Anomaly Detection with Changing Cluster Centers

  • Zhang Peng
  • Zhou Liang
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11323)


In view of the complexity of information system environment and the diversity of security requirements, many scholars proposed intrusion detection methods based on outlier mining. In order to meet the security requirement of condition guarantee information system, this paper proposes an anomaly detection with changing cluster centers (ADCCC). The rough set algorithm is used to reduce the sample set, and the number of sample repeats is determined on the basis of the duplicated degrees. The algorithm determines whether the sample is an outlier sample, mainly by changing the cluster center before and after adding a sample. Based on the overall deviation degree of the sample set, we can determine whether the sample set is an anomaly sample. Experimental results show that ADCCC algorithm has higher detection rate for anomaly detection.


Anomaly detection Rough set Sample reduction Outliers 


  1. 1.
    Guo, C., Zhou, Y.J., Ping, Y., et al.: Efficient intrusion detection using representative instances. Comput. Secur. 39(4), 255–267 (2013)CrossRefGoogle Scholar
  2. 2.
    Wang, Y., et al.: A novel intrusion detection system based on advanced Naive Bayesian classification. In: Long, K., Leung, V.C.M., Zhang, H., Feng, Z., Li, Y., Zhang, Z. (eds.) 5GWN 2017. LNICST, vol. 211, pp. 581–588. Springer, Cham (2018). Scholar
  3. 3.
    Feng, Y., Shigan, Y.U., Liu, H.: Network intrusion detection based on KNN-IPSO selecting features. Comput. Eng. Appl. (2014)Google Scholar
  4. 4.
    Jain, Y.K.: An efficient intrusion detection based on decision tree classifier using feature reduction. In: The First International Symposium on Data, Privacy, and E-Commerce, ISDPE 2007 (2007). 2012:c1Google Scholar
  5. 5.
    Hu, L., Zhang, Z., Tang, H., et al.: An improved intrusion detection framework based on artificial neural networks. In: International Conference on Natural Computation, pp. 1115–1120. IEEE (2016)Google Scholar
  6. 6.
    Breunig, M.M., Kriegel, H.P., Ng, R.T., et al.: LOF: identifying density-based local outliers. ACM Sigmod Rec. 29(2), 93–104 (2000)CrossRefGoogle Scholar
  7. 7.
    Zhang, K., Hutter, M., Jin, H.: A new local distance-based outlier detection approach for scattered real-world data. In: Theeramunkong, T., Kijsirikul, B., Cercone, N., Ho, T.-B. (eds.) PAKDD 2009. LNCS (LNAI), vol. 5476, pp. 813–822. Springer, Heidelberg (2009). Scholar
  8. 8.
    Pawlak, Z.: Rough set theory and its applications to data analysis. Cybern. Syst. 29(29), 661–688 (2010)CrossRefGoogle Scholar
  9. 9.
    Chen, Q., Liangxiao, J., Chaoqun, L.: Not always simple classification: learning super parent for class probability estimation. Expert Syst. Appl. 42(13), 5433–5440 (2015)CrossRefGoogle Scholar
  10. 10.
    Chen, H., Li, T., Luo, C., et al.: A decision-theoretic rough set approach for dynamic data mining. IEEE Trans. Fuzzy Syst. 23(6), 1958–1970 (2015)CrossRefGoogle Scholar
  11. 11.
    Lee, Y.J., Yeh, Y.R., Wang, Y.C.F.: Anomaly detection via online oversampling principal component analysis. IEEE Trans. Knowl. Data Eng. 25(7), 1460–1470 (2013)CrossRefGoogle Scholar
  12. 12.
    Bhuyan, M.H., Bhattacharyya, D.K., Kalita, J.K.: NADO: network anomaly detection using outlier approach. In: International Conference on Communication, Computing & Security, ICCCS 2011, February, Odisha, India, DBLP, pp. 531–536 (2011)Google Scholar
  13. 13.
    Xie, S., Nie, H.: Retinal vascular image segmentation using genetic algorithm plus FCM clustering. In: Proceedings of the 3rd International Conference on Intelligent System Design and Engineering Applications, Piscataway, NJ, pp. 1225–1228. IEEE (2013)Google Scholar
  14. 14.
    Shang, W., Zeng, P., Wan, M., et al.: Intrusion detection algorithm based oil OCSVM in industrial control system. Secur. Commun. Netw. 9(10), 1040–1049 (2016)CrossRefGoogle Scholar
  15. 15.
    Jaddi, N.S., Abdullah, S.: An interactive rough set attribute reduction using great deluge algorithm. In: Zaman, H.B., Robinson, P., Olivier, P., Shih, T.K., Velastin, S. (eds.) IVIC 2013. LNCS, vol. 8237, pp. 285–299. Springer, Cham (2013). Scholar
  16. 16.
    Jiang, L., Zhang, H.: Weightily averaged one-dependence estimators. In: Yang, Q., Webb, G. (eds.) PRICAI 2006. LNCS (LNAI), vol. 4099, pp. 970–974. Springer, Heidelberg (2006). Scholar
  17. 17.
    KDD-CUP-99 task description [EB/OL]. Accessed 29 June 2016
  18. 18.
    KDD cup 1999 data [EB/OL]. Accessed 29 June 2016
  19. 19.
    Singh, P., Garg, S., Kumar, V., et a1.: A testbed for SCADA cyber security and intrusion detection. In: Proceedings of International Conference on Cyber Security of Smart Cities, Industrial Control System and Communications (2015). 1.6Google Scholar

Copyright information

© Springer Nature Switzerland AG 2018

Authors and Affiliations

  1. 1.Nanjing University of Aeronautics and AstronauticsNanjingChina

Personalised recommendations