Adaptive anomaly detection with evolving connectionist systems
Adaptive anomaly detection with evolving connectionist systems
复制标题
DOI：
10.1016/j.jnca.2005.08.005
复制
发表时间：
2007
期刊：
影响因子：
--
通讯作者：
Y. Liao;V. Rao Vemuri;Alejandro Pasos
中科院分区：
文献类型：
--
作者：
Y. Liao;V. Rao Vemuri;Alejandro Pasos
异常检测在检测以前未知的攻击方面具有很大的潜力。为了在实际环境中有效，异常检测系统必须能够在线学习和处理概念漂移。在本文中，一个新的自适应异常检测框架，使用无监督的不断发展的连接主义系统的基础上，提出了解决这些问题。它的设计是为了适应正常的行为变化，同时仍然识别异常。不断发展的联结系统通过有效的局部元素调整，以在线的、自适应的方式学习主体的行为。KDD Cup 1999网络数据和Windows NT用户分析数据的实验表明，我们的自适应异常检测系统，基于模糊自适应共振理论（ART）和进化模糊神经网络（EFuNN），可以显着降低误报率，而攻击检测率仍然很高。
Anomaly detection holds great potential for detecting previously unknown attacks. In order to be effective in a practical environment, anomaly detection systems have to be capable of online learning and handling concept drift. In this paper, a new adaptive anomaly detection framework, based on the use of unsupervised evolving connectionist systems, is proposed to address these issues. It is designed to adapt to normal behavior changes while still recognizing anomalies. The evolving connectionist systems learn a subject's behavior in an online, adaptive fashion through efficient local element tuning. Experiments with the KDD Cup 1999 network data and the Windows NT user profiling data show that our adaptive anomaly detection systems, based on Fuzzy Adaptive Resonance Theory (ART) and Evolving Fuzzy Neural Networks (EFuNN), can significantly reduce the false alarm rate while the attack detection rate remains high.