Sciweavers

Share
CONEXT
2010
ACM

MAWILab: combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking

9 years 8 months ago
MAWILab: combining diverse anomaly detectors for automated anomaly labeling and performance benchmarking
Evaluating anomaly detectors is a crucial task in traffic monitoring made particularly difficult due to the lack of ground truth. The goal of the present article is to assist researchers in the evaluation of detectors by providing them with labeled anomaly traffic traces. We aim at automatically finding anomalies in the MAWI archive using a new methodology that combines different and independent detectors. A key challenge is to compare the alarms raised by these detectors, though they operate at different traffic granularities. The main contribution is to propose a reliable graph-based methodology that combines any anomaly detector outputs. We evaluated four unsupervised combination strategies; the best is the one that is based on dimensionality reduction. The synergy between anomaly detectors permits to detect twice as many anomalies as the most accurate detector, and to reject numerous false positive alarms reported by the detectors. Significant anomalous traffic features are extrac...
Romain Fontugne, Pierre Borgnat, Patrice Abry, Ken
Added 10 Feb 2011
Updated 10 Feb 2011
Type Journal
Year 2010
Where CONEXT
Authors Romain Fontugne, Pierre Borgnat, Patrice Abry, Kensuke Fukuda
Comments (0)
books