Comparison of Network Intrusion Detection Performance Using Feature Representation

P. 463-475Intrusion detection is essential for the security of the components of any network. For that reason, several strategies can be used in Intrusion Detection Systems (IDS) to identify the increasing attempts to gain unauthorized access with malicious purposes including those base on machine learning. Anomaly detection has been applied successfully to numerous domains and might help to identify unknown attacks. However, there are existing issues such as high error rates or large dimensionality of data that make its deployment di cult in real-life scenarios. Representation learning allows to estimate new latent features of data in a low-dimensionality space. In this work, anomaly detection is performed using a previous feature learning stage in order to compare these methods for the detection of intrusions in network tra c. For that purpose, four di erent anomaly detection algorithms are applied to recent network datasets using two di erent feature learning methods such as principal component analysis and autoencoders. Several evaluation metrics such as accuracy, F1 score or ROC curves are used for comparing their performance. The experimental results show an improvement for two of the anomaly detection methods using autoencoder and no signi cant variations for the linear feature transformationS

Extracting discriminative features for identifying abnormal sequences in one-class mode

This paper presents a novel framework for detecting abnormal sequences in an one-class setting (i.e., only normal data are available), which is applicable to various domains. Examples include intrusion detection, fault detection and speaker verification. Detecting abnormal sequences with only normal data presents several challenges for anomaly detection: the weak discrimination of normal and abnormal sequences; the unavailability of the abnormal data and other issues. Traditional model-based anomaly detection techniques can solve some of the above issues but with limited discrimination power (because of directly modeling the normal data). In order to enhance the discriminative power for anomaly detection, we turn to extracting discriminative features from the generative model based on the principle deducted from the corresponding theoretical analysis. Then a new anomaly detection framework is developed on top of that. The proposed approach firstly projects all the sequential data into a model-based equal length feature space (this is theoretically proven to have better discriminative power than the model itself), and then adopts a classifier learned from the transformed data to detect anomalies. Experimental evaluation on both the synthetic and real-world data shows that our proposed approach outperforms several anomaly detection baseline algorithms for sequential data. © 2013 IEEE

Developing Machine Learning Models for Space Based Edge AI Platforms

On September 3rd 2020, one of the first small satellites equipped with Edge AI hardware was launched. The inclusion of a UB0100 board on PhiSat-1 enabled the use of deep neural networks to provide real-time image analysis on-board an Earth Observation satellite. The primary benefit of this was a 90% reduction in downlink data as the system only transmitted non-cloudy, and thus usable, data. PhiSat-1 and missions like it have started the revolution of satellite-based machine learning, leading ESA and other space agencies to further explore the in-situ deployment of machine-learning models. Other applications that can benefit from on-board space-based machine learning capabilities range from anomaly detection and prognostics to feature recognition and object detection. This paper focuses on the application of anomaly detection models on space-ready Edge AI hardware to detect and classify anomalous behaviour in telemetry data. The ability to accurately detect anomalies onboard satellite systems has the potential to both increase system lifetimes and reduce satellite operator workloads. The limitations of Edge AI boards and the space environment put restrictions on the models that can be used. Limited power and potential single event upsets constrain the complexity of the models that can be deployed. Therefore, this paper is targeted at models that will run efficiently within these constraints. We describe an experiment that evaluates the suitability of different anomaly detection approaches (multi-layer-perceptrons, auto-encoders, etc.) for space applications. These approaches are compared both in terms of their performance in the anomaly detection tasks and how well they run on “space ready” low-power hardware. We focus on the Intel Myriad chipset, the basis of the UB0100, which hosted the machine learning image analysis model on PhiSat-1. Our evaluations use both the MIMII machine audio dataset, a well-regarded anomaly detection dataset that is a good proxy for telemetry data, and a dataset generated using anonymized NASA mission telemetry data. The findings show how well basic models work when presented with anomalous satellite telemetry

A GAN Approach for Anomaly Detection in Spacecraft Telemetries

In spacecraft health management a large number of time series is acquired and used for on-board units surveillance and for historical data analysis. The early detection of abnormal behaviors in telemetry data can prevent failures in the spacecraft equipment. In this paper we present an advanced monitoring system that was carried out in partnership with Thales Alenia Space Italia S.p.A, a leading industry in the field of spacecraft manufacturing. In particular, we developed an anomaly detection algorithm based on Generative Adversarial Networks, that thanks to their ability to model arbitrary distributions in high dimensional spaces, allow to capture complex anomalies avoiding the burden of hand crafted feature extraction. We applied this method to detect anomalies in telemetry data collected from a simulator of a Low Earth Orbit satellite. One of the strengths of the proposed approach is that it does not require any previous knowledge on the signal. This is particular useful in the context of anomaly detection where we do not have a model of the anomaly. Hence the only assumption we made is that an anomaly is a pattern that lives in a lower probability region of the data space

On Anomaly Ranking and Excess-Mass Curves

Learning how to rank multivariate unlabeled observations depending on their degree of abnormality/novelty is a crucial problem in a wide range of applications. In practice, it generally consists in building a real valued "scoring" function on the feature space so as to quantify to which extent observations should be considered as abnormal. In the 1-d situation, measurements are generally considered as "abnormal" when they are remote from central measures such as the mean or the median. Anomaly detection then relies on tail analysis of the variable of interest. Extensions to the multivariate setting are far from straightforward and it is precisely the main purpose of this paper to introduce a novel and convenient (functional) criterion for measuring the performance of a scoring function regarding the anomaly ranking task, referred to as the Excess-Mass curve (EM curve). In addition, an adaptive algorithm for building a scoring function based on unlabeled data X1 , . . . , Xn with a nearly optimal EM is proposed and is analyzed from a statistical perspective

Automated Global Feature Analyzer - A Driver for Tier-Scalable Reconnaissance

For the purposes of space flight, reconnaissance field geologists have trained to become astronauts. However, the initial forays to Mars and other planetary bodies have been done by purely robotic craft. Therefore, training and equipping a robotic craft with the sensory and cognitive capabilities of a field geologist to form a science craft is a necessary prerequisite. Numerous steps are necessary in order for a science craft to be able to map, analyze, and characterize a geologic field site, as well as effectively formulate working hypotheses. We report on the continued development of the integrated software system AGFA: automated global feature analyzerreg, originated by Fink at Caltech and his collaborators in 2001. AGFA is an automatic and feature-driven target characterization system that operates in an imaged operational area, such as a geologic field site on a remote planetary surface. AGFA performs automated target identification and detection through segmentation, providing for feature extraction, classification, and prioritization within mapped or imaged operational areas at different length scales and resolutions, depending on the vantage point (e.g., spaceborne, airborne, or ground). AGFA extracts features such as target size, color, albedo, vesicularity, and angularity. Based on the extracted features, AGFA summarizes the mapped operational area numerically and flags targets of "interest", i.e., targets that exhibit sufficient anomaly within the feature space. AGFA enables automated science analysis aboard robotic spacecraft, and, embedded in tier-scalable reconnaissance mission architectures, is a driver of future intelligent and autonomous robotic planetary exploration