Entropy-Defined Direct Batch Growing Hierarchical Self-Organizing Mapping for Efficient Network Anomaly Detection

This paper proposes a network anomaly detection model of direct batch growing hierarchical self-organizing mapping based on entropy, which facilitates clear topology representation for the asymmetrically-distributed data. Since the entropy-defined parameters dynamically vary with the incident datase...

Full description

Bibliographic Details
Main Authors: Xiaofei Qu, Lin Yang, Kai Guo, Zhisong Pan, Tao Feng, Shuangyin Ren, Meng Sun
Format: Article
Language:English
Published: IEEE 2021-01-01
Series:IEEE Access
Subjects:
Online Access:https://ieeexplore.ieee.org/document/9371708/
id doaj-56b399b0f5054faeae5666fcd8746f3d
record_format Article
spelling doaj-56b399b0f5054faeae5666fcd8746f3d2021-03-30T15:21:15ZengIEEEIEEE Access2169-35362021-01-019385223853010.1109/ACCESS.2021.30642009371708Entropy-Defined Direct Batch Growing Hierarchical Self-Organizing Mapping for Efficient Network Anomaly DetectionXiaofei Qu0https://orcid.org/0000-0003-3373-9306Lin Yang1Kai Guo2Zhisong Pan3Tao Feng4Shuangyin Ren5Meng Sun6https://orcid.org/0000-0002-7435-3752Beijing Institute of Remote Sensing Information, Beijing, ChinaNational Key Laboratory of Science and Technology on Information System Security, Institute of Systems Engineering, Academy of Military Science (AMS), Beijing, ChinaNational Key Laboratory of Science and Technology on Information System Security, Institute of Systems Engineering, Academy of Military Science (AMS), Beijing, ChinaCollege of Command and Control Engineering, Army Engineering University of PLA, Nanjing, ChinaNational Key Laboratory of Science and Technology on Information System Security, Institute of Systems Engineering, Academy of Military Science (AMS), Beijing, ChinaNational Key Laboratory of Science and Technology on Information System Security, Institute of Systems Engineering, Academy of Military Science (AMS), Beijing, ChinaCollege of Command and Control Engineering, Army Engineering University of PLA, Nanjing, ChinaThis paper proposes a network anomaly detection model of direct batch growing hierarchical self-organizing mapping based on entropy, which facilitates clear topology representation for the asymmetrically-distributed data. Since the entropy-defined parameters dynamically vary with the incident dataset, that is, follow a data-adaptive manner, the proposed model is naturally valid in all cases with various data types. For fine-grained data distinguishing, a resemble entropy parameter is proposed for the first time to our best knowledge. The experimental results validate that the proposed model achieves a more efficient network anomaly detection than the conventional models, especially for real-world applications with unexpected anomaly data updating.https://ieeexplore.ieee.org/document/9371708/Anomaly detectiontopologydirect batch growing hierarchical self-organizing mapping (DBGHSOM)entropyresemble entropy
collection DOAJ
language English
format Article
sources DOAJ
author Xiaofei Qu
Lin Yang
Kai Guo
Zhisong Pan
Tao Feng
Shuangyin Ren
Meng Sun
spellingShingle Xiaofei Qu
Lin Yang
Kai Guo
Zhisong Pan
Tao Feng
Shuangyin Ren
Meng Sun
Entropy-Defined Direct Batch Growing Hierarchical Self-Organizing Mapping for Efficient Network Anomaly Detection
IEEE Access
Anomaly detection
topology
direct batch growing hierarchical self-organizing mapping (DBGHSOM)
entropy
resemble entropy
author_facet Xiaofei Qu
Lin Yang
Kai Guo
Zhisong Pan
Tao Feng
Shuangyin Ren
Meng Sun
author_sort Xiaofei Qu
title Entropy-Defined Direct Batch Growing Hierarchical Self-Organizing Mapping for Efficient Network Anomaly Detection
title_short Entropy-Defined Direct Batch Growing Hierarchical Self-Organizing Mapping for Efficient Network Anomaly Detection
title_full Entropy-Defined Direct Batch Growing Hierarchical Self-Organizing Mapping for Efficient Network Anomaly Detection
title_fullStr Entropy-Defined Direct Batch Growing Hierarchical Self-Organizing Mapping for Efficient Network Anomaly Detection
title_full_unstemmed Entropy-Defined Direct Batch Growing Hierarchical Self-Organizing Mapping for Efficient Network Anomaly Detection
title_sort entropy-defined direct batch growing hierarchical self-organizing mapping for efficient network anomaly detection
publisher IEEE
series IEEE Access
issn 2169-3536
publishDate 2021-01-01
description This paper proposes a network anomaly detection model of direct batch growing hierarchical self-organizing mapping based on entropy, which facilitates clear topology representation for the asymmetrically-distributed data. Since the entropy-defined parameters dynamically vary with the incident dataset, that is, follow a data-adaptive manner, the proposed model is naturally valid in all cases with various data types. For fine-grained data distinguishing, a resemble entropy parameter is proposed for the first time to our best knowledge. The experimental results validate that the proposed model achieves a more efficient network anomaly detection than the conventional models, especially for real-world applications with unexpected anomaly data updating.
topic Anomaly detection
topology
direct batch growing hierarchical self-organizing mapping (DBGHSOM)
entropy
resemble entropy
url https://ieeexplore.ieee.org/document/9371708/
work_keys_str_mv AT xiaofeiqu entropydefineddirectbatchgrowinghierarchicalselforganizingmappingforefficientnetworkanomalydetection
AT linyang entropydefineddirectbatchgrowinghierarchicalselforganizingmappingforefficientnetworkanomalydetection
AT kaiguo entropydefineddirectbatchgrowinghierarchicalselforganizingmappingforefficientnetworkanomalydetection
AT zhisongpan entropydefineddirectbatchgrowinghierarchicalselforganizingmappingforefficientnetworkanomalydetection
AT taofeng entropydefineddirectbatchgrowinghierarchicalselforganizingmappingforefficientnetworkanomalydetection
AT shuangyinren entropydefineddirectbatchgrowinghierarchicalselforganizingmappingforefficientnetworkanomalydetection
AT mengsun entropydefineddirectbatchgrowinghierarchicalselforganizingmappingforefficientnetworkanomalydetection
_version_ 1724179631338160128