Anomaly detection for Cyber Security: Time Series Forecasting and Deep Learning

Giordano Colò¹

Section:Research Paper, Product Type: Journal-Paper
Vol.7 , Issue.1 , pp.40-52, Feb-2020

Online published on Feb 28, 2020

Copyright © Giordano Colò . This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.
 

View this paper at   Google Scholar | DPI Digital Library

XML View     PDF Download

How to Cite this Paper

Abstract :
Finding anomalies when dealing with a great amount of data creates issues related to the heterogeneity of different values and to the difficulty of modelling trend data during time. In this paper we combine the classical methods of time series analysis with deep learning techniques, with the aim to improve the forecast when facing time series with long-term dependencies. Starting with forecasting methods and comparing the expected values with the observed ones, we will find anomalies in time series. We apply this model to a bank cybersecurity case to find anomalous behaviour related to branches applications usage.

Key-Words / Index Term :
Anomaly detection, time series, cybersecurity, deep learning, stochastic processes, LSTM

References :
[1] Ba, J., Hinton, G. E., Mnih, V., Leibo, J. Z., & Ionescu, C.,
“Layer normalization”, Advances in neural information processing systems, pp. 4331–4339, 2016.
[2] Michèle Basseville, Igor V Nikiforov, et al.,
“Detection of abrupt changes: theory and application”, vol. 104, Prentice Hall Englewood Cliffs, 1993.
[3] Peter J Brockwell and Richard A Davis,
“Introduction to time series and forecasting”, Springer, 2016.
[4] Klaus Greff, Rupesh K Srivastava, Jan Koutník, Bas R Steunebrink, and Jürgen Schmidhuber, “Lstm: A search space odyssey”, IEEE transactions on neural networks and learning systems, no. 10, 2222–2232, 2016.
[5] Kyle Hundman, Valentino Constantinou, Christopher Laporte, Ian Colwell, and Tom Soderstrom, “Detecting spacecraft anomalies using lstms and nonparametric dynamic thresholding”, Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, ACM, pp. 387–395, 2018.
[6] Daehyung Park, Hokeun Kim, Yuuna Hoshi, Zackory Erickson, Ariel Kapusta, and Charles C Kemp, “A multimodal execution monitor with anomaly classification for robot-assisted feeding”, 2017 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), IEEE, pp. 5406–5413, 2017.
[7] T Januschowski, J Gasthaus, Y Wang, D Salinas, V Flunkert et al., “Criteria for classifying forecasting methods”, International Journal of Forecasting, 36 (1), 167-177, 2020.
[8] S Sherstinsky, Alex. (2020). “Fundamentals of Recurrent Neural Network (RNN) and Long Short-Term Memory (LSTM) network”. Physica D: Nonlinear Phenomena, To be published, Vol. 404, 2020.
[9] Fan, Chenyou et al. “Multi-task spatiotemporal neural networks for structured surface reconstruction”, 2018 IEEE Winter Conference on Applications of Computer Vision (WACV), pp. 1273-1282, 2018.