Hidden Markov models on a self-organizing map for anomaly detection in 802.11 wireless networks

Hidden Markov models on a self-organizing map for anomaly detection in 802.11 wireless networks
复制标题

DOI:
10.1007/s00521-020-05627-7
复制
发表时间:
2021-01
影响因子:
6
通讯作者:
Anisa Allahdadi;Diogo Pernes;Jaime S. Cardoso;Ricardo Morla
Anisa Allahdadi;Diogo Pernes;Jaime S. Cardoso;Ricardo Morla
中科院分区:
计算机科学3区
文献类型:
--
作者:
Anisa Allahdadi;Diogo Pernes;Jaime S. Cardoso;Ricardo Morla

文献摘要

被引文献

相似文献

目前的工作介绍了自组织映射和隐马尔可夫模型 (HMM) 的混合集成,用于 802.11 无线网络中的异常检测。自组织隐马尔可夫模型图 (SOHMMM) 处理 HMM 的空间连接以及数据序列固有的时间依赖性。本质上,HMM 与 SOHMMM 晶格的每个神经元相关联。本文采用 SOHMMM 算法对 802.11 无线接入点使用数据进行异常检测。此外,我们扩展了用于多元高斯发射的 SOHMMM 在线梯度下降无监督学习算法。实验分析使用两类数据:综合数据考察SOHMMM算法的准确性和收敛性,以及无线仿真数据验证该算法在异常检测中的意义和效率。将 SOHMMM 算法在异常检测中的灵敏度和特异性与其他两种方法进行了比较,即使用通用背景模型初始化的 HMM (HMM-UBM) 和零邻域的 SOHMMM (Z-SOHMMM)。无线仿真实验的结果表明,SOHMMM 在所有呈现的异常场景中都优于上述方法。
The present work introduces a hybrid integration of the self-organizing map and the hidden Markov model (HMM) for anomaly detection in 802.11 wireless networks. The self-organizing hidden Markov model map (SOHMMM) deals with the spatial connections of HMMs, along with the inherent temporal dependencies of data sequences. In essence, an HMM is associated with each neuron of the SOHMMM lattice. In this paper, the SOHMMM algorithm is employed for anomaly detection in 802.11 wireless access point usage data. Furthermore, we extend the SOHMMM online gradient descent unsupervised learning algorithm for multivariate Gaussian emissions. The experimental analysis uses two types of data:synthetic datato investigate the accuracy and convergence of the SOHMMM algorithm andwireless simulation datato verify the significance and efficiency of the algorithm in anomaly detection. The sensitivity and specificity of the SOHMMM algorithm in anomaly detection are compared to two other approaches, namely HMM initialized with universal background model (HMM-UBM) and SOHMMM with zero neighborhood (Z-SOHMMM). The results from the wireless simulation experiments show that SOHMMM outperformed the aforementioned approaches in all the presented anomalous scenarios.