MAWILab : Combining Diverse Anomaly Detectors for Automated Anomaly Labeling and Performance Benchmarking

Abstract : Evaluating anomaly detectors is a crucial task in traffic monitoring made particularly difficult due to the lack of ground truth. The goal of the present article is to assist researchers in the evaluation of detectors by providing them with labeled anomaly traffic traces. We aim at automatically finding anomalies in the MAWI archive using a new methodology that combines different and independent detectors. A key challenge is to compare the alarms raised by these detectors, though they operate at different traffic granularities. The main contribution is to propose a reliable graph-based methodology that combines any anomaly detector outputs. We evaluated four unsupervised combination strategies; the best is the one that is based on dimensionality reduction. The synergy between anomaly detectors permits to detect twice as many anomalies as the most accurate detector, and to reject numerous false positive alarms reported by the detectors. Significant anomalous traffic features are extracted from reported alarms, hence the labels assigned to theMAWI archive are concise. The results on the MAWI traffic are publicly available and updated daily. Also, this approach permits to include the results of upcoming anomaly detectors so as to improve over time the quality and variety of labels.
Complete list of metadatas

https://hal-ens-lyon.archives-ouvertes.fr/ensl-00552071
Contributor : Pierre Borgnat <>
Submitted on : Wednesday, January 5, 2011 - 1:31:06 PM
Last modification on : Thursday, April 19, 2018 - 2:54:03 PM
Long-term archiving on : Wednesday, April 6, 2011 - 2:51:43 AM

File

conext2010_1569335085_final.pd...
Files produced by the author(s)

Identifiers

  • HAL Id : ensl-00552071, version 1

Collections

Citation

Romain Fontugne, Pierre Borgnat, Patrice Abry, Kensuke Fukuda. MAWILab : Combining Diverse Anomaly Detectors for Automated Anomaly Labeling and Performance Benchmarking. ACM CoNEXT 2010, Nov 2010, Philadelphia, United States. ⟨ensl-00552071⟩

Share

Metrics

Record views

349

Files downloads

282