Back to Search
Start Over
Random Partitioning Forest for Point-Wise and Collective Anomaly Detection—Application to Network Intrusion Detection
- Source :
- IEEE Transactions on Information Forensics and Security, IEEE Transactions on Information Forensics and Security, Institute of Electrical and Electronics Engineers, 2021, 16, pp.2157-2172. ⟨10.1109/TIFS.2021.3050605⟩, IEEE Transactions on Information Forensics and Security, 2021, 16, pp.2157-2172. ⟨10.1109/TIFS.2021.3050605⟩
- Publication Year :
- 2021
- Publisher :
- Institute of Electrical and Electronics Engineers (IEEE), 2021.
-
Abstract
- In this paper, we propose DiFF-RF, an ensemble approach composed of random partitioning binary trees to detect point-wise and collective (as well as contextual) anomalies. Thanks to a distance-based paradigm used at the leaves of the trees, this semi-supervised approach solves a drawback that has been identified in the isolation forest (IF) algorithm. Moreover, taking into account the frequencies of visits in the leaves of the random trees allows to significantly improve the performance of DiFF-RF when considering the presence of collective anomalies. DiFF-RF is fairly easy to train, and excellent performance can be obtained by using a simple semi-supervised procedure to setup the extra hyper-parameter that is introduced. We first evaluate DiFF-RF on a synthetic data set to i) verify that the limitation of the IF algorithm is overcome, ii) demonstrate how collective anomalies are actually detected and iii) to analyze the effect of the meta-parameters it involves. We assess the DiFF-RF algorithm on a large set of datasets from the UCI repository, as well as two benchmarks related to intrusion detection applications. Our experiments show that DiFF-RF almost systematically outperforms the IF algorithm, but also challenges the one-class SVM baseline and a deep learning variational auto-encoder architecture. Furthermore, our experience shows that DiFF-RF can work well in the presence of small-scale learning data, which is conversely difficult for deep neural architectures. Finally, DiFF-RF is computationally efficient and can be easily parallelized on multi-core architectures.<br />Comment: arXiv admin note: text overlap with arXiv:1705.03800
- Subjects :
- FOS: Computer and information sciences
Computer Science - Machine Learning
Index Terms-Random Forest
Semi- supervised Learning
Computer Networks and Communications
Computer science
[INFO.INFO-DS]Computer Science [cs]/Data Structures and Algorithms [cs.DS]
0211 other engineering and technologies
Machine Learning (stat.ML)
02 engineering and technology
Intrusion detection system
Semi-supervised learning
Machine Learning (cs.LG)
Machine Learning
Set (abstract data type)
Statistics - Machine Learning
Safety, Risk, Reliability and Quality
021110 strategic, defence & security studies
Random Forest
Binary tree
business.industry
NIDS
Deep learning
Random Partitioning Trees
Intrusion Detection
Random forest
Support vector machine
[INFO.INFO-IR]Computer Science [cs]/Information Retrieval [cs.IR]
Semisupervised Learning
Anomaly Detection
Anomaly detection
Artificial intelligence
business
Algorithm
Subjects
Details
- ISSN :
- 15566021 and 15566013
- Volume :
- 16
- Database :
- OpenAIRE
- Journal :
- IEEE Transactions on Information Forensics and Security
- Accession number :
- edsair.doi.dedup.....345f60515a31daac97661aa679ccd14d