Anomaly Detection System Reducing Human Error and Measurement Cost Based on Man-Machine Collaboration

2016 Fiscal Year Final Research Report

• Project/Area Number: 26330112
• Research Category: Grant-in-Aid for Scientific Research (C)
• Allocation Type: Multi-year Fund
• Section: 一般
• Research Field: Information network
• Research Institution: Chiba Institute of Technology
• Principal Investigator: Uchida Masato 千葉工業大学, 工学部, 教授 (20419617)
• Project Period (FY): 2014-04-01 – 2017-03-31
• Keywords: 異常トラヒック検出

Outline of Final Research Achievements

This research focuses on an anomaly detection method that uses a baseline model describing the normal behavior of network traffic as the basis for comparison with the audit network traffic. In the anomaly detection method, an alarm is raised if a pattern in the current network traffic deviates from the baseline model. The baseline model is often trained using normal traffic data extracted from traffic data for which all instances (i.e., packets) are manually labeled by human experts in advance as either normal or anomalous. However, since humans are fallible, some errors are inevitable in labeling traffic data. Therefore, this research proposes a human error tolerant anomaly detection. The proposed method takes advantage of the lossy nature of packet sampling for the purpose of correcting/preventing human errors in labeling traffic data. By using real traffic traces, we show that the proposed method can better detect anomalies than the existing method.

Free Research Field

情報ネットワーク，数理モデリング