MAD-MulW: A Multi-Window Anomaly Detection Framework for BGP Security Events

• URL: http://arxiv.org/abs/2312.11225v1
• Date: Mon, 18 Dec 2023 14:19:40 GMT
• Title: MAD-MulW: A Multi-Window Anomaly Detection Framework for BGP Security Events
• Authors: Songtao Peng, Yiping Chen, Xincheng Shu, Wu Shuai, Shenhao Fang, Zhongyuan Ruan, Qi Xuan,
• Abstract summary: BGP-based event monitoring makes it possible to perform differential analysis of international events. We propose an unsupervised anomaly detection model, MAD-MulW, which incorporates a multi-window serial framework. Our model has been experimentally validated on multiple BGP anomalous events with an average F1 score of over 90%.
• Score: 5.46189969246928
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: In recent years, various international security events have occurred frequently and interacted between real society and cyberspace. Traditional traffic monitoring mainly focuses on the local anomalous status of events due to a large amount of data. BGP-based event monitoring makes it possible to perform differential analysis of international events. For many existing traffic anomaly detection methods, we have observed that the window-based noise reduction strategy effectively improves the success rate of time series anomaly detection. Motivated by this observation, we propose an unsupervised anomaly detection model, MAD-MulW, which incorporates a multi-window serial framework. Firstly, we design the W-GAT module to adaptively update the sample weights within the window and retain the updated information of the trailing sample, which not only reduces the outlier samples' noise but also avoids the space consumption of data scale expansion. Then, the W-LAT module based on predictive reconstruction both captures the trend of sample fluctuations over a certain period of time and increases the interclass variation through the reconstruction of the predictive sample. Our model has been experimentally validated on multiple BGP anomalous events with an average F1 score of over 90\%, which demonstrates the significant improvement effect of the stage windows and adaptive strategy on the efficiency and stability of the timing model.

Related papers

• Contextual and Seasonal LSTMs for Time Series Anomaly Detection [49.50689313712684]
  We propose a novel prediction-based framework named Contextual and Seasonal LSTMs (CS-LSTMs)<n>CS-LSTMs are built upon a noise decomposition strategy and jointly leverage contextual dependencies and seasonal patterns.<n>They consistently outperform state-of-the-art methods, highlighting their effectiveness and practical value in robust time series anomaly detection.
  arXiv  Detail & Related papers  (2026-02-10T11:46:15Z)
• Steering Vision-Language-Action Models as Anti-Exploration: A Test-Time Scaling Approach [78.4812458793128]
  We propose textbfTACO, a test-time-scaling framework that applies a lightweight pseudo-count estimator as a high-fidelity verifier of action chunks.<n>Our method resembles the classical anti-exploration principle in offline reinforcement learning (RL), and being gradient-free, it incurs significant computational benefits.
  arXiv  Detail & Related papers  (2025-12-02T14:42:54Z)
• Evaluation of Stress Detection as Time Series Events -- A Novel Window-Based F1-Metric [3.0936815707071403]
  Time series evaluation is essential for applications such as stress monitoring with wearable devices.<n>Standard metrics like F1 often misrepresent model performance in real-world, imbalanced datasets.<n>We introduce a window-based F1 metric (F1$_w$) that incorporates temporal tolerance.
  arXiv  Detail & Related papers  (2025-09-03T11:55:28Z)
• CALM: A Framework for Continuous, Adaptive, and LLM-Mediated Anomaly Detection in Time-Series Streams [0.42970700836450476]
  This paper introduces CALM, a novel, end-to-end framework for real-time anomaly detection.<n> CALM is built on the Apache Beam distributed processing framework.<n>It implements a closed-loop, continuous fine-tuning mechanism that allows the anomaly detection model to adapt to evolving data patterns in near real-time.
  arXiv  Detail & Related papers  (2025-08-29T00:27:35Z)
• EventVAD: Training-Free Event-Aware Video Anomaly Detection [19.714436150837148]
  EventVAD is an event-aware video anomaly detection framework. It combines tailored dynamic graph architectures and multimodal-event reasoning. It achieves state-of-the-art (SOTA) in training-free settings, outperforming strong baselines that use 7B or larger MLLMs.
  arXiv  Detail & Related papers  (2025-04-17T16:59:04Z)
• Strengthening Anomaly Awareness [0.0]
  We present a refined version of the Anomaly Awareness framework for enhancing unsupervised anomaly detection. Our approach introduces minimal supervision into Variational Autoencoders (VAEs) through a two-stage training strategy.
  arXiv  Detail & Related papers  (2025-04-15T16:52:22Z)
• Event Signal Filtering via Probability Flux Estimation [58.31652473933809]
  Events offer a novel paradigm for capturing scene dynamics via asynchronous sensing, but their inherent randomness often leads to degraded signal quality. Event signal filtering is thus essential for enhancing fidelity by reducing this internal randomness and ensuring consistent outputs across diverse acquisition conditions. This paper introduces a generative, online filtering framework called Event Density Flow Filter (EDFilter) Experiments validate EDFilter's performance across tasks like event filtering, super-resolution, and direct event-based blob tracking.
  arXiv  Detail & Related papers  (2025-04-10T07:03:08Z)
• Abnormality Forecasting: Time Series Anomaly Prediction via Future Context Modeling [30.87477150049186]
  Identifying anomalies from time series data plays an important role in various fields such as infrastructure security, intelligent operation and maintenance, and space exploration. Current research focuses on detecting the anomalies after they occur, which can lead to significant financial/reputation loss or infrastructure damage. In this work we study a more practical yet very challenging problem, time series anomaly prediction, aiming at providing early warnings for abnormal events before their occurrence.
  arXiv  Detail & Related papers  (2024-10-16T04:00:00Z)
• Graph Spatiotemporal Process for Multivariate Time Series Anomaly Detection with Missing Values [67.76168547245237]
  We introduce a novel framework called GST-Pro, which utilizes a graphtemporal process and anomaly scorer to detect anomalies. Our experimental results show that the GST-Pro method can effectively detect anomalies in time series data and outperforms state-of-the-art methods.
  arXiv  Detail & Related papers  (2024-01-11T10:10:16Z)
• LARA: A Light and Anti-overfitting Retraining Approach for Unsupervised Time Series Anomaly Detection [49.52429991848581]
  We propose a Light and Anti-overfitting Retraining Approach (LARA) for deep variational auto-encoder based time series anomaly detection methods (VAEs) This work aims to make three novel contributions: 1) the retraining process is formulated as a convex problem and can converge at a fast rate as well as prevent overfitting; 2) designing a ruminate block, which leverages the historical data without the need to store them; and 3) mathematically proving that when fine-tuning the latent vector and reconstructed data, the linear formations can achieve the least adjusting errors between the ground truths and the fine-tuned ones.
  arXiv  Detail & Related papers  (2023-10-09T12:36:16Z)
• Test-Time Compensated Representation Learning for Extreme Traffic Forecasting [13.859278899032846]
  congestion and rush hours can result in low correlation in vehicle speeds at various intersections during adjacent time periods. Existing methods generally predict future series based on recent and entirely decomposed training data during the testing phase. We propose a test-time representation learning framework comprising a multi-head spatial spatial transformer model.
  arXiv  Detail & Related papers  (2023-09-16T18:46:34Z)
• Incremental Outlier Detection Modelling Using Streaming Analytics in Finance & Health Care [0.0]
  In the era of real-time data, traditional methods often struggle to keep pace with the dynamic nature of streaming environments. In this paper, we proposed a hybrid framework where the model is built once and evaluated in a real-time environment. We employed 8 distinct state-of-the-art outlier detection models, including one-class support vector machine (OCSVM), isolation forest adaptive sliding window approach (IForest ASD), exact storm (ES), angle-based outlier detection (ABOD), local outlier factor (LOF), Kitsunes online algorithm (KitNet), and K-nearest neighbour
  arXiv  Detail & Related papers  (2023-05-17T02:30:28Z)
• Abnormal Event Detection via Hypergraph Contrastive Learning [54.80429341415227]
  Abnormal event detection plays an important role in many real applications. In this paper, we study the unsupervised abnormal event detection problem in Attributed Heterogeneous Information Network. A novel hypergraph contrastive learning method, named AEHCL, is proposed to fully capture abnormal event patterns.
  arXiv  Detail & Related papers  (2023-04-02T08:23:20Z)
• A Multi-View Framework for BGP Anomaly Detection via Graph Attention Network [4.120328427084187]
  Border Gateway Protocols (BGP) is the default protocol for exchanging routing reachability information on the Internet. BGP anomalous detection model ensures stable routing services on the Internet through its real-time monitoring and alerting capabilities.
  arXiv  Detail & Related papers  (2021-12-23T05:03:52Z)
• Robust Unsupervised Video Anomaly Detection by Multi-Path Frame Prediction [61.17654438176999]
  We propose a novel and robust unsupervised video anomaly detection method by frame prediction with proper design. Our proposed method obtains the frame-level AUROC score of 88.3% on the CUHK Avenue dataset.
  arXiv  Detail & Related papers  (2020-11-05T11:34:12Z)
• A Background-Agnostic Framework with Adversarial Training for Abnormal Event Detection in Video [120.18562044084678]
  Abnormal event detection in video is a complex computer vision problem that has attracted significant attention in recent years. We propose a background-agnostic framework that learns from training videos containing only normal events.
  arXiv  Detail & Related papers  (2020-08-27T18:39:24Z)
• A Multi-Channel Neural Graphical Event Model with Negative Evidence [76.51278722190607]
  Event datasets are sequences of events of various types occurring irregularly over the time-line. We propose a non-parametric deep neural network approach in order to estimate the underlying intensity functions.
  arXiv  Detail & Related papers  (2020-02-21T23:10:50Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.