Information-theoretic measures for anomaly detection

By Wenke Lee, Dong Xiang. Proceedings 2001 IEEE Symposium on Security and Privacy. S&P 2001, 2001

671 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/1b84b0b323c4572b065e41d8dc282fda03f2338b

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

An immunity-based technique to characterize intrusions in computer networks (2002, background): “There are multiple approaches to such anomaly detection [5], [7], [13]–[15], [22], [23], [26] and most of them work by building a model or profile of the system that reflects its normal behavior.”
A comprehensive survey on network anomaly detection (2018, background): “In this manner, it is possible to detect, for instance, a port scan attack, indicated by a change in the entropy of destination ports, or even the occurrence of a DDoS attack, denoted by changes in the entropy of source/destination IP addresses [127].”
Smart Anomaly Detection in Sensor Systems (2020, background): “Authors in [34] propose several measures for anomaly detection, namely: entropy, conditional entropy, relative conditional entropy, information gain and information cost.”
Outside the Closed World: On Using Machine Learning for Network Intrusion Detection (2010, background): “Often, they borrow schemes from the machine learning community, such as information theory [11], neural networks [12], support vector machines [13], genetic algorithms [14], artiﬁcial immune-systems [15], and many more.”
A Unifying Review of Deep and Shallow Anomaly Detection (2020, background): “perspective [564], [565], yet we think this could be fertile ground for building a better theoretical understanding of representation learning for AD.”
A hybrid machine learning approach to network anomaly detection (2007, methodology): “Diﬀering from the other researchers, Wenke Lee’s research [26] focuses on theoretical measures for anomaly detection.”
An empirical evaluation of entropy-based traffic anomaly detection (2008, background): “Lee and Xiang [12] propose information-theoretic measures for intrusion detection.”
“Andromaly”: a behavioral malware detection framework for android devices (2012, background): “Lee et al. (2002) examined the major cost factors associated with an IDS which include development cost, operational cost, damage cost due to successful intrusions, and the cost of manual and automated response to intrusions.”
Outlier Analysis (2013, methodology): “A variety of information theoretic methods for outlier detection are discussed in [34, 45, 74, 96, 123, 211, 212, 297, 410].”
A survey of network anomaly detection techniques (2016, background): “In a paper by Lee and Xiang (2001), several measures, such as entropy, conditional entropy, relative entropy, information gain and information cost, are used to explain the characteristics of a dataset.”
Graph-based anomaly detection (2003, background): “, [2]), but little work has been focused on graph-based data.”
Hiding Intrusions: From the Abnormal to the Normal and Beyond (2002, methodology): “The anomaly detector evaluation that led to our work has a sound scientific basis, but the application of these detectors to intrusion detection is very much ad hoc as has been noted by Lee and Xiang [18].”
DDoS Attack Detection and Mitigation Using SDN: Methods, Practices, and Solutions (2017, methodology): “Therefore, these techniques are used for anomaly detection extensively in traditional intrusion detection systems [35–37].”
A Roadmap Toward the Resilient Internet of Things for Cyber-Physical Systems (2018, background): “Information-theoretic By investigating the information content described by, e.g., the entropy of the information, one may draw conclusion about anomalies in the data (for information-theoretic measures characterizing regularity in data see [133]).”
Anomaly detection: A survey (2009, methodology): “, have also been used to measure the complexity of a categorical data set [Lee and Xiang 2001; He et al. 2005; He et al. 2006; Ando 2007].”
Eviction of Misbehaving and Faulty Nodes in Vehicular Networks (2007, background): “Most notably, [36] successfully applied the notion of relative entropy (also known as the Kullback-Leibler distance) to measure the similarity between two datasets.”