Model fusion of deep neural networks for anomaly detection.

Autor:	AlDahoul, Nouar, Abdul Karim, Hezerul, Ba Wazir, Abdulaziz Saleh
Předmět:	ANOMALY detection (Computer security) INTRUSION detection systems (Computer security) DENIAL of service attacks FALSE alarms COMPUTER network security
Zdroj:	Journal of Big Data; 8/5/2021, Vol. 8 Issue 1, p1-18, 18p
Abstrakt:	Network Anomaly Detection is still an open challenging task that aims to detect anomalous network traffic for security purposes. Usually, the network traffic data are large-scale and imbalanced. Additionally, they have noisy labels. This paper addresses the previous challenges and utilizes million-scale and highly imbalanced ZYELL's dataset. We propose to train deep neural networks with class weight optimization to learn complex patterns from rare anomalies observed from the traffic data. This paper proposes a novel model fusion that combines two deep neural networks including binary normal/attack classifier and multi-attacks classifier. The proposed solution can detect various network attacks such as Distributed Denial of Service (DDOS), IP probing, PORT probing, and Network Mapper (NMAP) probing. The experiments conducted on a ZYELL's real-world dataset show promising performance. It was found that the proposed approach outperformed the baseline model in terms of average macro Fβ score and false alarm rate by 17% and 5.3%, respectively. [ABSTRACT FROM AUTHOR]
Databáze:	Complementary Index
Externí odkaz:	Zobrazit plný text záznamu Full text from SpringerLink