Network anomaly detection with the restricted Boltzmann machine

Neurocomputing

Volumn 122, Issue , 2013, Pages 13-23

  Fiore, Ugo ^a   Palmieri, Francesco ^b   Castiglione, Aniello ^c   De Santis, Alfredo ^c  

^a UNIVERSITY OF NAPLES FEDERICO II   (Italy)

^b SECOND UNIVERSITY OF NAPLES   (Italy)

^c UNIVERSITY OF SALERNO   (Italy)

Author keywords

Anomaly detection; Energy based models; Intrusion detection; Restricted Boltzmann machine; Semi supervised learning

Indexed keywords

ANOMALY DETECTION; ANOMALY DETECTION SYSTEMS; ENERGY-BASED MODELS; INCOMPLETE TRAINING DATA; MACHINE LEARNING TECHNIQUES; NETWORK ANOMALY DETECTION; RESTRICTED BOLTZMANN MACHINE; SEMI-SUPERVISED LEARNING;

CLASSIFICATION (OF INFORMATION); INTRUSION DETECTION; SUPERVISED LEARNING;

COMPLEX NETWORKS;

ACCURACY; ALGORITHM; ANALYTICAL PARAMETERS; ARTICLE; ARTIFICIAL NEURAL NETWORK; COMPUTER NETWORK; DISCRIMINATIVE RESTRICTED BOLTZMANN MACHINE; INFORMATION PROCESSING; KNOWLEDGE; LEARNING; MACHINE LEARNING; METHODOLOGY; PERCEPTRON; PRIORITY JOURNAL; RECOGNITION; STATISTICAL ANALYSIS; VELOCITY;

EID: 84884203185     PISSN: 09252312     EISSN: 18728286     Source Type: Journal    
DOI: 10.1016/j.neucom.2012.11.050     Document Type: Article

References (29)

1. Chandola V., Banerjee A., Kumar V. Anomaly detection. a survey. ACM Comput. Surv. 2009, 41(3). 15:1-15:58.
2. J P. Anderson, Computer Security Threat Monitoring and Surveillance, Technical Report, Computer Security Division of the Information Technology Laboratory, National Institute of Standards and Technology, 1980.
3. Garcia-Teodoro P., Diaz-Verdejo J., Macia-Fernandez G., Vazquez E. Anomaly-based network intrusion detection. techniques, systems and challenges. Comput. Secur. 2009, 28(1-2):18-28.
4. M. Ficco, L. Romano, A generic intrusion detection and diagnoser system based on complex event processing, in: Proceedings - 1st International Conference on Data Compression, Communication, and Processing, CCP 2011, IEEE, 2011, pp. 275-284.
5. Palmieri F., Fiore U. A nonlinear, recurrence-based approach to traffic classification. Comput. Networks 2009, 53(6):761-773.
6. Palmieri F., Fiore U. Network anomaly detection through nonlinear analysis. Comput. Secur. 2010, 29(7):737-755.
7. Noto K., Brodley C., Slonim D. FRaC. a feature-modeling approach for semi-supervised and unsupervised anomaly detection. Data Mining knowl. Discovery 2012, 25(1):109-133.
8. C.-H. Mao, H.-M. Lee, D. Parikh, T. Chen, S.-Y. Huang, Semi-supervised co-training and active learning based approach for multi-view intrusion detection, in: Proceedings of the 2009 ACM symposium on Applied Computing, SAC '09, ACM, 2009, pp. 2042-2048.
9. C. Chen, Y. Gong, Y. Tian, Semi-supervised learning methods for network intrusion detection, in: IEEE International Conference on Systems, Man and Cybernetics, 2008, SMC '08, IEEE, 2008, pp. 2603-2608.
10. Lei J.Z., Ghorbani A.A. Improved competitive learning neural networks for network intrusion and fraud detection. Neurocomputing 2012, 75(1):135-145.
11. T. Ahmed, B. Oreshkin, M. Coates, Machine learning approaches to network anomaly detection, in: Proceedings of the 2nd USENIX Workshop on Tackling Computer Systems Problems with Machine Learning Techniques, SYSML'07, USENIX Association, Berkeley, CA, USA, 2007, pp. 7:1-7:6.
12. M. Davenport, R. Baraniuk, C. Scott, Learning minimum volume sets with support vector machines, in: Proceedings of the 2006 16th IEEE Signal Processing Society Workshop on Machine Learning for Signal Processing, 2006, IEEE, 2006, pp. 301-306.
13. Bengio Y. Learning deep architectures for AI. Found. Trends Mach. Learn. 2009, 2(1):1-127.
14. Hinton G.E. To recognize shapes, first learn to generate images. Prog. Brain Res. 2007, 165:535-547.
15. Hinton G., Salakhutdinov R. Reducing the dimensionality of data with neural networks. Science 2006, 313(5786):504-507.
16. Salama M.A., Eid H.F., Ramadan R.A., Darwish A., Hassanien A.E. Hybrid intelligent intrusion detection scheme. Soft Comput. Ind. Appl. 2011, 293-303.
17. Bishop C.M. Pattern Recognition and Machine Learning 2006, Springer.
18. Ogiela L., Ogiela M.R. Advances in Cognitive Information Systems Cognitive Systems Monographs 2012, vol. 17. Springer.
19. G.E. Hinton, A Practical Guide to Training Restricted Boltzmann Machines, Momentum, vol. 9, 2010, pp. 1-21.
20. Rumelhart D.E., Hintont G.E., Williams R.J. Learning representations by back-propagating errors. Nature 1986, 323(6088):533-536.
21. Glorot X., Bengio Y. Understanding the difficulty of training deep feedforward neural networks. J. Mach. Learn. Res. - Proc. Track 2010, 9:249-256.
22. H. Larochelle, Y. Bengio, Classification using Discriminative Restricted Boltzmann Machines, in: Proceedings of the Twenty-Fifth International Conference on Machine Learning (ICML 2008), ACM, 2008, pp. 536-543.
23. Janeway C., Travers P., Walport M., Capra J. Immunobiology. The Immune System in Health and Disease 2001, Garland Science.
24. Palmieri F., Fiore U. Automated detection and containment of worms and viruses into heterogeneous networks. a simple network immune system. Int. J. Wireless Mobile Comput. 2007, 2(1):47-58.
25. Ou C.-M. Host-based intrusion detection systems adapted from agent-based artificial immune systems. Neurocomputing 2012, 88(0):78-86.
26. J.-S.R. Lee, H.-D.J. Jeong, D.C. McNickle, K. Pawlikowski, Self-Similar Properties of Spam, in: Proceedings of the Fifth International Conference on Innovative Mobile and Internet Services in Ubiquitous Computing, IMIS, IEEE, 2011, pp. 347-352.
27. A. Castiglione, A. De Santis, U. Fiore, F. Palmieri, Device tracking in private networks via NAPT log analysis, in: Innovative Mobile and Internet Services in Ubiquitous Computing (IMIS), 2012 Sixth International Conference on, IEEE, 2012, pp. 603-608.
28. S.T. Brugger, J. Chow, An Assessment of the DARPA IDS Evaluation Dataset Using Snort, Technical Report, University of California, Davis, Department of Computer Science, 2007.
29. A. Castiglione, R. De Prisco, A. De Santis, U. Fiore, F. Palmieri, A botnet-based command and control approach relying on swarm intelligence, J. Network Comput. Appl., in press. http://dx.doi.org/10.1016/j.jnca.2013.05.002.