کد مقاله کد نشریه سال انتشار مقاله انگلیسی نسخه تمام متن
6902751 1446645 2018 13 صفحه PDF دانلود رایگان
عنوان انگلیسی مقاله ISI
A hierarchical hybrid framework for modelling anomalous behaviours
ترجمه فارسی عنوان
یک چارچوب ترکیبی سلسله مراتبی برای مدل سازی رفتارهای غیرمعمول
کلمات کلیدی
چارچوب نرم افزار، مدل سازی بی نظمی، تشخیص آنومالی، تشخیص امضا، تحلیل داده ها،
موضوعات مرتبط
مهندسی و علوم پایه مهندسی کامپیوتر علوم کامپیوتر (عمومی)
چکیده انگلیسی
The presence of anomalies in collected information, i.e. data that deviates substantially from what is normally expected, is a valuable source of knowledge and its discovery has many practical applications. Anomaly-detection approaches rely on building models that suitably describe data patterns deemed as normal, however they may incur the generation of a considerable amount of false positives. Signature-based techniques, which exploit a prior knowledge base of anomalous patterns, are able to effectively detect them but fail in identifying anomalies which did not occur previously. Hybrid anomaly detection systems combine the two approaches in order to obtain better detection performances. This paper proposes a framework, called HALF, that allows to develop hybrid systems by combining available techniques, coming from both approaches. HALF is able to operate on any data type and provides native support to online learning, or concept drifting. This enables the incremental updating of the knowledge bases used by the techniques. HALF has been designed to accommodate multiple mining algorithms by organizing them in a hierarchical structure in order to offer an higher and flexible detection capability. The framework effectiveness is demonstrated through two case studies concerning a network intrusion detection system and a steganography hunting system.
ناشر
Database: Elsevier - ScienceDirect (ساینس دایرکت)
Journal: Simulation Modelling Practice and Theory - Volume 82, March 2018, Pages 103-115
نویسندگان
, , , ,