论文标题
MSTREAM：多相关流中的快速异常检测
MSTREAM: Fast Anomaly Detection in Multi-Aspect Streams
论文作者
论文摘要
给定多相关数据设置中的条目流，即具有多个维度的条目，我们如何以无监督的方式检测异常活动？例如，在入侵检测设置中，现有工作试图检测动态图流中的异常事件或边缘，但这不允许我们考虑每个条目的其他属性。我们的工作旨在定义流媒体数据异常检测框架，称为MSTREAM，可以以动态方式检测出异常的组异常。 MStream具有以下属性：（a）它检测到包括分类和数字属性的多相关数据中的异常； （b）它是在线的，因此在恒定时间和恒定内存中处理每个记录； （c）它可以捕获数据的多个方面之间的相关性。 MSTREAM通过KDDCUP99，CICIDS-DOS，UNSW-NB 15和CICIDS-DDOS数据集进行评估，并且表现优于最先进的基线。
Given a stream of entries in a multi-aspect data setting i.e., entries having multiple dimensions, how can we detect anomalous activities in an unsupervised manner? For example, in the intrusion detection setting, existing work seeks to detect anomalous events or edges in dynamic graph streams, but this does not allow us to take into account additional attributes of each entry. Our work aims to define a streaming multi-aspect data anomaly detection framework, termed MSTREAM which can detect unusual group anomalies as they occur, in a dynamic manner. MSTREAM has the following properties: (a) it detects anomalies in multi-aspect data including both categorical and numeric attributes; (b) it is online, thus processing each record in constant time and constant memory; (c) it can capture the correlation between multiple aspects of the data. MSTREAM is evaluated over the KDDCUP99, CICIDS-DoS, UNSW-NB 15 and CICIDS-DDoS datasets, and outperforms state-of-the-art baselines.
