Anomaly Detection with ANN and SVM for Telemedicine Networks

Authors: Edward Guillén, Jeisson Sánchez, Carlos Omar Ramos

Abstract:

In recent years, a wide variety of applications are developed with Support Vector Machines -SVM- methods and Artificial Neural Networks -ANN-. In general, these methods depend on intrusion knowledge databases such as KDD99, ISCX, and CAIDA among others. New classes of detectors are generated by machine learning techniques, trained and tested over network databases. Thereafter, detectors are employed to detect anomalies in network communication scenarios according to user’s connections behavior. The first detector based on training dataset is deployed in different real-world networks with mobile and non-mobile devices to analyze the performance and accuracy over static detection. The vulnerabilities are based on previous work in telemedicine apps that were developed on the research group. This paper presents the differences on detections results between some network scenarios by applying traditional detectors deployed with artificial neural networks and support vector machines.

Keywords: Anomaly detection, back-propagation neural networks, network intrusion detection systems, support vector machines.

Digital Object Identifier (DOI): doi.org/10.5281/zenodo.1338874

References:

[1] Shah, B. & Trivedi, B. H, Improving Performance of Mobile Agent Based Intrusion Detection System, in 'Advanced Computing & Communication Technologies (ACCT), 2015 Fifth International Conference on', pp. 425-430, (2015).
[2] Hoque, M. S.; Mukit, M.; Bikas, M.; Naser, A. & others, 'An implementation of intrusion detection system using genetic algorithm', arXiv preprint arXiv: 1204. 1336. (2012).
[3] Rahman, M. & Cheung, W. M, 'A Novel Cloud Computing Security Model to Detect and Prevent DoS and DDoS Attack', International Journal of Advanced Computer Science and Applications (IJACSA) 5(6), (2014).
[4] Bhat, A. H.; Patra, S. & Jena, D., 'Machine Learning Approach for Intrusion Detection on Cloud Virtual Machines', International Journal of Application or Innovation in Engineering & Management (IJAIEM) 2(6), 56-66, (2013).
[5] Kim, G.; Lee, S. & Kim, S., 'A Novel Hybrid Intrusion Detection Method Integrating Anomaly Detection with Misuse Detection', Expert Systems with Applications 41(4), 1690-1700, (2014).
[6] Murphy, K. P., Machine Learning: A Probabilistic Perspective, MIT press, (2012).
[7] Cifuentes, Y.; Beltrán, L. & Ramirez, L., 'Analysis of Security Vulnerabilities for Mobile Health Applications', 2015 Seventh International Conference on Mobile Computing and Networking (ICMCN 2015).
[8] Mirza, N. A. S.; Abbas, H.; Khan, F. A. & Al Muhtadi, J., Anticipating Advanced Persistent Threat (APT) Countermeasures Using Collaborative Security Mechanisms, in 'Biometrics and Security Technologies (ISBAST), 2014 International Symposium on', pp. 129-132, (2014).
[9] Saied, A.; Overill, R. E. & Radzik, T., Artificial Neural Networks in the Detection of Known and Unknown DDoS Attacks: Proof-of-Concept' Highlights of Practical Applications of Heterogeneous Multi-Agent Systems. The PAAMS Collection', Springer, pp. 309--320, (2014).
[10] Devaraju, S. & Ramakrishnan, S., 'Performance Comparison for Intrusion Detection System Using Neural Network with KDD Dataset.', ICTACT Journal on Soft Computing 4(3), 743-752, (2014).
[11] Macek, N. & Milosavljević, M. (2014), 'Reducing U2R and R2L Category False Negative rates with support vector machines', Serbian Journal of Electrical Engineering 11(1), 175-188.
[12] Hasan, M. A. M.; Nasser, M.; Pal, B. & Ahmad, S., 'Support Vector Machine and Random Forest Modeling for Intrusion Detection System (IDS)', Journal of Intelligent Learning Systems and Applications 2014, (2014).
[13] Guillén, E.; Rodriguez, J.; Páez, R.; Rodriguez, A. Detection of non-content based attacks using GA with extended KDD features. In Proceedings of the World Congress on Engineering and Computer Science, San Francisco, USA, 24-26 October 2012; pp. 30–35.
[14] Guillén, E.; Rodriguez, J.; Páez, R. Evaluating Performance of an Anomaly Detection Module with Artificial Neural Network Implementation. Int. J. Comput. Inf. Syst. Control Eng. 2013, 7, 836–842.
[15] Stolfo, S. J.; Fan, W.; Lee, W.; Prodromidis, A. & Chan, P. K., Cost-based modeling for fraud and intrusion detection: Results from the JAM project, in 'DARPA Information Survivability Conference and Exposition, 2000. DISCEX'00. Proceedings', pp. 130--144, (2000).
[16] Kim, B.-J. & Kim, I. K. (2005), Machine learning approach to real time intrusion detection System' AI 2005: Advances in Artificial Intelligence', Springer, pp. 153-163.
[17] Pati, J. & Shukla, K., A comparison of ARIMA, Neural Network and a Hybrid Technique for Debian Bug Number Prediction, in 'Computer and Communication Technology (ICCCT), 2014 International Conference on', pp. 47-53, (2014).
[18] Ndiaye, A.; Thiaw, L.; Sow, G. & Fall, S., 'Development of a Multilayer Perceptron (MLP) Based Neural Network Controller for Grid Connected Photovoltaic System', Int. J. Phys. Sci 9(3), 41--47, (2014).
[19] Meyer, D. & Wien, F. T., 'Support Vector Machines', The Interface to Libsvm in Package e1071, (2014).
[20] Rüping, S., Incremental Learning with Support Vector Machines, in '2013 IEEE 13th International Conference on Data Mining', pp. 641-641, (2001).
[21] Rüping, S., 'Incremental Learning with Support Vector Machines', Technical Report, Technical Report, SFB, 475: Komplexitдtsreduktion in Multivariaten Datenstrukturen, Universitдt Dortmund, (2002).
[22] Mei, S. & Zhu, X., Using Machine Teaching to Identify Optimal Training-Set Attacks on Machine Learners, in Proceedings of Association for the Advancement of Artificial Intelligence, Austin, Texas USA. January 25 –30, 2015, pp. 2871–2877, (2015).
[23] Levy, B. C., Principles of Signal Detection and Parameter Estimation, Springer Science & Business Media, (2008).
[24] Murphy, K. P., Machine Learning: A Probabilistic Perspective, MIT Press, (2012).