Cluster-based deep one-class classification model for anomaly detection

Younghwan Kim, Huy Kang Kim

Research output: Contribution to journalArticlepeer-review

1 Citation (Scopus)

Abstract

As cyber-attacks on Cyber-Physical System (CPS) become more diverse and sophisticated, it is important to quickly detect malicious behaviors occurring in CPS. Since CPS can collect sensor data in near real time throughout the process, there have been many attempts to detect anomaly behavior through normal behavior learning from the perspective of data-driven security. However, since the CPS datasets are big data and most of the data are normal data, it has always been a great challenge to analyze the data and implement the anomaly detection model. In this paper, we propose and evaluate the Clustered Deep One-Class Classification (CD-OCC) model that combines the clustering algorithm and deep learning (DL) model using only a normal dataset for anomaly detection. We use auto-encoder to reduce the dimensions of the dataset and the K-means clustering algorithm to classify the normal data into the optimal cluster size. The DL model trains to predict clusters of normal data, and we can obtain logit values as outputs. The derived logit values are datasets that can better represent normal data in terms of knowledge distillation and are used as inputs to the OCC model. As a result of the experiment, the F1 score of the proposed model shows 0.93 and 0.83 in the SWaT and HAI dataset, respectively, and shows a significant performance improvement over other recent detectors such as Com-AE and SVM-RBF.

Original languageEnglish
Pages (from-to)903-911
Number of pages9
JournalJournal of Internet Technology
Volume22
Issue number4
DOIs
Publication statusPublished - 2021

Keywords

  • Anomaly detection
  • Clustering
  • Deep learning
  • Knowledge distillation

ASJC Scopus subject areas

  • Software
  • Computer Networks and Communications

Fingerprint

Dive into the research topics of 'Cluster-based deep one-class classification model for anomaly detection'. Together they form a unique fingerprint.

Cite this