이상탐지 알고리즘 성능 비교:이상치 유형과 데이터 속성 관점에서

김재웅,정승렬,김남규 한국지능정보시스템학회 2023 지능정보연구 Vol.29 No.3

With the increasing emphasis on anomaly detection across various fields, diverse anomaly detection algorithms have been developed for various data types and anomaly patterns. However, the performance of anomaly detection algorithms is generally evaluated on publicly available datasets, and the specific performance of each algorithm on anomalies of particular types remains unexplored. Consequently, selecting an appropriate anomaly detection algorithm for specific analytical contexts poses challenges. Therefore, in this paper, we aim to investigate the types of anomalies and various attributes of data. Subsequently, we intend to propose approaches that can assist in the selection of appropriate anomaly detection algorithms based on this understanding. Specifically, this study compares the performance of anomaly detection algorithms for four types of anomalies: local, global, contextual, and clustered anomalies. Through further analysis, the impact of label availability, data quantity, and dimensionality on algorithm performance is examined. Experimental results demonstrate that the most effective algorithm varies depending on the type of anomaly, and certain algorithms exhibit stable performance even in the absence of anomaly-specific information. Furthermore, in some types of anomalies, the performance of unsupervised anomaly detection algorithms was observed to be lower than that of supervised and semi-supervised learning algorithms. Lastly, we found that the performance of most algorithms is more strongly influenced by the type of anomalies when the data quantity is relatively scarce or abundant. Additionally, in cases of higher dimensionality, it was noted that excellent performance was exhibited in detecting local and global anomalies, while lower performance was observed for clustered anomaly types.

An Effective Anomaly Detection Approach based on Hybrid Unsupervised Learning Technologies in NIDS

김강석 한국인터넷정보학회 2024 KSII Transactions on Internet and Information Syst Vol.18 No.2

Internet users are exposed to sophisticated cyberattacks that intrusion detection systems have difficulty detecting. Therefore, research is increasing on intrusion detection methods that use artificial intelligence technology for detecting novel cyberattacks. Unsupervised learning-based methods are being researched that learn only from normal data and detect abnormal behaviors by finding patterns. This study developed an anomaly-detection method based on unsupervised machines and deep learning for a network intrusion detection system (NIDS). We present a hybrid anomaly detection approach based on unsupervised learning techniques using the autoencoder (AE), Isolation Forest (IF), and Local Outlier Factor (LOF) algorithms. An oversampling approach that increased the detection rate was also examined. A hybrid approach that combined deep learning algorithms and traditional machine learning algorithms was highly effective in setting the thresholds for anomalies without subjective human judgment. It achieved precision and recall rates respectively of 88.2% and 92.8% when combining two AEs, IF, and LOF while using an oversampling approach to learn more unknown normal data improved the detection accuracy. This approach achieved precision and recall rates respectively of 88.2% and 94.6%, further improving the detection accuracy compared with the hybrid method. Therefore, in NIDS the proposed approach provides high reliability for detecting cyberattacks.

Detection of multi-type data anomaly for structural health monitoring using pattern recognition neural network

Shun Weng,Ke Gao,Zhi-Dan Chen,Hong Ping Zhu,Li-Ying Wu 국제구조공학회 2022 Smart Structures and Systems, An International Jou Vol.29 No.1

The effectiveness of system identification, damage detection, condition assessment and other structural analyses relies heavily on the accuracy and reliability of the measured data in structural health monitoring (SHM) systems. However, data anomalies often occur in SHM systems, leading to inaccurate and untrustworthy analysis results. Therefore, anomalies in the raw data should be detected and cleansed before further analysis. Previous studies on data anomaly detection mainly focused on just single type of data anomaly for denoising or removing outliers, meanwhile, the existing methods of detecting multiple data anomalies are usually time consuming. For these reasons, recognising multiple anomaly patterns for real-time alarm and analysis in field monitoring remains a challenge. Aiming to achieve an efficient and accurate detection for multi-type data anomalies for field SHM, this study proposes a pattern-recognition-based data anomaly detection method that mainly consists of three steps: the feature extraction from the long time-series data samples, the training of a pattern recognition neural network (PRNN) using the features and finally the detection of data anomalies. The feature extraction step remarkably reduces the time cost of the network training, making the detection process very fast. The performance of the proposed method is verified on the basis of the SHM data of two practical long-span bridges. Results indicate that the proposed method recognises multiple data anomalies with very high accuracy and low calculation cost, demonstrating its applicability in field monitoring.

Toward Anomaly Detection in IaaS Cloud Computing Platforms

Mingwei Lin,Zhiqiang Yao,Fei Gao,Yang Li 보안공학연구지원센터 2015 International Journal of Security and Its Applicat Vol.9 No.12

In order to monitor the running status of IaaS cloud computing platforms, performance metric data are collected to perform anomaly detection for IaaS cloud computing platforms and determine whether the IaaS cloud computing platforms fail to run normally. However, it is challenging to effectively detect performance anomalies from a large amount of noisy and high dimensional performance metric data. In this paper, an efficient anomaly detection scheme is proposed for IaaS cloud computing platforms. The proposed scheme first designs a global locality preserving projection algorithm to perform feature extraction on performance metric data, and then introduces a local outlier factor algorithm to detect anomalies. A series of experiments are conducted on a private cloud computing platform. Experimental results show that our proposed global locality preserving projection algorithm outperforms the principal components analysis algorithm and the locality preserving projection algorithm and our proposed anomaly detection scheme is better than the state-of-the-art schemes for IaaS cloud computing platforms.

이상 탐지 기반 퍼스널 모빌리티 사용자 인식 및 운전보조 응용

노동현,이재열 한국CDE학회 2022 한국CDE학회 논문집 Vol.27 No.3

As the number of personal mobility users increases, it is essential to protect both personal mobility users and car drivers. Although existing supervised learning-based object detection methods can recognize personal mobilities, processing for data collection, labeling, and training is time-consuming and expensive whenever new forms of personal mobilities come to the market. Anomaly detection-based methods are proposed to learn normal patterns and detect abnormal patterns without prior training. This study proposes a new approach to personal mobility user recognition using deep learning-based anomaly detection in dynamically changing driving environments. The proposed approach consists of Human detection, Cropping and Anomaly detection modules. The Human detection module detects human regions. The Cropping module removes unnecessary areas and performs a preprocessing. The memory-based Anomaly detection module distinguishes between pedestrians and personal mobility users. Based on the proposed anomaly detection method, augmented reality (AR) visualization in the head-up display (HUD) is proposed for effective driving assistance. Since it is possible to distinguish pedestrians and mobility users effectively, the AR HUD-based visualization can assist the driver to pay more attention to the mobility user.

빅데이터 기반의 IoT 이상 장애 탐지 시스템 설계

나성일,김형중 한국디지털콘텐츠학회 2018 한국디지털콘텐츠학회논문지 Vol.19 No.2

Internet of Things (IoT) is producing various data as the smart environment comes. The IoT data collection is used as important data to judge systems’s status. Therefore, it is important to monitor the anomaly state of the sensor in real-time and to detect anomaly data. However, it is necessary to convert the IoT data into a normalized data structure for anomaly detection because of the variety of data structures and protocols. Thus, we can expect a good quality effect such as accurate analysis data quality and service quality. In this paper, we propose an anomaly detection system based on big data from collected sensor data. The proposed system is applied to ensure anomaly detection and keep data quality. In addition, we applied the machine learning model of support vector machine using anomaly detection based on time-series data. As a result, machine learning using preprocessed data was able to accurately detect and predict anomaly. 사물인터넷(IoT) 서비스는 스마트 환경이 발전하면서 다양한 데이터를 생산하고 있다. 이 데이터는 사용자의 상황을 판단하는 중요한 데이터로 사용된다. 그렇기 때문에 센서의 이상 상태를 실시간으로 모니터링하고 이상 데이터를 탐지하는 것이 중요하다. 하지만 데이터 구조와 프로토콜이 다양하기 때문에 표준화된 데이터 구조로 변환하는 과정이 필요하다. 그럼으로써 데이터의 품질을 보장하고 정확한 분석을 통해 서비스의 품질까지 좋아지는 효과를 기대할 수 있다. 본 논문은 수집된 센서의 이상탐지를 위해 빅데이터 기반의 이상탐지 시스템을 제안한다. 제안한 시스템은 이상탐지를 위해 데이터 표준화 전처리와 시계열 기반의 이상탐지가 우수한 SVM(Support Vector Machine) 모델을 적용하였다. 실험에서는 전처리 와 전처리되지 않은 데이터를 각각 학습시키고 비교하였다. 그 결과, 전처리된 데이터는 이상 장애를 정확히 탐지하고 예측하였다.

An Algorithm of Clustering by Density Peaks Using in Anomaly Detection

Chunyong Yin,Sun Zhang,Zhichao Yin,Jin Wang 보안공학연구지원센터 2015 International Journal of Security and Its Applicat Vol.9 No.12

With the development of the networks, the security of computer networks is becoming more and more serious. The information openness, sharing and interconnection are three important characteristics of computer networks. However, the amounts of intruders and attackers have been grows with the popularization of computers. Therefore, the focus of network security is preventing systems from being invaded effectively. Intrusion detection as a key technology of network security active defense system is designed to distinguish normal behaviors and attack behaviors. Intrusion detection is divided into misuse detection and anomaly detection, and using clustering algorithm is one of the most effective methods for anomaly detection. In this paper, a clustering algorithm based on fast search and find of density peaks is used to distinguish the normal and abnormal network connections to achieve the purpose of anomaly detection. The performance of the algorithm is tested by a data set selected from KDD CUP99. Experiment results show that this algorithm is more suitable than the traditional K-means in data sets containing a large amount of data and uneven density distribution.

A Novel Network Anomaly Detection Method based on Data Balancing and Recursive Feature Addition

( Xinqian Liu ),( Jiadong Ren ),( Haitao He ),( Qian Wang ),( Shengting Sun ) 한국인터넷정보학회 2020 KSII Transactions on Internet and Information Syst Vol.14 No.7

Network anomaly detection system plays an essential role in detecting network anomaly and ensuring network security. Anomaly detection system based machine learning has become an increasingly popular solution. However, due to the unbalance and high-dimension characteristics of network traffic, the existing methods unable to achieve the excellent performance of high accuracy and low false alarm rate. To address this problem, a new network anomaly detection method based on data balancing and recursive feature addition is proposed. Firstly, data balancing algorithm based on improved KNN outlier detection is designed to select part respective data on each category. Combination optimization about parameters of improved KNN outlier detection is implemented by genetic algorithm. Next, recursive feature addition algorithm based on correlation analysis is proposed to select effective features, in which a cross contingency test is utilized to analyze correlation and obtain a features subset with a strong correlation. Then, random forests model is as the classification model to detection anomaly. Finally, the proposed algorithm is evaluated on benchmark datasets KDD Cup 1999 and UNSW_NB15. The result illustrates the proposed strategies enhance accuracy and recall, and decrease the false alarm rate. Compared with other algorithms, this algorithm still achieves significant effects, especially recall in the small category.

Tropospheric Anomaly Detection in Multi-Reference Stations Environment during Localized Atmospheric Conditions-(2) : Analytic Results of Anomaly Detection Algorithm

유윤자 한국항해항만학회 2016 한국항해항만학회지 Vol.40 No.5

Localized atmospheric conditions between multi-reference stations can bring the tropospheric delay irregularity that becomes an error terms affecting positioning accuracy in network RTK environment. Imbalanced network error can affect the network solutions and it can corrupt the entire network solution and degrade the correction accuracy. If an anomaly could be detected before the correction message was generated, it is possible to eliminate the anomalous satellite that can cause degradation of the network solution during the tropospheric delay anomaly. An atmospheric grid that consists of four meteorological stations was used to detect an inhomogeneous weather conditions and tropospheric anomaly applied AWSs (automatic weather stations) meteorological data. The threshold of anomaly detection algorithm was determined based on the statistical weather data of AWSs for 5 years in an atmospheric grid. From the analytic results of anomaly detection algorithm it showed that the proposed algorithm can detect an anomalous satellite with an anomaly flag generation caused tropospheric delay anomaly during localized atmospheric conditions between stations. It was shown that the different precipitation condition between stations is the main factor affecting tropospheric anomalies.

Data-driven Anomaly Detection Method for Monitoring Runtime Performance of Cloud Computing Platforms

Mingwei Lin,Zhiqiang Yao,Fei Gao,Yang Li 보안공학연구지원센터 2016 International Journal of Hybrid Information Techno Vol.9 No.2

Cloud computing platforms are complex system, which consist of a lot of software working together. Because of software defects, cloud computing platforms may has performance anomaly during runtime. In this paper, a data-driven anomaly detection method is proposed to monitor runtime performance for cloud computing platforms. The proposed method can not only detect the performance anomaly of cloud computing platforms during runtime, but also find out which performance metric results in the anomaly. A series of experiments are conducted on a real private cloud computing platform based on OpenStack and experimental results show the proposed method is better than previous anomaly detection methods for cloud computing platforms.