Showing items 1 - 15 of 15

Your selections:

Complex anomaly for enhanced machine independent condition monitoring

- Amar, Muhammad, Gondal, Iqbal, Wilson, Campbell

  • Authors: Amar, Muhammad , Gondal, Iqbal , Wilson, Campbell
  • Date: 2015
  • Type: Text , Conference proceedings
  • Relation: 9th International Conference on Open Source Systems and Technologies, ICOSST 2015; Lahore, Pakistan; 17th-19th December 2015
  • Full Text: false
  • Description: Safety in machine applications requires tracking machine health during the time of operations. Anomaly detection techniques are used to model normal behavior of the machines and raise an alarm if any anomaly is observed. But traditional anomaly detection techniques do not identify type and severity of aberrance in terms of amplitude, pattern or both. Once the anomalous behavior is observed then fault detection techniques are applied to diagnose faults. For machine independent condition monitoring (MICM) a range of features transforms are needed for autonomous learning of the fault classifiers for different parameters to identify variety of fault types which requires huge amount of time. In this paper a novel complex anomaly plan (CAP) representation has been proposed with amplitude anomalies on real and pattern anomalies on imaginary axis. To plot amplitude and pattern anomalies in the CAP, normal state vibrations frequency features are used to train Gaussian models for each of the frequency. The dynamic location of the anomaly plotted in the CAP gives a measure of the intensity of the anomaly, where real and imaginary axis components help the fault classifier to make an appropriate selection of the transform and thus enhances the efficiency of MICM framework. © 2015 IEEE.
  • Description: ICOSST 2015 - 2015 International Conference on Open Source Systems and Technologies, Proceedings

Commentary : A decomposition of the outlier detection problem into a set of supervised learning problems

- Zhu, Ye, Ting, Kaiming

  • Authors: Zhu, Ye , Ting, Kaiming
  • Date: 2016
  • Type: Text , Journal article
  • Relation: Machine Learning Vol. 105, no. 2 (2016), p. 301-304
  • Full Text: false
  • Reviewed:
  • Description: This article discusses the material in relation to iForest (Liu et al. in ACM Trans Knowl Discov Data 6(1):3, 2012) reported in a recent Machine Learning Journal paper by Paulheim and Meusel (Mach Learn 100(2–3):509–531, 2015). It presents an empirical comparison result of iForest using the default parameter settings suggested by its creator (Liu et al. 2012) and iForest using the settings employed by Paulheim and Meusel (2015). This comparison has an impact on the conclusion made by Paulheim and Meusel (2015). © 2016, The Author(s).

Survey of intrusion detection systems : techniques, datasets and challenges

- Khraisat, Ansam, Iqbal, Gondal, Vamplew, Peter, Kamruzzaman, Joarder

Mass estimation

- Ting, Kaiming, Zhou, Guang, Liu, Fei, Tan, Swee

  • Authors: Ting, Kaiming , Zhou, Guang , Liu, Fei , Tan, Swee
  • Date: 2013
  • Type: Text , Journal article
  • Relation: Machine Learning Vol. 90, no. 1 (2013), p. 127-160
  • Full Text: false
  • Reviewed:
  • Description: This paper introduces mass estimation—a base modelling mechanism that can be employed to solve various tasks in machine learning. We present the theoretical basis of mass and efficient methods to estimate mass. We show that mass estimation solves problems effectively in tasks such as information retrieval, regression and anomaly detection. The models, which use mass in these three tasks, perform at least as well as and often better than eight state-of-the-art methods in terms of task-specific performance measures. In addition, mass estimation has constant time and space complexities.

An anomaly intrusion detection system using C5 decision tree classifier

- Khraisat, Ansam, Gondal, Iqbal, Vamplew, Peter

Cybercrime : The case of obfuscated malware

- Alazab, Mamoun, Venkatraman, Sitalakshmi, Watters, Paul, Alazab, Moutaz, Alazab, Ammar

  • Authors: Alazab, Mamoun , Venkatraman, Sitalakshmi , Watters, Paul , Alazab, Moutaz , Alazab, Ammar
  • Date: 2011
  • Type: Text , Conference paper
  • Relation: Joint 7th International Conference on Global Security, Safety and Sustainability, ICGS3 2011, and the 4th Conference on e-Democracy Vol. 99 LNICST, p. 204-211
  • Full Text: false
  • Reviewed:
  • Description: Cybercrime has rapidly developed in recent years and malware is one of the major security threats in computer which have been in existence from the very early days. There is a lack of understanding of such malware threats and what mechanisms can be used in implementing security prevention as well as to detect the threat. The main contribution of this paper is a step towards addressing this by investigating the different techniques adopted by obfuscated malware as they are growingly widespread and increasingly sophisticated with zero-day exploits. In particular, by adopting certain effective detection methods our investigations show how cybercriminals make use of file system vulnerabilities to inject hidden malware into the system. The paper also describes the recent trends of Zeus botnets and the importance of anomaly detection to be employed in addressing the new Zeus generation of malware. © 2012 ICST Institute for Computer Science, Social Informatics and Telecommunications Engineering.
  • Description: 2003010650

Unitary anomaly detection for ubiquitous safety in machine health monitoring

- Amar, Muhammad, Gondal, Iqbal, Wilson, Campbell

  • Authors: Amar, Muhammad , Gondal, Iqbal , Wilson, Campbell
  • Date: 2012
  • Type: Text , Conference paper
  • Relation: 19th International Conference on Neural Information Processing (INCONIP) p. 361-368
  • Full Text: false
  • Reviewed:
  • Description: Safety has always been of vital concern in both industrial and home applications. Ensuring safety often requires certain quantifications regarding the inclusive behavior of the system under observation in order to determine deviations from normal behavior. In machine health monitoring, the vibration signal is of great importance for such measurements because it includes abundant information from several machine parts and surroundings that can influence machine behavior. This paper proposes a unitary anomaly detection technique (UAD) that, upon observation of abnormal behavior in the vibration signal, can trigger an alarm with an adjustable threshold in order to meet different safety requirements. The normalized amplitude of spectral contents of the quasi stationary time vibration signal are divided into frequency bins, and the summed amplitudes frequencies over bin are used as features. From a training set consisting of normal vibration signals, Gaussian distribution models are obtained for each feature, which are then used for anomaly detection.

Classification under streaming emerging new classes : A solution using completely-random trees

- Mu, Xin, Ting, Kaiming, Zhou, Zhi-Hua

  • Authors: Mu, Xin , Ting, Kaiming , Zhou, Zhi-Hua
  • Date: 2017
  • Type: Text , Journal article
  • Relation: IEEE Transactions on Knowledge and Data Engineering Vol. 29, no. 8 (2017), p. 1605-1618
  • Full Text: false
  • Reviewed:
  • Description: This paper investigates an important problem in stream mining, i.e., classification under streaming emerging new classes or SENC. The SENC problem can be decomposed into three subproblems: detecting emerging new classes, classifying known classes, and updating models to integrate each new class as part of known classes. The common approach is to treat it as a classification problem and solve it using either a supervised learner or a semi-supervised learner. We propose an alternative approach by using unsupervised learning as the basis to solve this problem. The proposed method employs completely-random trees which have been shown to work well in unsupervised learning and supervised learning independently in the literature. The completely-random trees are used as a single common core to solve all three subproblems: unsupervised learning, supervised learning, and model update on data streams. We show that the proposed unsupervised-learning-focused method often achieves significantly better outcomes than existing classification-focused methods.

Isolation-based anomaly detection using nearest-neighbor ensembles

- Bandaragoda, Tharindu, Ting, Kaiming, Albrecht, David, Liu, Fei, Zhu, Ye, Wells, Jonathan

  • Authors: Bandaragoda, Tharindu , Ting, Kaiming , Albrecht, David , Liu, Fei , Zhu, Ye , Wells, Jonathan
  • Date: 2018
  • Type: Text , Journal article
  • Relation: Computational Intelligence Vol. 34, no. 4 (2018), p. 968-998
  • Full Text: false
  • Reviewed:
  • Description: The first successful isolation-based anomaly detector, ie, iForest, uses trees as a means to perform isolation. Although it has been shown to have advantages over existing anomaly detectors, we have identified 4 weaknesses, ie, its inability to detect local anomalies, anomalies with a high percentage of irrelevant attributes, anomalies that are masked by axis-parallel clusters, and anomalies in multimodal data sets. To overcome these weaknesses, this paper shows that an alternative isolation mechanism is required and thus presents iNNE or isolation using Nearest Neighbor Ensemble. Although relying on nearest neighbors, iNNE runs significantly faster than the existing nearest neighbor–based methods such as the local outlier factor, especially in data sets having thousands of dimensions or millions of instances. This is because the proposed method has linear time complexity and constant space complexity. © 2018 Wiley Periodicals, Inc.

Hybrid intrusion detection system based on the stacking ensemble of C5 decision tree classifier and one class support vector machine

- Khraisat, Ansam, Gondal, Iqbal, Vamplew, Peter, Kamruzzaman, Joarder, Alazab, Ammar

  • Authors: Khraisat, Ansam , Gondal, Iqbal , Vamplew, Peter , Kamruzzaman, Joarder , Alazab, Ammar
  • Date: 2020
  • Type: Text , Journal article
  • Relation: Electronics (Switzerland) Vol. 9, no. 1 (2020), p.
  • Full Text:
  • Reviewed:
  • Description: Cyberttacks are becoming increasingly sophisticated, necessitating the efficient intrusion detection mechanisms to monitor computer resources and generate reports on anomalous or suspicious activities. Many Intrusion Detection Systems (IDSs) use a single classifier for identifying intrusions. Single classifier IDSs are unable to achieve high accuracy and low false alarm rates due to polymorphic, metamorphic, and zero-day behaviors of malware. In this paper, a Hybrid IDS (HIDS) is proposed by combining the C5 decision tree classifier and One Class Support Vector Machine (OC-SVM). HIDS combines the strengths of SIDS) and Anomaly-based Intrusion Detection System (AIDS). The SIDS was developed based on the C5.0 Decision tree classifier and AIDS was developed based on the one-class Support Vector Machine (SVM). This framework aims to identify both the well-known intrusions and zero-day attacks with high detection accuracy and low false-alarm rates. The proposed HIDS is evaluated using the benchmark datasets, namely, Network Security Laboratory-Knowledge Discovery in Databases (NSL-KDD) and Australian Defence Force Academy (ADFA) datasets. Studies show that the performance of HIDS is enhanced, compared to SIDS and AIDS in terms of detection rate and low false-alarm rates. © 2020 by the authors. Licensee MDPI, Basel, Switzerland.

Autonomous behavior modeling approach for diverse anomaly detection application

- Amar, Muhammad, Wilson, Campbell, Gondal, Iqbal

  • Authors: Amar, Muhammad , Wilson, Campbell , Gondal, Iqbal
  • Date: 2014
  • Type: Text , Conference paper
  • Relation: ICOSST 2014 - 2014 International Conference on Open Source Systems and Technologies, Lahore, Pakistan, 18-20th Dec 2014 p. 122-127
  • Full Text: false
  • Reviewed:
  • Description: For absolute process safety in diverse machine applications, timely and reliable anomalous behavior detection is very crucial. Different machine applications have different normal behavior patterns and safety standards thus require adjustable and adaptive anomaly detection techniques. In this paper an autonomous behavior modeling approach for anomaly detection has been presented. In this approach time segmented vibration signals from the machines are transformed into spectral contents. After normalization, these frequency domain contents are divided into weighted frequency bins and then Gaussian models are achieved for these frequency bins over the entire training set. Using summation rule on the outputs of Gaussian models a single indicative measure of the machine health: normality score is obtained. The sensitivity of the normality score and anomaly detector towards potential anomalous signals can be controlled by using different number of bins and weights. Suitable parameters values, number of bins and weights profile, for anomaly detector model are selected autonomously using minimum value of the cost function. The increase of normality score of this model above a certain threshold is considered an alarm indicating anomalous behavior. Thus the proposed method enables us to achieve autonomously a suitable anomaly detection model with suitable parameters with controlled sensitivity during the test phase.

LiNearN : A new approach to nearest neighbour density estimator

- Wells, Jonathan, Ting, Kaiming, Washio, Takashi

  • Authors: Wells, Jonathan , Ting, Kaiming , Washio, Takashi
  • Date: 2014
  • Type: Text , Journal article
  • Relation: Pattern Recognition Vol. 47, no. 8 (2014), p. 2702-2720
  • Full Text: false
  • Reviewed:
  • Description: Despite their wide spread use, nearest neighbour density estimators have two fundamental limitations: O(n2) time complexity and O(n) space complexity. Both limitations constrain nearest neighbour density estimators to small data sets only. Recent progress using indexing schemes has improved to near linear time complexity only.We propose a new approach, called LiNearN for Linear time Nearest Neighbour algorithm, that yields the first nearest neighbour density estimator having O(n) time complexity and constant space complexity, as far as we know. This is achieved without using any indexing scheme because LiNearN uses a subsampling approach for which the subsample values are significantly less than the data size. Like existing density estimators, our asymptotic analysis reveals that the new density estimator has a parameter to trade off between bias and variance. We show that algorithms based on the new nearest neighbour density estimator can easily scale up to data sets with millions of instances in anomaly detection and clustering tasks. Highlights•Reject the premise that a NN algorithm must find the NN for every instance.•The first NN density estimator that has O(n) time complexity and O(1) space complexity.•These complexities are achieved without using any indexing scheme.•Our asymptotic analysis reveals that it trades off between bias and variance.•Easily scales up to large data sets in anomaly detection and clustering tasks.

Defying the gravity of learning curve : A characteristic of nearest neighbour anomaly detectors

- Ting, Kaiming, Washio, Takashi, Wells, Jonathan, Aryal, Sunil

  • Authors: Ting, Kaiming , Washio, Takashi , Wells, Jonathan , Aryal, Sunil
  • Date: 2017
  • Type: Text , Journal article
  • Relation: Machine Learning Vol. 106, no. 1 (2017), p. 55-91
  • Full Text: false
  • Reviewed:
  • Description: Conventional wisdom in machine learning says that all algorithms are expected to follow the trajectory of a learning curve which is often colloquially referred to as ‘more data the better’. We call this ‘the gravity of learning curve’, and it is assumed that no learning algorithms are ‘gravity-defiant’. Contrary to the conventional wisdom, this paper provides the theoretical analysis and the empirical evidence that nearest neighbour anomaly detectors are gravity-defiant algorithms.

A novel ensemble of hybrid intrusion detection system for detecting internet of things attacks

- Khraisat, Ansam, Gondal, Iqbal, Vamplew, Peter, Kamruzzaman, Joarder, Alazab, Ammar

  • Authors: Khraisat, Ansam , Gondal, Iqbal , Vamplew, Peter , Kamruzzaman, Joarder , Alazab, Ammar
  • Date: 2019
  • Type: Text , Journal article
  • Relation: Electronics (Switzerland) Vol. 8, no. 11 (2019), p.
  • Full Text:
  • Reviewed:
  • Description: The Internet of Things (IoT) has been rapidly evolving towards making a greater impact on everyday life to large industrial systems. Unfortunately, this has attracted the attention of cybercriminals who made IoT a target of malicious activities, opening the door to a possible attack to the end nodes. Due to the large number and diverse types of IoT devices, it is a challenging task to protect the IoT infrastructure using a traditional intrusion detection system. To protect IoT devices, a novel ensemble Hybrid Intrusion Detection System (HIDS) is proposed by combining a C5 classifier and One Class Support Vector Machine classifier. HIDS combines the advantages of Signature Intrusion Detection System (SIDS) and Anomaly-based Intrusion Detection System (AIDS). The aim of this framework is to detect both the well-known intrusions and zero-day attacks with high detection accuracy and low false-alarm rates. The proposed HIDS is evaluated using the Bot-IoT dataset, which includes legitimate IoT network traffic and several types of attacks. Experiments show that the proposed hybrid IDS provide higher detection rate and lower false positive rate compared to the SIDS and AIDS techniques. © 2019 by the authors. Licensee MDPI, Basel, Switzerland.

Half-space mass : a maximally robust and efficient data depth method

- Chen, Bo, Ting, Kaiming, Washio, Takashi, Haffari, Gholamreza

  • Authors: Chen, Bo , Ting, Kaiming , Washio, Takashi , Haffari, Gholamreza
  • Date: 2015
  • Type: Text , Journal article
  • Relation: Machine Learning Vol. 100, no. 2-3 (2015), p. 677-699
  • Full Text: false
  • Reviewed:
  • Description: Data depth is a statistical method which models data distribution in terms of center-outward ranking rather than density or linear ranking. While there are a lot of academic interests, its applications are hampered by the lack of a method which is both robust and efficient. This paper introduces Half-Space Mass which is a significantly improved version of half-space data depth. Half-Space Mass is the only data depth method which is both robust and efficient, as far as we know. We also reveal four theoretical properties of Half-Space Mass: (i) its resultant mass distribution is concave regardless of the underlying density distribution, (ii) its maximum point is unique which can be considered as median, (iii) the median is maximally robust, and (iv) its estimation extends to a higher dimensional space in which the convex hull of the dataset occupies zero volume. We demonstrate the power of Half-Space Mass through its applications in two tasks. In anomaly detection, being a maximally robust location estimator leads directly to a robust anomaly detector that yields a better detection accuracy than half-space depth; and it runs orders of magnitude faster than L2 depth, an existing maximally robust location estimator. In clustering, the Half-Space Mass version of K-means overcomes three weaknesses of K-means.
  • Description: Data depth is a statistical method which models data distribution in terms of center-outward ranking rather than density or linear ranking. While there are a lot of academic interests, its applications are hampered by the lack of a method which is both robust and efficient. This paper introduces
  • 1