Abstract
A method for botnet detection from traffic data of the Internet by the Non-negative Matrix Factorization (NMF) was proposed by (Yamauchi et al. 2012). This method assumes that traffic data is composed by several types of communications, and estimates the number of types in the data by the minimum description length (MDL) criterion. However, consideration on the MDL criterion was not sufficient and validity has not been guaranteed. In this paper, we refine the MDL criterion for NMF and report results of experiments for the new MDL criterion on synthetic and real data.
Keywords
Y. Kawamura—Moved to Nihon Unisys, Ltd. in April 2015.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsReferences
Cichocki, A., Zdunek, R., Phan, A.H., Amari, S.: Nonnegative Matrix and Tensor Factorizations. Wiley, Chichester (2009)
Dong, B., Lin, M.M., Chu, M.T.: Nonnegative rank factorization - a heuristic approach via rank reduction. Numer. Algorithms 65(2), 251–274 (2014)
Rissanen, J.: Modeling by shortest data description. Automatica 14, 465–471 (1978)
Rissanen, J.: Fisher information and stochastic complexity. IEEE Trans. Inf. Theor. 42(1), 40–47 (1996)
Kramer, L., et al.: AmpPot: monitoring and defending amplification DDoS attacks. In: Proceedings of RAID 2015 (2015)
Lee, D.D., Seung, H.S.: Algorithms for non-negative matrix factorization. Neural Inf. Process. Syst. 13, 556–562 (2001)
Yamauchi, S., Kawakita, M., Takeuchi, J.: Botnet detection based on non-negative matrix factorization and the MDL principle. In: Proceedings of the 19th International Conference on Neural Information Processing, Doha, Qatar, 12–15 November, pp. 400–409 (2012)
Acknowledgment
We thank everyone of Cybersecurity Laboratory, NICT, who provides the darknet data, and the members of Proactive Response Against Cyber-attacks Through International Collaborative Exchange (PRACTICE).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2016 Springer International Publishing AG
About this paper
Cite this paper
Tanaka, S., Kawamura, Y., Kawakita, M., Murata, N., Takeuchi, J. (2016). MDL Criterion for NMF with Application to Botnet Detection. In: Hirose, A., Ozawa, S., Doya, K., Ikeda, K., Lee, M., Liu, D. (eds) Neural Information Processing. ICONIP 2016. Lecture Notes in Computer Science(), vol 9947. Springer, Cham. https://doi.org/10.1007/978-3-319-46687-3_63
Download citation
DOI: https://doi.org/10.1007/978-3-319-46687-3_63
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-46686-6
Online ISBN: 978-3-319-46687-3
eBook Packages: Computer ScienceComputer Science (R0)