skip to main content


Title: Network Anomaly Detection Based on Tensor Decomposition
The problem of detecting anomalies in time series from network measurements has been widely studied and is a topic of fundamental importance. Many anomaly detection methods are based on packet inspection collected at the network core routers, with consequent disadvantages in terms of computational cost and privacy. We propose an alternative method in which packet header inspection is not needed. The method is based on the extraction of a normal subspace obtained by the tensor decomposition technique considering the correlation between different metrics. We propose a new approach for online tensor decomposition where changes in the normal subspace can be tracked efficiently. Another advantage of our proposal is the interpretability of the obtained models. The flexibility of the method is illustrated by applying it to two distinct examples, both using actual data collected on residential routers.  more » « less
Award ID(s):
1740895
NSF-PAR ID:
10181893
Author(s) / Creator(s):
Date Published:
Journal Name:
18th Mediterranean Communication and Computer Networking Conference
Format(s):
Medium: X
Sponsoring Org:
National Science Foundation
More Like this
  1. Low-dimensional and computationally less-expensive reduced-order models (ROMs) have been widely used to capture the dominant behaviors of high-4dimensional systems. An ROM can be obtained, using the well-known proper orthogonal decomposition (POD), by projecting the full-order model to a subspace spanned by modal basis modes that are learned from experimental, simulated, or observational data, i.e., training data. However, the optimal basis can change with the parameter settings. When an ROM, constructed using the POD basis obtained from training data, is applied to new parameter settings, the model often lacks robustness against the change of parameters in design, control, and other real-time operation problems. This paper proposes to use regression trees on Grassmann manifold to learn the mapping between parameters and POD bases that span the low-dimensional subspaces onto which full-order models are projected. Motivated by the observation that a subspace spanned by a POD basis can be viewed as a point in the Grassmann manifold, we propose to grow a tree by repeatedly splitting the tree node to maximize the Riemannian distance between the two subspaces spanned by the predicted POD bases on the left and right daughter nodes. Five numerical examples are presented to comprehensively demonstrate the performance of the proposed method, and compare the proposed tree-based method to the existing interpolation method for POD basis and the use of global POD basis. The results show that the proposed tree-based method is capable of establishing the mapping between parameters and POD bases, and thus adapt ROMs for new parameters.

     
    more » « less
  2. In the era of big data, data-driven based classification has become an essential method in smart manufacturing to guide production and optimize inspection. The industrial data obtained in practice is usually time-series data collected by soft sensors, which are highly nonlinear, nonstationary, imbalanced, and noisy. Most existing soft-sensing machine learning models focus on capturing either intra-series temporal dependencies or pre-defined inter-series correlations, while ignoring the correlation between labels as each instance is associated with multiple labels simultaneously. In this paper, we propose a novel graph based soft-sensing neural network (GraSSNet) for multivariate time-series classification of noisy and highly-imbalanced soft-sensing data. The proposed GraSSNet is able to 1) capture the inter-series and intra-series dependencies jointly in the spectral domain; 2) exploit the label correlations by superimposing label graph that built from statistical co-occurrence information; 3) learn features with attention mechanism from both textual and numerical domain; and 4) leverage unlabeled data and mitigate data imbalance by semi-supervised learning. Comparative studies with other commonly used classifiers are carried out on Seagate soft sensing data, and the experimental results validate the competitive performance of our proposed method. 
    more » « less
  3. Purpose

    A new method for enhancing the sensitivity of diffusion MRI (dMRI) by combining the data from single (sPFG) and double (dPFG) pulsed field gradient experiments is presented.

    Methods

    This method uses our JESTER framework to combine microscopic anisotropy information from dFPG experiments using a new method called diffusion tensor subspace imaging (DiTSI) to augment the macroscopic anisotropy information from sPFG data analyzed using our guided by entropy spectrum pathways method. This new method, called joint estimation diffusion imaging (JEDI), combines the sensitivity to macroscopic diffusion anisotropy of sPFG with the sensitivity to microscopic diffusion anisotropy of dPFG methods.

    Results

    Its ability to produce significantly more detailed anisotropy maps and more complete fiber tracts than existing methods within both brain white matter (WM) and gray matter (GM) is demonstrated on normal human subjects on data collected using a novel fast, robust, and clinically feasible sPFG/dPFG acquisition.

    Conclusions

    The potential utility of this method is suggested by an initial demonstration of its ability to mitigate the problem of gyral bias. The capability of more completely characterizing the tissue structure and connectivity throughout the entire brain has broad implications for the utility and scope of dMRI in a wide range of research and clinical applications.

     
    more » « less
  4. We use commercial wearable sensors to collect three-dimensional acceleration signals from various gaits. Then, we organize the collected measurements in three-way tensors and present a simple, efficient gait classification scheme based on TUCKER2 tensor decomposition. The proposed scheme derives as multi-linear generalization of the nearest-subspace classifier. Our experimental studies show that the proposed approach manages to automatically identify the motion axes of interest and classify walking, jogging, and running gaits with high accuracy. 
    more » « less
  5. The Sylvester equation offers a powerful and unifying primitive for a variety of important graph mining tasks, including network alignment, graph kernel, node similarity, subgraph matching, etc. A major bottleneck of Sylvester equation lies in its high computational complexity. Despite tremendous effort, state-of-the-art methods still require a complexity that is at least \em quadratic in the number of nodes of graphs, even with approximations. In this paper, we propose a family of Krylov subspace based algorithms (\fasten) to speed up and scale up the computation of Sylvester equation for graph mining. The key idea of the proposed methods is to project the original equivalent linear system onto a Kronecker Krylov subspace. We further exploit (1) the implicit representation of the solution matrix as well as the associated computation, and (2) the decomposition of the original Sylvester equation into a set of inter-correlated Sylvester equations of smaller size. The proposed algorithms bear two distinctive features. First, they provide the \em exact solutions without any approximation error. Second, they significantly reduce the time and space complexity for solving Sylvester equation, with two of the proposed algorithms having a \em linear complexity in both time and space. Experimental evaluations on a diverse set of real networks, demonstrate that our methods (1) are up to $10,000\times$ faster against Conjugate Gradient method, the best known competitor that outputs the exact solution, and (2) scale up to million-node graphs. 
    more » « less