An Anomaly Detection Method Based On Deep Learning

Transcription

1 Sed Orders for Reprits to 734 The Ope Automatio ad Cotrol Systems Joural, 05, 7, A Aomaly Detectio Method Based O Deep Learig Ope Access Hog-li Deg *, Tao yag ad Jiag-i Gao Chia West ormal Uiversity, achog Sichua, Chia Abstract: I order to overcome the difficulty of extractig features from ad improve the accuracy of aomaly detectio system, this paper proposes a ovel aomaly detectio method based o deep learig. We build a deep eural etwork with multiple hidde layers to automatically lear features of before detectig aomaly behaviors. The leared features from this etwork ca ehace the discrimiatio of differet behaviors. Moreover, a exactly auto-ecoder (ESAE) is proposed to achieve the pre-traiig of this etwork. This method does ot require maual extractio of features, ad is usupervised, avoidig the difficulty of providig labeled. Experimetal results show that the proposed method could sigificatly improve the detectio accuracy. Keywords: Deep learig, Aomaly detectio, Feature represetatio, Sparse auto-ecoder.. ITRODUCTIO Itrusio detectio techology [] is to prevet or reduce the threat of cyber-attacks, uder the coditio that the etwork performace is ot affected. It ca be divided ito misuse detectio ad aomaly detectio techology. Compared to misuse detectio, aomaly detectio ca detect ukow attacks, so researches get more attetios o that. At preset, most aomaly detectio methods ca be summarized as follows: all the istaces are represeted as poits accordig to their features (attributes), ad the the classic patter classificatio algorithms such as eural etwork, decisio tree, cluster aalysis ad Bayesia theory, support vector machie (SVM), K earest eighbor algorithm (K) are used to classify these poits [-4]. We ca see that these features are the raw materials of the classificatio system. Good features play a key role for improvig the accuracy of various aomaly detectio algorithms. Geoffrey Hito, professor of uiversity of Toroto, ad a leader i the field of machie learig, has published a paper i sciece [5] about deep learig, which poits out that deep has outstadig advatages o learig good features. The features leared by this ca represet with richer iformatio. The basic idea of this [6] is to stack multiple oliear fuctios, combiig low-level features to form more abstract ad more useful high-level features. It maps all the samples from their origial space ito a ew feature space which ca facilitate the classificatio. Therefore, i order to improve the performace of various aomaly detectio algorithms, we proposed to use deep to lear better ad richer features of before iputtig them ito aomaly detectio system. By buildig deep eural etwork with more hidde layers, the *Address correspodece to this author at the Shida Road, achog, Chia. Postcard: 63700; Tel: ; @qq.com features of origial are extracted automatically from the bottom to the top layer. Ad the these features are used as the iput of ay existig aomaly detectio algorithms. Good feature represetatio of origial will help improve the performace of most algorithms. Moreover, these represetatios are leared completely usupervised, overcomig the difficulty of lack of labeled. I order to validate the effectiveess of our method, two aomaly detectio algorithms based o this method were give. Experimetal results show that the features leared by deep ca sigificatly improve the detectio accuracy compared to origial aomaly detectio algorithms.. AOMALY DETECTIO ARCHITECUTRE BASED O DEEP LEARIG I this paper, we propose to lear the features of based o deep eural etworks. Istead of the attributes desiged artificially, these features leared from these etworks will be iput ito the classificatio to detect abormal behaviors. As show i Fig. (), this aomaly detectio method icludes two stages. Oe is the traiig phase (Fig. A), which icludes the traiig tasks for feature learig ad classificatio. The traiig of feature learig is carried out by usupervised method, while classificatio is traied with labeled. Well traied feature learig ca be directly applied to lear feature of ew. The classificatio here ca be ay aomaly detectio algorithm that ca be used for the classificatio, such as K, eural etwork ad SVM, ad so o. Data preprocessig i this phase is to execute stadardizatio ad ormalizatio of iput, as well as type coversio. Aother phase is aomaly detectio usig the well traied s before. As show i Fig. (B), whe we detect abormal behaviors, we first preprocess the iput, ad the the traied feature learig i first stage is used to lear the features of. Fially, these /5 05 Betham Ope

2 A Aomaly Detectio Method Based O Deep Learig The Ope Automatio ad Cotrol Systems Joural, 05, Volume features are iput to the classifier to predict ormal or abormal iformatio. frequetly-used pre-traiig method ad our improvemet o it. ulabeled preprocessig Feature learig traiig Ulabelled for classifyig Classifcatio result trai the feature learig classificatio traiig (A) Model traiig phase preprocessig Classificatio (B) Aomaly detectio phase labelled traiig set ad test set preprocessig feature learig features of traiig set ad test set trai ad test the classificatio classificatio Feature learig features Fig. (). Aomaly detectio process based o deep learig 3. RESEARCH METHOD From the sectio, we ca see that the mai task of our is how to trai a good feature learig. However, it is well kow that, the traiig of deep eural etwork has bee very difficult before 006. The obective fuctio, which has may local optimal values [5], is very hard to optimize. Whether or ot the etwork ca achieve the optimal solutio, the iitial parameter has a pivotal role. If the iitial value is ot good, eural etwork is easy to fall ito local optimum. Util 006, Geoffrey Hito put forward that the difficulty of traiig eural etwork ca be effectively overcome by "layer-wise traiig" [4]. Iitialize etwork oe layer after oe layer, ad fially form the iitial value of the etire etwork. This iitializatio will help the gradiet descet begi at a better iitial search poit, so as to coverge to better local optima. The process to get this iitializatio is the pre-traiig of the etwork. Therefore, most importat task of our work is to pretrai our deep eural etwork, so as to get oe better iitializatio. I this sectio, we will first itroduce the whole process of etwork traiig. The we will focus o oe 3.. Traiig Process The basic rule for traiig deep eural etwork is as follows: first pre-trai etwork by a usupervised traiig method (i.e., layer-wise traiig for iitializatio); the stack multiple layers that has bee iitialized to form a deep etwork; fially fie-tue this pre-traied deep etwork to get the feature learig. This paper follows the same priciple. The first step, also the most importat step, is to use ulabeled (labeled ca also be used) for pre-traiig etwork. This process of pre-traiig ca be described as follows: Algorithm : Startig from the layer (i = ) () Use the feature i layer i - (that value of layer is the origial ) as the iput to trai preset layer i, so as to lear the ecodig parameters at this layer W b, which are applied to get the features i the layer i ( h ). () Iput h to the ext layer, followed by the traiig of the ext layer. (3) Repeat () ad () to trai each layer i the etwork, util the last layer. The of layer is the iput of etire deep etwork, amely the origial. The features obtaied for the last layer are the output of deep feature learig, ad the W iput of the followig classifier. ad weight ad bias values of layer i respectively. 3.. Auto-ecoder () b i represet Existig pre-traiig methods iclude auto-ecoder (AE), restricted Boltzma machie (RBM), codig ad deep belief etwork (DB). I this paper, we use autoecoder, which is simple but useful for pre-traiig our deep feature learig. Auto-ecoder [8-0] usually cosists of two parts: ecoder ad decoder. Ecoder uses oliear mappig fuctio f to map iput ( ( h R m x R ) ito the represetatio i hidde layer ). The mappig is represeted as follows: h= f( x) = s ( Wx+ b) f The parameters of ecoder cotai a weight matrix (W) m of size m, ad a bias vector ( b R ). Decoder applies oliear mappig fuctio g to recostruct iput from the represetatio i hidde layer m ( h R ) to form r R. ()

3 736 The Ope Automatio ad Cotrol Systems Joural, 05, Volume 7 Deg et al. ' ' r = g( h) = sg ( W h+ b) () W is the weight matrix of decoder with size m b R s,, ad s are oliear ac- is its bias vector. The f g tivatio fuctios, which usually adopt sigmoid or tah fuctio. () etwork architecture Suppose that we have a ulabeled traiig set () () ( ) {,,, ( k) X = x x L x } of examples, x R represets a sample. Fig. () gives the structure of covetioal auto-ecoder eural etwork. $!!! $! %&!! # + + & ' ($ ) %! % $ % %&! % # L L L 3 Fig. (). etwork Architecture. i Here, circle represets euros. The euro with + is a bias uit. There are three layers i the etwork: the iput layer o the left, the output layer o the right ad oe hidde layer. Let l deotes the umber of layers, for example l =3, as show i Fig. (). We label l-th layer as L l. 3 3 The parameters of the etwork are θ = ( W, b, W, b ), l where w deotes the weight associated with the coectio betwee -th uit i layer l ad i-th uit i layer l+. l Also, b i is the bias associated with i-th uit i layer l+. The otatio r ( x ) θ is the activatio of euros at the output layer whe x is give as iput. This etwork tries to lear a approximatio of the idetity fuctio, i other words to make rθ ( x ) similar to x. The mappig from the iput of etwork to the value i hidde layer is to ecode iput, amely learig feature of that. Ad the the recostructio process from hidde layer to the output is to decode from the feature. Our goal is to make the output after decodig approach, the origial iput. The ecoded result (activatio vector of hidde layer) is the feature expressio of the iput. () Cost fuctio Usually, auto-ecoder eural etwork [8-0] is traied by usupervised learig algorithm, which uses the back propagatio algorithm to make the output (recostructio of iput) approach the iput. That is to say the traiig ob- r ( x ) x ective is makig θ. The traiig process is to search the best parameters of etwork to miimize the recostructio error o the traiig set ( D ). Therefore, the cost fuctio ca be simply represeted as: λ l JAE ( θ) = ( L( x, g( f( x)))) + ( Wi ) x D The first item is the recostructio error, which usually is squared-error fuctio: Lxr (,) ( x r) i (3) = (4) or the cross etropy cost fuctio Lxr (,) = xlog( r) + ( x)log( r) = I this paper, oe-half squared-error fuctio is used for traiig. I detail, for a traiig example x, we defie the cost fuctio with respect to this example to be: L( θ ; x ) = r ( x ) x i θ Give a traiig set of m examples, the overall cost fuctio is: λ J( θ; X) = L( ; x ) + ( W ) l sl sl+ ( k) l θ i k= l= i= = = + l sl sl ( k) ( k) λ l rθ ( x ) x + ( Wi) k= l= i= = The first item is the average squared-errors of all examples. The secod item is weight decay to decrease the magitude of the weights, so as to help prevet over fittig. λ is weight decay parameter used to cotrol the relative importace of the two items. θ is the parameters of etwork, icludig the weights ad biases i all the layers The Improved Pre-traiig Method I this paper, a exactly auto-ecoder (ESAE) eural etwork is proposed to pre-trai deep eural etworks. ESAE is similar to covetioal autoecoder except that ESAE will force the euros whose activatio approximates zero to exact zero, achievig exact sparsity of leared features Exactly Sparse Auto-ecoder Based o covetioal auto-ecoder, i this paper we try to lear exact feature of. It udermies that most of the hidde layer euros are exact zero, which is differet from the approximate zero i traditioal auto-ecoder. That makes some of hidde euros (5) (6) (7)

4 A Aomaly Detectio Method Based O Deep Learig The Ope Automatio ad Cotrol Systems Joural, 05, Volume are activated, while the activatio of other hidde euros equals zero, so as to make the average activatio of hidde euros i a small rage. I this paper, the activatio fuctio of euros is the sigmoid fuctio. () We use h ( x ) to deote the activatio of the -th euro at hidde layer give the iput sample x. The average values of that over all the samples i traiig set is defied to be: i= ( ) () ˆ ρ = h x Sparse auto-ecoder is to add oe sparsity pealty item to the overall cost fuctio to help lear more features. These features ca improve the discrimiatio of differet, so that the accuracy of classifier is icreased. This sparsity pealty item is represeted as: s = ρ ρ ρlog + ( ρ) log ˆ ρ ˆ ρ Where ρ is a sparsity parameter, usually a small value close to zero? The sparsity pealty item makes ˆ ρ close to ρ, so as to make the average activatio of euros eough. The the overall cost fuctio after addig sparsity pealty item is as follows: λ J ( θ; X) = r ( x ) x + ( W ) l sl sl+ ( k) ( k) l θ i k= l= i= = s ρ ρ + β ρlog + ( ρ) log = ˆ ρ ˆ ρ (8) (9) (0) This sparsity pealty item results i the activatio of part of euros i hidde layer approximatig zero, but they are still more tha zero. I order to achieve exact sparsity of leared feature, we set a threshold s for () ( ) h x. It forces the activatio of euros i hidde layer, which approximate zero, to equal to zero. We defie a threshold fuctio to be: thred h ( x ) () ( ) ( x ) ( x ) () 0, h < s = (), h s The, the fial activatio of hidde euros is: i ( ) ( x ) = ( x ) ( x ) ( ) ( ) h h thred( h ) () () Learig algorithm () () The learig algorithm is to fid the fial activatio of hidde euros (oe feature expressio of iput) through searchig the miimal J ( θ ; X). I this paper, we adopt the batch gradiet descet algorithm as follows: Algorithm : ) Compute the overall cost fuctio J ( θ ; X) Step : forward propagatio. Compute the activatios of every layer ( l) ( ) ( ) ( ) l l l l z = W a + b (3) ( ) ( l) ( l) = (4) a f z a deotes the activatio of layer l. of layer l. ( l) z is the et iput Step : compute the average activatio of every hidde euro usig formula (8) Step 3: apply formula (0) to compute the overall cost fuctio J ( θ ; X) ) Compute the gradiet of J ( ; X) every parameter ( ) ( θ l ; ) ad ( l) J ( θ; X) J X W 3) Update all the parameters ( l) ( l) W θ with respect to b ( l) ( θ) W = W α J (5) ( l) ( l) b = b α J (6) Where α is learig rate. ( l) ( θ) b 4) Repeat ) - 3) util our cost fuctio J ( ; X) small eough. θ is 5) Compute the iitial activatios of hidde euros through forward propagatio with the traied parameters of etwork 6) Compute the fial activatio of hidde euros accordig to formula () Usig this algorithm, we ca obtai oe feature expressio of iput. It becomes the iput sigal of the secod ESAE. Through miimizig the loss fuctio of secod ESAE, we ca get the secod expressio of the origial iput iformatio. Repeatig the above steps, we obtai several ESAR etworks. Stackig them will form a multilayer etwork, which is our feature learig. The parameters of each layer are the feature expressio extractors of raw iput at differet levels. They ca be used to obtai the feature of ew.

5 738 The Ope Automatio ad Cotrol Systems Joural, 05, Volume 7 Deg et al. 4. EXPERIMETS AD AALYSES 4.. Dataset We use Breast Cacer Wiscosi Data Set (BCW) [] to verify the effectiveess of this method. It icludes 699 istaces. Each istace has oe of possible classes: beig or maligat, deoted by its class label ad 4. There are totally 458 ad 4 istaces for each class respectively. Ad each istace is described by 9 differet attributes. Therefore, we represet oe istace as a poit i 9- dimesio space, ad all the poits belogig to class beig as self-set, others as oself set. This paper focuses o improvig the detectio accuracy for oself set. So we used all the i self-set ad 00 poits i oself as the traiig set, ad the remaiig 4 samples i oself as test set. 4.. Experimetal Setup I our experimets, the feature learig i this paper cotais two feature learig layers. It meas that we will lear two feature represetatios at differet levels. So i our experimets two ESAE eural etworks were pretraied to iitialize parameters of the two feature learig layers. Each ESAE eural etwork cotais three layers: the iput layer, hidde layer ad output layer. For the first ESAE, the size of iput layer (deoted ass ) is equal to the dimesio of the iput, that iss = 9. We set its hidde layer sizes = 0. Ad the output layer size equals the s = s = 9, because the umber of iput layer euros 3 represetatio at output layer is the recostructio of iput. The iput of secod ESAE is the feature leared from the first ESAE (amely the represetatio i hidde layer of the first ESAE). Therefore, the iput layer size of the secod etwork equals hidde layer size of first ESAE s = s = 0). The size of its hidde layer ad output ( ' layer is both set to 0. Other parameters are = 0.003, β = 3, ρ = 0.5, ad the threshold s=0.00. These parameters are chose because they worked well i our experimets. Features leared by well-traied feature learig are iput to other regular aomaly detectio algorithms. We have validated the effectiveess of these features o two algorithms: K algorithm ad multi-layer eural etwork (MLP) algorithm. Set the earest eighbor size K from to 00 for K algorithm. MLP etwork icludes three layers, the iput layer, oe hidde layer ad the output layer. The size of iput ad output layer is 9 ad respectively. Ad the hidde layer size chages from 0 to The Experimetal Results Aalyses All the experimetal results are average values of 0 repeated tests. Fig. (3) gives the variace of detectio rates for K ad improved K based o DL (DL_K) with differet eighbor sizes. It shows that almost all the detectio rates usig DL_K method are higher tha that of K algorithm. The best detectio rate of K method is 90.7 whe K equals 6, while that of DL_K algorithm is up to 97.6% (K = 0). Moreover, we foud that whe K approached 00, the detectio rate declied quickly. That is because, whe K is close to 00, the umber of samples belogig to oself (oly 00 istaces of this class i traiig set) is less tha or equal to that belogig to self-set i the collectio of K eighbors. Therefore, most of the istaces i test set were predicted to be self-set. But eve i this situatio, our method still achieved better results. For example whe K equals 00, K detectio rate is.3%, while our detectio rate is 3.48%. However, whe K is larger tha 00, samples of self-set are always more tha oself samples i earest eighbors. At this time the detectio rate of both equals to zero. Fig. (4) shows the results of compariso betwee MLP ad DL_MLP method. We ca see that the detectio rates of DL_MLP method are all higher tha that of MLP method. All the experimetal results show that the features leared by deep learig ca improve the detectio rates of various detectio algorithms sigificatly. Fig. (3). Compariso betwee K ad DL_K method. Fig. (4). Compariso betwee MLP ad DL_MLP method.

6 A Aomaly Detectio Method Based O Deep Learig The Ope Automatio ad Cotrol Systems Joural, 05, Volume COCLUSIO Aimig at overcomig the problems of learig good feature ad improvig the detectio accuracy i aomaly detectio system, this paper proposed a ew aomaly detectio algorithm. This method applied a improved deep feature learig based o exactly autoecoder to lear more useful features. These features help the traditioal aomaly detectio algorithm to obtai better detectio accuracy. To our kowledge, it is the first time to use the deep learig to extract the features of aomaly detectio. This method proposed i this paper overcomes some limitatios of classical aomaly detectio methods. The mai advatages of this method are: () It does ot eed artificial feature extractio. Artificial eural etwork with much more hidde layers has outstadig advatages i terms of feature learig. It ca automatically lear with full use of big to get useful features; () The deep trasforms from oe expressio to aother, which implemets the mappig of the samples from the origial space to the ew feature space. This trasformatio keeps richer iformatio of the origial, at the same time ehaces the ability to distiguish differet samples, ad accordigly improves the accuracy of aomaly detectio; (3) The feature learig is a completely usupervised traiig process, which makes full use of huge amouts of ulabeled that are easy to access, overcomig the difficulty to obtai labeled. COFLICT OF ITEREST The authors cofirm that this article cotet has o coflict of iterest. REFERECES [] Zhag Zhao, Zhag Ru-lia ad Jiag Xiao-ge, Aomaly detectio method based o feature selectio ad support vector machie, Computer egieerig ad desig, vol. 34 o. 9 pp , 36, 03. [] Guo Xiao-fag, Li Feg ad Wag Wei-dog, Local outlier detectio algorithm of multivariate time series based o k-earest eighbor, Joural of Jiagsu Uiversity of Sciece ad Techology, vol. 6, o. 5, pp , 0. [3] Hou Di-bo, Che Yue ad Zhao Hai-feg, Water quality aomaly detectio method based o RBF eural etwork ad wavelet aalysis, Trasducer ad Microsystem Techologies, vol. 3, o., pp. 38-4, 03. [4] Qua Liag-liag ad WU Wei-dog, Aomaly detectio based o support vector machie ad Bayesia classificatio, Joural of Computer Applicatios vol. 3, o. 6, pp [5] Hito G ad Salakhutdiov R, Reducig the dimesioality of with eural etwork Sciece, vol. 33, o. 5786, pp , 006. [6] Yu Kai, Jia Lei ad Che Yuqiag, Deep Learig: Yesterday, Today, ad Tomorrowvol. 50, o. 9, pp , 03. [7] Begio Y. Learig deep architectures for AI, Foudatios ad treds i Machie Learig, vol., o., pp. -7, 009. [8] Rifai S, Vicet P ad Muller X. Cotractive auto-ecoders: Explicit ivariace durig feature extractio. Proceedigs of the 8th Iteratioal Coferece o Machie Learig (ICML-), 0: [9] Begio Y. Deep learig of represetatios: Lookig forward, Statistical Laguage ad Speech Processig. Spriger Berli Heidelberg, 03: pp [0] Begio Y, Courville A ad Vicet P, Represetatio learig: A review ad ew perspectives, Patter Aalysis ad Machie Itelligece, IEEE Trasactios o, vol. 35, o. 8, pp , 03. [] cosi+%8origial%9 ACKOWLEDGEMETS This study was supported by the proect grat from the Sciece ad Techology Departmet of SiChua Provice, Chia. o. 5ZB047 ad o. 5ZB04. Received: May 6, 05 Revised: July 4, 05 Accepted: August 0, 05 Deg et al.; Licesee Betham Ope. This is a ope access articles licesed uder the terms of the Creative Commos Attributio-o-Commercial 4.0 Iteratioal Public Licese (CC BY-C 4.0) ( which permits urestricted, o-commercial use, distributio ad reproductio i ay medium, provided that the work is properly cited.