An Anomaly Detection Framework for Detecting Anomalous Virtual Machines under Cloud Computing Environment

GuiPing Wang,JiaWei Wang 보안공학연구지원센터 2016 International Journal of Security and Its Applicat Vol.10 No.1

A variety of faults may cause performance degradation or even downtime of virtual machines (VMs) under Cloud environment, thus lowering the dependability of Cloud platform. Detecting anomalous VMs before real failures occur is an important means to improve the dependability of Cloud platform. Since the performance or state of VMs may be affected by the environmental factors, this article proposes an environment-aware anomaly detection framework (termed EaAD) for VMs under Cloud environment. EaAD partitions all the VMs in Cloud platform into several monitoring domains based on similarity in running environment, which makes the VMs in a same monitoring domain have similar running environment. In each domain, the equipped anomaly detection algorithm detects anomalous VMs based on their performance metrics. In addition, anomaly detection in a certain monitoring domain faces such challenges as multiple anomaly categories, imbalanced training sample sets, increasing number of training samples. To cope with these challenges, several support vector machine (SVM) based anomaly detection algorithms are implemented and equipped in EaAD, including C-SVM, OCSVM, multi-class SVM, imbalanced SVM, online learning SVM. This article conducts experiments on EaAD to test the performance of the adopted detection algorithms and looks into future work.

UFKLDA: An unsupervised feature extraction algorithm for anomaly detection under cloud environment

GuiPing Wang,JianXi Yang,Ren Li 한국전자통신연구원 2019 ETRI Journal Vol.41 No.5

In a cloud environment, performance degradation, or even downtime, of virtual machines (VMs) usually appears gradually along with anomalous states of VMs. To better characterize the state of a VM, all possible performance metrics are collected. For such high‐dimensional datasets, this article proposes a feature extraction algorithm based on unsupervised fuzzy linear discriminant analysis with kernel (UFKLDA). By introducing the kernel method, UFKLDA can not only effectively deal with non‐Gaussian datasets but also implement nonlinear feature extraction. Two sets of experiments were undertaken. In discriminability experiments, this article introduces quantitative criteria to measure discriminability among all classes of samples. The results show that UFKLDA improves discriminability compared with other popular feature extraction algorithms. In detection accuracy experiments, this article computes accuracy measures of an anomaly detection algorithm (i.e., C‐SVM) on the original performance metrics and extracted features. The results show that anomaly detection with features extracted by UFKLDA improves the accuracy of detection in terms of sensitivity and specificity.

Anomaly-based Intrusion Detection using Multiclass-SVM with Parameters Optimized by PSO

GuiPing Wang,ShuYu Chen,Jun Liu 보안공학연구지원센터 2015 International Journal of Security and Its Applicat Vol.9 No.6

Intrusion detection systems (IDS) play an important role in defending network systems from insider misuse as well as external attackers. Compared with misuse-based techniques, anomaly-based intrusion detection techniques perform well in detecting new attacks. Firstly, this paper proposes a feature selection algorithm based on SVM (termed FS-SVM) to reduce the dimensionality of sample data. Moreover, this paper presents an anomaly-based intrusion detection algorithm, i.e., multiclass support vector machine (MSVM) with parameters optimized by particle swarm optimization (PSO) (termed MSVM-PSO), to detect anomalous connections. To verify the effectiveness of these two proposed algorithms (FS-SVM and MSVM-PSO) and the detection precision of MSVM-PSO, this paper conducts experiments on the famous KDD Cup dataset. This paper compares MSVM-PSO with three commonly adopted algorithms, namely, Bayesian, K-Means, and multiclass SVM with parameters optimized grid method (MSVM-grid). The experimental results show that MSVM-PSO outperforms these three algorithms in detection accuracy, FP rate, and FN rate.

Effect of Easy Transaction, Consumer Interests, and Systems Security Level Measures against Fraud Online Shopping in Lazada

GuiPing Wang,Ren Li,XiaoYi Yuan 보안공학연구지원센터 2016 International Journal of Security and Its Applicat Vol.10 No.12

This study aimed to examine the effect of the ease of the transaction, the consumer interest, and the level of system security against acts of fraud on online shopping. Ease of transaction is measured from the transaction speed, high accuracy, high volume transaction, highly correlated, and ease of access are high. Measurement of consumer interests is including motivation, perception, learning, and memory. System security level measured from the privacy, integrity, autentication, availability, and access control.Sample selection is done by using purposive sampling method. The research data were collected from students of the Faculty of Economics, University of Trisakti. The samples used were 100 accounting students from semesters 1 to 9. The analysis technique used is multiple regression in SPSS version 23. The results showed that the factors such as the ease of transactions, consumer interest, and the security level of the system is partially measured by the transaction speed, high accuracy, high volume transaction are highly correlated. Meanwhile, ease of access is high, motivation, perception, learning and memory does not have a significant effect on the action of cheating but the privacy, integrity, autentication, availability. The access control can influence the actions of fraud significantly. Influence ease of transactions, consumer interest, and the security level of positive and significant impact on fraud actions simultaneously.

An Anomaly Detection Framework Based on ICA and Bayesian Classification for IaaS Platforms

( Guiping Wang ),( Jianxi Yang ),( Ren Li ) 한국인터넷정보학회 2016 KSII Transactions on Internet and Information Syst Vol.10 No.8

Infrastructure as a Service (IaaS) encapsulates computer hardware into a large amount of virtual and manageable instances mainly in the form of virtual machine (VM), and provides rental service for users. Currently, VM anomaly incidents occasionally occur, which leads to performance issues and even downtime. This paper aims at detecting anomalous VMs based on performance metrics data of VMs. Due to the dynamic nature and increasing scale of IaaS, detecting anomalous VMs from voluminous correlated and non-Gaussian monitored performance data is a challenging task. This paper designs an anomaly detection framework to solve this challenge. First, it collects 53 performance metrics to reflect the running state of each VM. The collected performance metrics are testified not to follow the Gaussian distribution. Then, it employs independent components analysis (ICA) instead of principal component analysis (PCA) to extract independent components from collected non-Gaussian performance metric data. For anomaly detection, it employs multi-class Bayesian classification to determine the current state of each VM. To evaluate the performance of the designed detection framework, four types of anomalies are separately or jointly injected into randomly selected VMs in a campus-wide testbed. The experimental results show that ICA-based detection mechanism outperforms PCA-based and LDA-based detection mechanisms in terms of sensitivity and specificity.

A Dependable Monitoring Mechanism Combining Static and Dynamic Anomaly Detection for Network Systems

GuiPing Wang,ShuYu Chen,Zhen Zhou,MingWei Lin 보안공학연구지원센터 2014 International Journal of Future Generation Communi Vol.7 No.1

Imbalanced SVM-Based Anomaly Detection Algorithm for Imbalanced Training Datasets

GuiPing Wang,JianXi Yang,Ren Li 한국전자통신연구원 2017 ETRI Journal Vol.39 No.5

Abnormal samples are usually difficult to obtain in production systems, resulting in imbalanced training sample sets. Namely, the number of positive samples is far less than the number of negative samples. Traditional Support Vector Machine (SVM)-based anomaly detection algorithms perform poorly for highly imbalanced datasets: the learned classification hyperplane skews toward the positive samples, resulting in a high false-negative rate. This article proposes a new imbalanced SVM (termed ImSVM)- based anomaly detection algorithm, which assigns a different weight for each positive support vector in the decision function. ImSVM adjusts the learned classification hyperplane to make the decision function achieve a maximum GMean measure value on the dataset. The above problem is converted into an unconstrained optimization problem to search the optimal weight vector. Experiments are carried out on both Cloud datasets and Knowledge Discovery and Data Mining datasets to evaluate ImSVM. Highly imbalanced training sample sets are constructed. The experimental results show that ImSVM outperforms over-sampling techniques and several existing imbalanced SVM-based techniques.

Monitoring Neighborhood Self-organization and Message Dissemination for Monitoring Large-scale Distributed Systems

ShuYu Chen,GuiPing Wang,Jun Liu,MingWei Lin 보안공학연구지원센터 2015 International Journal of Hybrid Information Techno Vol.8 No.1

In order to successfully monitor a large-scale distributed system, it is an important issue that the monitoring function fully covers all the entities in the system. To this end, a key challenge is to efficiently transmit state information of the entities in the system. This paper solves this challenge from two aspects. First, in virtue of the idea of self-organizing networks, this paper proposes a neighborhood organization algorithm, which self-organizes the nodes into several monitoring neighborhoods based on the t distance between nodes. The second aspect focuses on message transmission. There are three common message transmission methods in network, i.e., flooding, multicast and unicast. Flooding may cause high network overhead, while unicast may pose high system delay. Based on the idea of Gossip protocol, this paper proposes a directional message dissemination algorithm (D-Gossip), which is a kind of probabilistic multicast. D-Gossip reduces message dissemination uncertainty of traditional Gossip protocols. It effectively improves the efficiency and coverage of message dissemination, while reducing redundant information in the system due to Gossip protocol. The experimental results show that the neighborhood organization algorithm and the D-Gossip can effectively solve the above challenge.

An evaluation of trimethyl phosphate on deactivation of Cu/Zn catalyst in hydrogenation of dodecyl methyl ester

Guiping Cao,Hui Huang,Shaohong Wang 한국화학공학회 2013 Korean Journal of Chemical Engineering Vol.30 No.9

The effect of trimethyl phosphate on Cu/Zn catalyst prepared by co-precipitation method for hydrogenation of methyl laurate to dodecanol in a slurry phase was studied using a stirred autoclave reactor system. The catalysts were characterized by means of XRD, EDS, XPS, SEM and BET. The results indicated that catalytic activity decreased with the increased amount of trimethyl phosphate. Correlating with the results from the above characterization, it was found that the main cause for the catalyst deactivation was the trimethyl phosphate occlusion of active sites by the physical adsorption and BET surface area decrement.

Hybrid energy storage bidirectional DC–DC converter based on Hermite interpolation and linear active disturbance rejection control

Hao Zheng,Guiping Du,Yanxiong Lei,Ruijing Wang 전력전자학회 2023 JOURNAL OF POWER ELECTRONICS Vol.23 No.6

The steady and transient performance of a bidirectional DC–DC converter (BDC) is the key to regulating bus voltage and maintaining power balance in a hybrid energy storage system. In this study, the state of charge of the energy storage element (ESE) is used to calculate the converter current control coefficient (CCCC) via Hermite interpolation. Moreover, the charging and discharging currents of the BDC are controlled by the CCCC. Thus, the ESE runs in the best working region. The linear active disturbance rejection control is used in the current inner loop of BDC to solve the problems of slow dynamic response and parameter tuning in traditional PI control. The method can deal with the great transient response and a vast range of uncertainties, improve the BDC response speed by more than 20%, compensate for the unbalanced power timely, reduce the bus voltage fluctuation, and enhance the disturbance immunity of the system. The proposed method is verified by simulations and experiments.