UPM Institutional Repository

A refined filter for UHAD to improve anomaly detection


Hajamydeen, Asif Iqbal and Udzir, Nur Izura (2016) A refined filter for UHAD to improve anomaly detection. Security and Communication Networks, 9 (14). pp. 2434-2447. ISSN 1939-0122


Filtering is used in intrusion detection to remove the insignificant events from a log to facilitate the analysis method to focus on the significant events and to minimize processing overhead. Generally, filtering is performed using filtering rules, which are framed using a set of data training data, or the known facts on anomalous events. This knowledge-dependent nature confines the filterer to filter-in only the recognized anomalies in the logs, making the rest unavailable for further scrutiny. This problem has been addressed earlier by designing a filterer that manipulates the tested log data based on the patterns and volume of events to calculate the filtering threshold. Even though this filtering threshold was able to retain the anomalous events in most heterogeneous logs, it failed when such events were of high volume and also due to the inaccuracies in cluster formation. Therefore, this paper proposes a refined filterer for unsupervised heterogeneous anomaly detection that retains most anomalous events irrespective of its volume in the logs and also discusses the impact of the refined filterer in supporting the detection. The experiment conducted reveals that the refined filterer retained almost all the abnormal events thereby enabling the detection of maximum anomalies.

Download File

[img] Text
A refined filter for UHAD to improve anomaly detection.pdf
Restricted to Repository staff only

Download (568kB)

Additional Metadata

Item Type: Article
Divisions: Faculty of Computer Science and Information Technology
DOI Number: https://doi.org/10.1002/sec.1514
Publisher: John Wiley & Sons
Keywords: Refined filter; Anomaly detection; Intrusion detection; Clustering algorithm
Depositing User: Mohd Hafiz Che Mahasan
Date Deposited: 12 Jun 2018 02:51
Last Modified: 12 Jun 2018 02:51
Altmetrics: http://www.altmetric.com/details.php?domain=psasir.upm.edu.my&doi=10.1002/sec.1514
URI: http://psasir.upm.edu.my/id/eprint/54906
Statistic Details: View Download Statistic

Actions (login required)

View Item View Item