Skip to main content
SpringerLink
Log in

An improvement of the state-of-the-art covariance-based methods for statistical anomaly detection algorithms

  • Original Paper
  • Published:
Signal, Image and Video Processing Aims and scope Submit manuscript

Abstract

This paper presents a possible improvement to one of the main statistical anomaly detection algorithms for cyber security applications, i.e., the covariance-based method. This algorithm employs covariance matrices to build a norm profile of the normal network traffic and to detect anomalous activities in the data flow. In order to improve the detection capabilities of this algorithm, we propose a modified version of the statistical decision rule based on a generalized version of the Chebyshev inequality for random vectors. The performance of the proposed algorithm is evaluated and compared, in terms of ROC (receiver operating characteristic) curves with the ones of the state-of-the-art covariance-based algorithm.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
Fig. 7

Similar content being viewed by others

References

  1. Thottan, M., Liu, G., Ji, C.: Anomaly detection approaches for communication networks. In: Algorithm for Next Generation Networks, Ch. 11, pp. 239-261. Springer, Berlin (2010)

  2. Chandola, V., Banerjee, A., Kumar, V.: Anomaly Detection: A Survey. Technical Report, Department of Computer Science and Engineering University of Minnesota, September (2009)

  3. Kent, S.: On the trail of intrusions into information systems. Spect. IEEE 37(12), 52–56 (2000)

    Article  Google Scholar 

  4. Scarfone, K., Mell, P.: Guide to intrusion detection and prevention systems (IDPS). Technical Report NIST SP 800-94, available at: csrc.nist.gov/publications/nistpubs/800-94/SP800-94.pdf

  5. Lakhina, A., Crovella, M., Diot C.: Diagnosis network-wide traffic anomalies. In: Proceedings of ACM SIGCOMM 2004, Portland, Oregon, USA, Aug. 30–Sept. 3, (2004)

  6. Yeung, D.S., Shuyuan, J., Xizhao, W.: Covariance-matrix modeling and detecting various flooding attacks. Syst. Man Cybern. A Syst. Humans IEEE Trans. 37(2), 157–169 (2007)

    Article  Google Scholar 

  7. Lee, W., Stolfo, S.: A framework for constructing features and models for intrusion detection systems. ACM Trans. Inf. Syst. Secur. 3(4), 227–261 (2000)

    Article  Google Scholar 

  8. Laha, R.G., Rohatgi, V.K.: Probability Theory. Wiley, New Jersey (1979)

    MATH  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Dipartimento di Ingegneria dell’Informazione, University of Pisa, Pisa, Italy

    Stefano Fortunati, Fulvio Gini & Maria S. Greco

  2. Selex ES, Rome, Italy

    Antonio Graziano & Sofia Giompapa

  3. IEEE AESS BoG VP Industry Relations, Rome, Italy

    Alfonso Farina

Authors
  1. Stefano Fortunati
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Fulvio Gini
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Maria S. Greco
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Alfonso Farina
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Antonio Graziano
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Sofia Giompapa
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Stefano Fortunati.

Additional information

The work of S. Fortunati has been supported by SESM-Finmeccanica and Selex ES.

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Fortunati, S., Gini, F., Greco, M.S. et al. An improvement of the state-of-the-art covariance-based methods for statistical anomaly detection algorithms. SIViP 10, 687–694 (2016). https://doi.org/10.1007/s11760-015-0796-y

Download citation

  • Received:

  • Revised:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s11760-015-0796-y

Keywords

Search

Navigation