Random Partitioning Forest for Point-Wise and Collective Anomaly Detection-Application to Network Intrusion Detection

In this paper, we propose DiFF-RF, an ensemble approach composed of random partitioning binary trees to detect point-wise and collective (as well as contextual) anomalies. Thanks to a distance-based paradigm used at the leaves of the trees, this semi-supervised approach solves a drawback that has be...

Full description

Saved in:
Bibliographic Details
Published in:IEEE transactions on information forensics and security 2021-01, Vol.16, p.2157-2172
Main Author: Marteau, Pierre-Francois
Format: Article
Language:English
Subjects:
Algorithms
Anomalies
Anomaly detection
Coders
Complexity theory
Computer architecture
Computer Science
Data Structures and Algorithms
Entropy
Forestry
Information Retrieval
intrusion detection
Intrusion detection systems
Leaves
Machine learning
NIDS
Parallel processing
Parameters
Partitioning
Partitioning algorithms
Performance enhancement
Random forest
semi-supervised learning
Support vector machines
Vegetation
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:In this paper, we propose DiFF-RF, an ensemble approach composed of random partitioning binary trees to detect point-wise and collective (as well as contextual) anomalies. Thanks to a distance-based paradigm used at the leaves of the trees, this semi-supervised approach solves a drawback that has been identified in the isolation forest (IF) algorithm. Moreover, taking into account the frequencies of visits in the leaves of the random trees allows to significantly improve the performance of DiFF-RF when considering the presence of collective anomalies. DiFF-RF is fairly easy to train, and good performance can be obtained by using a simple semi-supervised procedure to setup the extra hyper-parameter that is introduced. We first evaluate DiFF-RF on a synthetic data set to i) verify that the limitation of the IF algorithm is overcome, ii) demonstrate how collective anomalies are actually detected and iii) to analyze the effect of the meta-parameters it involves. We assess the DiFF-RF algorithm on a large set of datasets from the UCI repository, as well as four benchmarks related to network intrusion detection applications. Our experiments show that DiFF-RF almost systematically outperforms the IF algorithm and one of its extended variant, but also challenges the one-class SVM baseline, deep learning variational auto-encoder and ensemble of auto-encoder architectures. Finally, DiFF-RF is computationally efficient and can be easily parallelized on multi-core architectures.
ISSN:1556-6013
1556-6021
DOI:10.1109/TIFS.2021.3050605