Search

Anomaly extraction refers to automatically finding, in a large set of flows observed during an anomalous time interval, the flows associated with the anomalous event(s). It is important for root-cause analysis, network forensics, attack mitigation, and anomaly modeling. In this paper, we use meta-data provided by several histogram-based detectors to identify suspicious flows, and then apply association rule mining to find and summarize anomalous flows. Using rich traffic data from a backbone network, we show that our technique effectively finds the flows associated with the anomalous event(s) in all studied cases. In addition, it triggers a very small number of false positives, on average between 2 and 8.5, which exhibit specific patterns and can be trivially sorted out by an administrator. Our anomaly extraction method significantly reduces the work-hours needed for analyzing alarms, making anomaly detection systems more practical. [ABSTRACT FROM AUTHOR]

Abstract: Traditional algorithms in hiding sensitive association rules do not consider the correlation between rules, which lead to a high ratio of hiding failure and a big side effect. We propose a new privacy preserving algorithm for sensitive association rules based on least transactions to be modified in this paper, which considers the correlation between sensitive rules sufficiently. The proposed algorithm first creates a table in the main memory, then for each sensitive rule, inserts all the information about modification rules which can decrease their support or confidence into the table. After that, it compares all the modification rules and removes the modification rules which will increase the support or confidence of some sensitive rules. Then the algorithm selects transactions which satisfy maximum modification rules characteristics to modify each time. Thus, it will need much less transactions to be modified overall. Theoretical analysis and the experiment results show that the proposed algorithm can not only reduce the ratio of hiding failure but also modify much less transactions, and it produces a small side effect. [Copyright &y& Elsevier]