TU Darmstadt / ULB / TUbiblio

Deep Unrolling for Anomaly Detection in Network Flows

Schynol, Lukas ; Pesavento, Marius (2023)
Deep Unrolling for Anomaly Detection in Network Flows.
9th International Workshop on Computational Advances in Multi-Sensor Adaptive Processing. Herradura, Costa Rica (10.12.2023-13.12.2023)
doi: 10.1109/CAMSAP58249.2023.10403513
Konferenzveröffentlichung, Bibliographie

Kurzbeschreibung (Abstract)

Anomaly detection becomes increasingly important in the design of future resilient communication systems. In this work, anomaly detection in network flows with incomplete measurements on the basis of robust PCA, where normal flows are characterized as low-rank components and anomalies as sparse components, is considered. Based on the block-successive convex approximation framework, we first introduce a novel model-based algorithm for normal and anomalous traffic recovery. Since robust-PCA-based anomaly detection alone is suboptimal in terms of the receiver operating characteristic, we apply deep unrolling to this algorithm and use a homotopy optimization method to train the resulting deep network architecture to explicitly optimize the area under the curve of the receiver oper-ating characteristic. Thereby, the domain knowledge introduced by robust PCA is retained. Our deep unrolling-based network architecture outperforms the classical methods while generalizing well and featuring excellent data efficiency.

Typ des Eintrags: Konferenzveröffentlichung
Erschienen: 2023
Autor(en): Schynol, Lukas ; Pesavento, Marius
Art des Eintrags: Bibliographie
Titel: Deep Unrolling for Anomaly Detection in Network Flows
Sprache: Deutsch
Publikationsjahr: 14 Dezember 2023
Verlag: IEEE
Buchtitel: 2023 IEEE 9th International Workshop on Computational Advances in Multi-Sensor Adaptive Processing (CAMSAP)
Veranstaltungstitel: 9th International Workshop on Computational Advances in Multi-Sensor Adaptive Processing
Veranstaltungsort: Herradura, Costa Rica
Veranstaltungsdatum: 10.12.2023-13.12.2023
DOI: 10.1109/CAMSAP58249.2023.10403513
Kurzbeschreibung (Abstract):

Anomaly detection becomes increasingly important in the design of future resilient communication systems. In this work, anomaly detection in network flows with incomplete measurements on the basis of robust PCA, where normal flows are characterized as low-rank components and anomalies as sparse components, is considered. Based on the block-successive convex approximation framework, we first introduce a novel model-based algorithm for normal and anomalous traffic recovery. Since robust-PCA-based anomaly detection alone is suboptimal in terms of the receiver operating characteristic, we apply deep unrolling to this algorithm and use a homotopy optimization method to train the resulting deep network architecture to explicitly optimize the area under the curve of the receiver oper-ating characteristic. Thereby, the domain knowledge introduced by robust PCA is retained. Our deep unrolling-based network architecture outperforms the classical methods while generalizing well and featuring excellent data efficiency.

Freie Schlagworte: Conferences, Optimization methods, Receivers, Network architecture, Approximation algorithms, Anomaly detection, Principal component analysis, Deep unrolling, anomaly detection
Fachbereich(e)/-gebiet(e): 18 Fachbereich Elektrotechnik und Informationstechnik
18 Fachbereich Elektrotechnik und Informationstechnik > Institut für Nachrichtentechnik
18 Fachbereich Elektrotechnik und Informationstechnik > Institut für Nachrichtentechnik > Nachrichtentechnische Systeme
Hinterlegungsdatum: 16 Jan 2025 12:50
Letzte Änderung: 16 Jan 2025 12:50
PPN:
Export:
Suche nach Titel in: TUfind oder in Google
Frage zum Eintrag Frage zum Eintrag

Optionen (nur für Redakteure)
Redaktionelle Details anzeigen Redaktionelle Details anzeigen