DocumentCode :
3182441
Title :
A Robust Anomaly Detection Technique Using Combined Statistical Methods
Author :
Ndong, Joseph ; Salamatian, Kavé
Author_Institution :
LIP6, Univ. Pierre et Marie Curie, Paris, France
fYear :
2011
fDate :
2-5 May 2011
Firstpage :
101
Lastpage :
108
Abstract :
Parametric anomaly detection is generally a three steps process where, in the first step a model of normal behavior is calibrated and thereafter, the obtained model is used in order to reduce the entropy of the observation. The second step generates an innovation process that is used in the third step to make a decision on the existence or not of an anomaly in the observed data. Under favorable conditions the innovation process is expected to be a Gaussian white noise. However, in practice, this is hardly the case as frequently the observed signals are not gaussian themselves. Moreover long range dependencies, as well as heavy tail in the observation can lead to important deviation from the normality and the independence in the innovation processes. This, results in the frequent observation that the decisions made assuming that the innovation process is a white and Gaussian results in a large false positive rate. In this paper we deal with the above issue. Our approach consists of not assuming anymore that the innovation process is Gaussian and white. In place we are assuming that the real distribution of the process is a mixture of Gaussian and that there are some time dependency in the innovation that we will capture by using a Hidden Markov Model. We therefore derive a new decision process and we show that this approach results into an important decrease of false alarm rates. We validate this approach over realistic traces.
Keywords :
Gaussian noise; hidden Markov models; security of data; statistical analysis; white noise; Gaussian white noise; entropy; hidden Markov model; innovation process; mixture of Gaussian; parametric anomaly detection; robust anomaly detection; statistical methods; Data models; Hidden Markov models; Kalman filters; Mathematical model; Monitoring; Technological innovation; Viterbi algorithm; Anomaly Detection; GMM; HMM; Kalman filter; System Monitors;
fLanguage :
English
Publisher :
ieee
Conference_Titel :
Communication Networks and Services Research Conference (CNSR), 2011 Ninth Annual
Conference_Location :
Ottawa, ON
Print_ISBN :
978-1-4577-0040-8
Electronic_ISBN :
978-0-7695-4393-2
Type :
conf
DOI :
10.1109/CNSR.2011.23
Filename :
5771198
Link To Document :
بازگشت