Fast Tensor Factorization for Accurate Internet Anomaly Detection
Fast Tensor Factorization for Accurate Internet Anomaly Detection
复制标题
快速张量分解以实现准确的互联网异常检测
DOI：
10.1109/tnet.2017.2761704
复制
发表时间：
2017-12
期刊：
影响因子：
--
通讯作者：
Dafang Zhang
中科院分区：
文献类型：
--
作者：
Kun Xie;Xiaocan Li;Xin Wang;Gaogang Xie;Jigang Wen;Jiannong Cao;Dafang Zhang
异常流量检测是高级互联网管理的关键任务。近年来，人们提出了许多异常检测算法。然而，现有的算法往往受到基于矩阵的流量数据模型的限制，异常检测的准确性不高。为了充分利用隐藏在流量数据中的多维信息，本文主动研究了执行张量因子分解以更准确地检测互联网异常的潜力和方法。更具体地说，我们将流量数据建模为三向张量，并将异常检测问题制定为一个鲁棒的张量恢复问题，该问题具有对张量的秩和异常集的基数的约束。然而，这些限制使问题非常难以解决。我们提出TensorDet来直接有效地解决这个问题，而不是以低检测性能为代价诉诸凸松弛。为了提高异常检测的准确性和张量因式分解的速度，TensorDet利用了两种新技术，顺序张量截断和两阶段异常检测的因式分解结构。我们已经进行了广泛的实验，使用互联网流量跟踪数据Abilene和GARMANT。与张量恢复和基于矩阵的异常检测的最新算法相比，TensorDet可以显著降低假阳性率和提高真阳性率。特别是，得益于我们精心设计的算法，以减少张量因式分解的计算成本，张量因式分解过程中的TensorDet是5（Abilene）和13（GARMANT）倍的速度比传统的Tucker分解解决方案。
Detecting anomalous traffic is a critical task for advanced Internet management. Many anomaly detection algorithms have been proposed recently. However, constrained by their matrix-based traffic data model, existing algorithms often suffer from low accuracy in anomaly detection. To fully utilize the multi-dimensional information hidden in the traffic data, this paper takes the initiative to investigate the potential and methodologies of performing tensor factorization for more accurate Internet anomaly detection. More specifically, we model the traffic data as a three-way tensor and formulate the anomaly detection problem as a robust tensor recovery problem with the constraints on the rank of the tensor and the cardinality of the anomaly set. These constraints, however, make the problem extremely hard to solve. Rather than resorting to the convex relaxation at the cost of low detection performance, we propose TensorDet to solve the problem directly and efficiently. To improve the anomaly detection accuracy and tensor factorization speed, TensorDet exploits the factorization structure with two novel techniques, sequential tensor truncation and two-phase anomaly detection. We have conducted extensive experiments using Internet traffic trace data Abilene and GÈANT. Compared with the state of art algorithms for tensor recovery and matrix-based anomaly detection, TensorDet can achieve significantly lower false positive rate and higher true positive rate. Particularly, benefiting from our well designed algorithm to reduce the computation cost of tensor factorization, the tensor factorization process in TensorDet is 5 (Abilene) and 13 (GÈANT) times faster than that of the traditional Tucker decomposition solution.
登录
查看更多内容
DOI：
10.1109/cvpr.2003.1211457
发表时间：
2003-06
期刊：
2003 IEEE Computer Society Conference on Computer Vision and Pattern Recognition, 2003. Proceedings.
影响因子：
--
作者：
M. Alex O. Vasilescu;Demetri Terzopoulos
通讯作者：
M. Alex O. Vasilescu;Demetri Terzopoulos
影响因子：
7.9
作者：
Kun Xie;Xueping Ning;Xin Wang;Dongliang Xie;Jiannong Cao;Gaogang Xie;Jigang Wen
通讯作者：
Kun Xie;Xueping Ning;Xin Wang;Dongliang Xie;Jiannong Cao;Gaogang Xie;Jigang Wen
影响因子：
8.6
作者：
Manqi Zhao;Venkatesh Saligrama
通讯作者：
Manqi Zhao;Venkatesh Saligrama
DOI：
10.1007/s13042-011-0017-0
发表时间：
2011-03
影响因子：
5.6
作者：
Jie Li;Guan Han;Jing Wen;Xinbo Gao
通讯作者：
Jie Li;Guan Han;Jing Wen;Xinbo Gao
DOI：
10.2307/2530985
发表时间：
1980-07
期刊：
--
影响因子：
--
作者：
V. Barnett;T. Lewis
通讯作者：
V. Barnett;T. Lewis