A GEOMETRIC FRAMEWORK FOR UNSUPERVISED ANOMALY DETECTION: DETECTING INTRUSIONS IN UNLABELED DATA

By Eleazar Eskin, Andrew O. Arnold, Michael J. Prerau. 2002

795 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

View Paper: https://www.semanticscholar.org/paper/2981e8267135dae55c0c061ee214e888ecbef099

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

Incremental Support Vector Learning: Analysis, Implementation and Applications (2006, background): “…data sets (cf. LeCun et al. (1998)) or even have to perform real-time estimation tasks for continuous data streams, such as in intrusion detection (e.g. Laskov et al. (2004); Eskin et al. (2002)), web-mining (e.g. Chakrabarti (2002)) or brain computer interfacing (e.g. Blankertz et al. (2003)).”
A comprehensive survey on machine learning for networking: evolution, applications and research opportunities (2018, methodology): “The KDD dataset is used for evaluation and shows that IMM outperforms three related works [131, 139, 363] in terms of detection rate and FP.”
Classifier ensembles: Select real-world applications (2008, background): “Part of the problem is that many of the anomaly detection systems devised in the literature are monolithic models that are designed to cover all protocols and services offered by the computer system and network [86,69,29].”
Detecting Unknown Network Attacks Using Language Models (2006, methodology): “In the ensuing work these ideas were extended through application of Hidden Markov Models (21), feed-forward and recursive neural networks (23), rule induction algorithms (47) and Support Vector Machines (14).”
Anomaly Based Network Intrusion Detection with Unsupervised Outlier Detection (2006, methodology): “Compared to other unsupervised anomaly based systems [1, 9], our system provides better performance over the KDD’99 dataset while the false positive rate is low.”
Toward Supervised Anomaly Detection (2014, positive): “For instance, ﬁnding anomalies in network trafﬁc (Eskin et al., 2002) or program behaviour (Heller, Svore, Keromytis, & Stolfo, 2003), denoising patterns (Park, Kang, Kim, Kwok, & Tsang, 2007) or annotating (Goh, Chang, & Li, 2005) and classifying images (Lai, Tax, Duin, Zbieta, Ekalska, & Ik,…”
Behavior of Machine Learning Algorithms in Adversarial Environments (2010, background): “Because this approach often fails to detect novel intrusions, a variety of researchers have proposed incorporating machine learning techniques into intrusion detection systems [e.g., Mahoney and Chan, 2002, Lazarevic et al., 2003, Mukkamala et al., 2002, Eskin et al., 2002].”
Machine Learning in the Presence of an Adversary: Attacking and Defending the SpamBayes Spam Filter (2008, background): “Often, security sensitive tasks, such as network intrusion/extrusion detection, financial fraud detection, virus and worm detection, and spam filtering use statistical machine learning algorithms to improve data classification [5, 12, 13, 17, 18, 23].”
McPAD: A multiple classifier system for accurate payload-based anomaly detection (2009, methodology): “One-class classiﬁcation algorithms pursue concept learning in absence of counter examples [31], and have been shown to be promising for network anomaly detection [12].”
Incremental Local Outlier Detection for Data Streams (2007, methodology): “replicator neural networks [13] or unsupervised support vector machines [4, 12]), and then detect outliers as deviations from the learned model.”
Unsupervised Anomaly Detection in Network Intrusion Detection Using Clusters (2005, methodology): “Eskin, et al. (Eskin et al. 2002) investigated the effectiveness of three algorithms in intrusion detection: the (cid:12)xed-width clustering algorithm, an optimised version of the k -nearest neighbour algorithm, and the one class support vector machine algorithm.”
Intrusion detection by machine learning: A review (2009, neutral): “…et al. (2004), Eskin et al. (2002), Li and Guo (2007), Liao and Vemuri (2002), Wang and Stolfo (2004), Wang et al. (2004) Chen et al. (2005), Eskin et al. (2002), Heller et al. (2003), Peddabachigari et al. (2004), Tian et al. (2004), Wang and Battiti (2006), Zhang and Shen (2005) Schultz…”
Outlier Detection for Temporal Data: A Survey (2014, methodology): “…: Popular clustering methods include k -Means [25], EM [26], phased k -Means [27], dynamic clustering [24], k-medoids [21], [22], single-linkage clustering [28], clustering of multi-variate time series in the principal components space [29], one-class SVM [30]–[33] and self-organizing maps [34].”