{"created":"2023-05-15T11:58:53.749616+00:00","id":5096,"links":{},"metadata":{"_buckets":{"deposit":"a44c3a4b-b45f-4cfe-a64e-6bb593c007d6"},"_deposit":{"created_by":14,"id":"5096","owners":[14],"pid":{"revision_id":0,"type":"depid","value":"5096"},"status":"published"},"_oai":{"id":"oai:kyutech.repo.nii.ac.jp:00005096","sets":["8:24"]},"author_link":["20529","20530","20531","5853","900"],"item_21_biblio_info_6":{"attribute_name":"書誌情報","attribute_value_mlt":[{"bibliographicIssueDates":{"bibliographicIssueDate":"2012-07-01","bibliographicIssueDateType":"Issued"},"bibliographicIssueNumber":"7","bibliographicPageEnd":"2367","bibliographicPageStart":"2358","bibliographicVolumeNumber":"E95-B","bibliographic_titles":[{"bibliographic_title":"IEICE Transactions on Communications","bibliographic_titleLang":"en"}]}]},"item_21_description_4":{"attribute_name":"抄録","attribute_value_mlt":[{"subitem_description":"We propose an anomaly detection method for finding patterns in network traffic that do not conform to legitimate (i.e., normal) behavior. The proposed method trains a baseline model describing the normal behavior of network traffic without using manually labeled traffic data. The trained baseline model is used as the basis for comparison with the audit network traffic. This anomaly detection works in an unsupervised manner through the use of time-periodic packet sampling, which is used in a manner that differs from its intended purpose — the lossy nature of packet sampling is used to extract normal packets from the unlabeled original traffic data. Evaluation using actual traffic traces showed that the proposed method has false positive and false negative rates in the detection of anomalies regarding TCP SYN packets comparable to those of a conventional method that uses manually labeled traffic data to train the baseline model. Performance variation due to the probabilistic nature of sampled traffic data is mitigated by using ensemble anomaly detection that collectively exploits multiple baseline models in parallel. Alarm sensitivity is adjusted for the intended use by using maximum- and minimum-based anomaly detection that effectively take advantage of the performance variations among the multiple baseline models. Testing using actual traffic traces showed that the proposed anomaly detection method performs as well as one using manually labeled traffic data and better than one using randomly sampled (unlabeled) traffic data. ","subitem_description_language":"en","subitem_description_type":"Abstract"}]},"item_21_description_60":{"attribute_name":"資源タイプ","attribute_value_mlt":[{"subitem_description":"Journal Article","subitem_description_type":"Other"}]},"item_21_publisher_7":{"attribute_name":"出版社","attribute_value_mlt":[{"subitem_publisher":"電子情報通信学会","subitem_publisher_language":"ja"}]},"item_21_relation_12":{"attribute_name":"DOI","attribute_value_mlt":[{"subitem_relation_type":"isIdenticalTo","subitem_relation_type_id":{"subitem_relation_type_id_text":"https://doi.org/10.1587/transcom.E95.B.2358","subitem_relation_type_select":"DOI"}}]},"item_21_rights_13":{"attribute_name":"著作権関連情報","attribute_value_mlt":[{"subitem_rights":"Copyright (c) 2012 The Institute of Electronics, Information and Communication Engineers"}]},"item_21_select_59":{"attribute_name":"査読の有無","attribute_value_mlt":[{"subitem_select_item":"yes"}]},"item_21_source_id_10":{"attribute_name":"NCID","attribute_value_mlt":[{"subitem_source_identifier":"AA10826261","subitem_source_identifier_type":"NCID"}]},"item_21_source_id_8":{"attribute_name":"ISSN","attribute_value_mlt":[{"subitem_source_identifier":"0916-8516","subitem_source_identifier_type":"PISSN"},{"subitem_source_identifier":"1745-1345","subitem_source_identifier_type":"EISSN"}]},"item_21_text_63":{"attribute_name":"連携ID","attribute_value_mlt":[{"subitem_text_value":"6280"}]},"item_21_version_type_58":{"attribute_name":"出版タイプ","attribute_value_mlt":[{"subitem_version_resource":"http://purl.org/coar/version/c_970fb48d4fbd8a85","subitem_version_type":"VoR"}]},"item_creator":{"attribute_name":"著者","attribute_type":"creator","attribute_value_mlt":[{"creatorNames":[{"creatorName":"Uchida,  Masato","creatorNameLang":"en"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"Nawata, Shuichi","creatorNameLang":"en"}],"nameIdentifiers":[{}]},{"creatorNames":[{"creatorName":"Gu, Yu","creatorNameLang":"en"}],"nameIdentifiers":[{}]},{"creatorAffiliations":[{"affiliationNames":[{}]}],"creatorNames":[{"creatorName":"Tsuru, Masato","creatorNameLang":"en"},{"creatorName":"鶴, 正人","creatorNameLang":"ja"},{"creatorName":"ツル, マサト","creatorNameLang":"ja-Kana"}],"familyNames":[{},{},{}],"givenNames":[{},{},{}],"nameIdentifiers":[{},{},{},{},{}]},{"creatorAffiliations":[{"affiliationNames":[{}]}],"creatorNames":[{"creatorName":"Oie, Yuji","creatorNameLang":"en"},{"creatorName":"尾家, 祐二","creatorNameLang":"ja"},{"creatorName":"オイエ, ユウジ","creatorNameLang":"ja-Kana"}],"familyNames":[{},{},{}],"givenNames":[{},{},{}],"nameIdentifiers":[{},{},{}]}]},"item_files":{"attribute_name":"ファイル情報","attribute_type":"file","attribute_value_mlt":[{"accessrole":"open_date","date":[{"dateType":"Available","dateValue":"2017-08-24"}],"displaytype":"detail","filename":"ieice_t_c_95_7.pdf","filesize":[{"value":"985.0 kB"}],"format":"application/pdf","licensetype":"license_note","mimetype":"application/pdf","url":{"label":"ieice_t_c_95_7.pdf","url":"https://kyutech.repo.nii.ac.jp/record/5096/files/ieice_t_c_95_7.pdf"},"version_id":"e4938d74-f320-4863-b9d3-61750e331574"}]},"item_keyword":{"attribute_name":"キーワード","attribute_value_mlt":[{"subitem_subject":"anomaly detection","subitem_subject_scheme":"Other"},{"subitem_subject":"packet sampling","subitem_subject_scheme":"Other"}]},"item_language":{"attribute_name":"言語","attribute_value_mlt":[{"subitem_language":"eng"}]},"item_resource_type":{"attribute_name":"資源タイプ","attribute_value_mlt":[{"resourcetype":"journal article","resourceuri":"http://purl.org/coar/resource_type/c_6501"}]},"item_title":"Unsupervised Ensemble Anomaly Detection Using Time-Periodic Packet Sampling","item_titles":{"attribute_name":"タイトル","attribute_value_mlt":[{"subitem_title":"Unsupervised Ensemble Anomaly Detection Using Time-Periodic Packet Sampling","subitem_title_language":"en"}]},"item_type_id":"21","owner":"14","path":["24"],"pubdate":{"attribute_name":"PubDate","attribute_value":"2017-08-24"},"publish_date":"2017-08-24","publish_status":"0","recid":"5096","relation_version_is_last":true,"title":["Unsupervised Ensemble Anomaly Detection Using Time-Periodic Packet Sampling"],"weko_creator_id":"14","weko_shared_id":-1},"updated":"2023-12-05T03:03:47.405536+00:00"}