We consider the problem of clustering data points coming from sub-Gaussian mixtures. Existing methods that provably achieve the optimal mislabeling error, such as the Lloyd algorithm, are usually vulnerable to outliers. In contrast, clustering methods seemingly robust to adversarial perturbations are not known to satisfy the optimal statistical guarantees. We propose a simple robust algorithm based on the coordinatewise median that obtains the optimal mislabeling rate even when we allow adversarial outliers to be present. Our algorithm achieves the optimal error rate in constant iterations when a weak initialization condition is satisfied. In the absence of outliers, in fixed dimensions, our theoretical guarantees are similar to that of the Lloyd algorithm. Extensive experiments on various simulated and public datasets are conducted to support the theoretical guarantees of our method.

We study learning from unlabeled data distributed across clients in a federated fashion where raw data do not leave the corresponding devices. We develop a K-means clustering algorithm within this federated setting where the local datasets are clustered at the clients, and a server generates the global clusters after aggregating the local ones. Given the importance of initialization on the federated K -means algorithm (FKM), our objective is to find better initial centroids by utilizing the local data stored on each client. To this end, we start the centroid initialization at the clients, rather than at the server, since the server initially lacks any preliminary insight into the clients’ data. The clients first select their local initial clusters and subsequently share their clustering information (including cluster centroids and sizes) with the server. The server then employs a greedy algorithm to determine the global initial centroids based on the information received from the clients. We refer to this idea as G-FKM. Numerical results obtained from both synthetic and public datasets demonstrate that our proposed algorithm demonstrates accelerated convergence, exhibiting reduced within-cluster sum of squares ( WCSS ) and higher adjusted Rand Index compared to three distinct federated K-means variants. This improvement comes at a relatively low cost of sending limited additional information from the clients to the server, rather than conducting the initialization entirely at the server. Furthermore, we have also observed that the proposed algorithm performs better than the centralized algorithm for cases where the data distribution across the clients is highly skewed.

One-Class Support Vector Machines (OCSVMs) are a set of common approaches for novelty detection due to their flexibility in fitting complex nonlinear boundaries between normal and novel data. Novelty detection is important in the Internet of Things (“IoT”) due to the potential threats that IoT devices can present, and OCSVMs often perform well in these environments due to the variety of devices, traffic patterns, and anomalies that IoT devices present. Unfortunately, conventional OCSVMs can introduce prohibitive memory and computational overhead in detection. This work designs, implements, and evaluates an efficient OCSVM for such practical settings. We extend Nyström and (Gaussian) Sketching approaches to OCSVM, combining these methods with clustering and Gaussian mixture models to achieve 15-30x speedup in prediction time and 30-40x reduction in memory requirements without sacrificing detection accuracy. Here, the very nature of IoT devices is crucial: they tend to admit few modes of normal operation, allowing for efficient pattern compression.

This paper focuses on the problem of adversarial attacks from Byzantine machines in a Federated Learning setting where non-Byzantine machines can be partitioned into disjoint clusters. In this setting, non-Byzantine machines in the same cluster have the same underlying data distribution, and different clusters of non-Byzantine machines have different learning tasks. Byzantine machines can adversarially attack any cluster and disturb the training process on clusters they attack. In the presence of Byzantine machines, the goal of our work is to identify cluster membership of non-Byzantine machines and optimize the models learned by each cluster. We adopt the Iterative Federated Clustering Algorithm (IFCA) framework of Ghosh et al. (2020) to alternatively estimate cluster membership and optimize models. In order to make this framework robust against adversarial attacks from Byzantine machines, we use coordinate-wise trimmed mean and coordinate-wise median aggregation methods used by Yin et al. (2018). Specifically, we propose a new Byzantine-Robust Iterative Federated Clustering Algorithm to improve on the results in Ghosh et al. (2019). We prove a convergence rate for this algorithm for strongly convex loss functions. We compare our convergence rate with the convergence rate of an existing algorithm, and we demonstrate the performance of our algorithm on simulated data.

Insecure Internet of things (IoT) devices pose significant threats to critical infrastructure and the Internet at large; detecting anomalous behavior from these devices remains of critical importance, but fast, efficient, accurate anomaly detection (also called "novelty detection") for these classes of devices remains elusive. One-Class Support Vector Machines (OCSVM) are one of the state-of-the-art approaches for novelty detection (or anomaly detection) in machine learning, due to their flexibility in fitting complex nonlinear boundaries between normal and novel data. IoT devices in smart homes and cities and connected building infrastructure present a compelling use case for novelty detection with OCSVM due to the variety of devices, traffic patterns, and types of anomalies that can manifest in such environments. Much previous research has thus applied OCSVM to novelty detection for IoT. Unfortunately, conventional OCSVMs introduce significant memory requirements and are computationally expensive at prediction time as the size of the train set grows, requiring space and time that scales with the number of training points. These memory and computational constraints can be prohibitive in practical, real-world deployments, where large training sets are typically needed to develop accurate models when fitting complex decision boundaries. In this work, we extend so-called Nyström and (Gaussian) Sketching approaches to OCSVM, by combining these methods with clustering and Gaussian mixture models to achieve significant speedups in prediction time and space in various IoT settings, without sacrificing detection accuracy.

Although many distributed denial of service (DDoS) attacks detection algorithms have been proposed and even some of them have claimed high detection accuracy, DDoS attacks are still a major problem for network security. The latent and inherent problems of these detection algorithms are 1) Requirement of both normal and attack data for building detection models, and 2) Almost inability to detect novel and unknown DDoS attacks. To conquer the problems, this paper proposes an AutoEncoder based DDoS attacks Detection Framework (AE-D3F), which only uses normal traffic to build the detection model and is able to update itself automatically as time goes. Experimental results on synthetic and public traffic show that our AE-D3F can not only achieve 82.00% detection rate (DR) with 0 false positive rate (FPR), better than classical anomaly detection approaches, but also detect novel and unknown attacks.

Encrypted application classification (EAC) has become an emerging and challenging task for network monitoring and management, and statistical-based approaches are less impacted by encrypted streams. However, much effort is required from domain experts to handcraft statistical features. To solve this problem, this paper proposes an end-to-end encrypted application classification framework (E2E-EACF) based on one dimensional convolutional neural network (1D-CNN). Only encrypted payload (EncP) and inter-arrival time (IAT) are required by the framework to classify encrypted flows. Experimental results denmonstrate that E2E-EACF can achieve more than 91.00% accuracy and 0.92 F1 score (the harmonic average of precision and recall) on a public dataset (WRCCDC), better than classical machine learning algorithms (e.g., decision tree and support vector machine).

Data representation plays a critical role in the performance of novelty detection (or ``anomaly detection'') methods in machine learning. The data representation of network traffic often determines the effectiveness of these models as much as the model itself. The wide range of novel events that network operators need to detect (e.g., attacks, malware, new applications, changes in traffic demands) introduces the possibility for a broad range of possible models and data representations. In each scenario, practitioners must spend significant effort extracting and engineering features that are most predictive for that situation or application. While anomaly detection is well-studied in computer networking, much existing work develops specific models that presume a particular representation -- often IPFIX/NetFlow. Yet, other representations may result in higher model accuracy, and the rise of programmable networks now makes it more practical to explore a broader range of representations. To facilitate such exploration, we develop a systematic framework, open-source toolkit, and public Python library that makes it both possible and easy to extract and generate features from network traffic and perform and end-to-end evaluation of these representations across most prevalent modern novelty detection models. We first develop and publicly release an open-source tool, an accompanying Python library (NetML), and end-to-end pipeline for novelty detection in network traffic. Second, we apply this tool to five different novelty detection problems in networking, across a range of scenarios from attack detection to novel device detection. Our findings general insights and guidelines concerning which features appear to be more appropriate for particular situations.

Flooding Distributed Denial of Service (DDoS) attacks can cause significant damage to Internet. These attacks have many similarities to Flash Crowds (FCs) and are always difficult to distinguish. To solve this issue, this paper first divides existing methods into two categories to clarify existing researches. Moreover, after conducting an extensive analysis, a new feature set is concluded to profile DDoS and FC. Along with this feature set, this paper proposes a new method that employs Data Mining approaches to discriminate between DDoS attacks and FCs. Experiments are conducted to evaluate the proposed method based on two realworld datasets. The results demonstrate that the proposed method could achieve a high accuracy (more than 98%). Additionally, compared with a traditional entropy method, the proposed method still demonstrates better performance.

Flooding DDoS and Flash Crowds (FC) are difficult to be discriminated from network layer because both of them have too many statistical similarities. If attacker learnt those statistical difference and could produce some mimicking traffic which have little difference from traffic produced by legitimate uses in FC, which means existing methods will uselessness. In order to verify the existence of this possibility, this paper proposes an idea that employed Least Squares Generative Adversarial Networks (LSGANs) to generate mimicking traffic to make the defense system uselessness. By experiments evaluated, the proposed idea could mimicking traffic to fool the defense system. The proposed idea mainly focuses on traffic statistical information of each Bot and legitimate user, does not rely on network environments, so the possibility of this mimicking attack happened could be existed in other networks, such as wired network, wireless network and mobile network.

Discriminating Distributed Denial of Service Attacks (DDoS) from Flash Crowds (FC) is a tough and challenging problem. If attackers could generate mimicking traffic which have little difference from the traffic produced by legitimate users in FC, are existing methods and defense systems still able to distinguish DDoS from FC? To verify the possibility of the existence of this mimicking attack and prove the existing methods cannot discriminate this attack from FC, this paper proposes an idea employed Least Squares Generative Adversarial Networks (LSGAN) to generate mimicking traffic based on a statistical features achieved from an extensive analysis of user traffic behavior of DDoS and FC. Then to establish an efficient defense system employed Random Forest to prove it can achieve better performance on real network traffic traces, but cannot discriminate this mimicking attack traffic from FC. The experiments results show the proposed idea can generate this mimicking attack traffic and the defense system cannot discriminate it from FC. In addition, a comparison with GAN has been made to show that LSGAN is better than GAN in performance.

DDoS and Flash Crowds are always difficult to distinguish. In order to solve this issue, this paper concluded a new feature set to profile the behaviors of legitimate users and Bots, and proposed an idea employed Random Forest to distinguish DDoS and FC on two widely-used datasets. The results show that the proposed idea can achieve distinguishing accuracy more than 95%. With comparison with traditional methods-Entropy, it still has a high accuracy.

DDoS attacks are very difficult to detect, researches have been in the pursuit of highly efficient and flexible DDoS attacks detection methods. For this purpose, we put forward an improved Non-parametric CUSUM method (NPCUSUM), which combined with adaptive sliding windows (ASW), to detect DDoS attacks. In order to evaluate our method, we do experiments on 2000 DARPA Intrusion Detection Scenario Specific Data Set (DARPA 2000 Dataset). The results show that the proposed method improves the detection efficiency and has good flexibility.

Network anomaly traffic detection can discover network abnormal behavior and unknown network attacks. But anomaly detection system in current has the disadvantage of the high rate of false positives. Because the condition is not sufficient and high-order conditional reasoning cannot be computed, it leads inaccurate detection of abnormal behavior. In this paper, an analysis method for abnormal network traffic detection is presented. The method firstly applied conditional event algebra for abnormal network traffic detection of Denial-of-Service (DoS) attacks on the 10% trainset of KDD Cup 99 data set. Neptune attack, as an instance of DoS attacks, is used to illustrate this method. Firstly of all, introducing analyzes the attack process of neptune attack. Then, Selecting the most related features of neptune attack on KDD Cup 99 data set and summarizes the basic flow chart of neptune attack. Finally, applying this method for detection of Neptune attack, it can be found that this method can handle with high-order conditional reasoning under insufficient situation, and detect network abnormal behavior.