Enhancing IoT anomaly detection performance for federated learning

Federated Learning (FL) with mobile computing and the Internet of Things (IoT) is an effective cooperative learning approach. However, several technical challenges still need to be addressed. For instance, dividing the training process among several devices may impact the performance of Machine Learning (ML) algorithms, often significantly degrading prediction accuracy compared to centralized learning. One of the primary reasons for such performance degradation is that each device can access only a small fraction of data (that it generates), which limits the efficacy of the local ML model constructed on that device. The performance degradation could be exacerbated when the participating devices produce different classes of events, which is known as the class balance problem. Moreover, if the participating devices are of different types, each device may never observe the same types of events, which leads to the device heterogeneity problem. In this study, we investigate how data augmentation can be applied to address these challenges and improving detection performance in an anomaly detection task using IoT datasets. Our extensive experimental results with three publicly accessible IoT datasets show the performance improvement of up to 22.9% with the approach of data augmentation, compared to the baseline (without relying on data augmentation). In particular, stratified random sampling and uniform random sampling show the best improvement in detection performance with only a modest increase in computation time, whereas the data augmentation scheme using Generative Adversarial Networks is the most time-consuming with limited performance benefits.

Clustering-based label estimation for network anomaly detection

A substantial body of work has been done to identify network anomalies using supervised and unsupervised learning techniques with their unique strengths and weaknesses.In this work,we propose a new approach that takes advantage of both worlds of unsupervised and supervised learnings.The main objective of the proposed approach is to enable supervised anomaly detection without the provision of the associated labels by users.To this end,we estimate the labels of each connection in the training phase using clustering.The“estimated”labels are then utilized to establish a supervised learning model for the subsequent classification of connections in the testing stage.We set up a new property that defines anomalies in the context of network anomaly detection to improve the quality of estimated labels.Through our extensive experiments with a public dataset(NSL-KDD),we will prove that the proposed method can achieve performance comparable to one with the “original”labels provided in the dataset.We also introduce two heuristic functions that minimize the impact of the randomness of clustering to improve the overall quality of the estimated labels.

Factors affecting flocculation performance of synthetic polymer for turbidity control

A multilateral effort into managing nonpoint source pollution from agriculture has gotten much attention for many years. Particularly during the heavy rain season, run-off of turbid water from sloped farmlands, fallow ground and/or unmanaged uplands is deteriorated. Flocculant polymer, commonly used in wastewater treatment facilities, but now exploited to improve control of sediment turbidity by promoting flocculation of particles in construction site. This study used the flocculant polymer to control the discharge of agricultural nonpoint source pollution and focused on the understanding of how soil-water and polymer properties affect flocculation performance. Therefore, a series of flocculation experiments under different conditions was evaluated for better polymer clarification efficiency. Various factors such as flocculant dose, end-over-end inversion of a cylinder, and soil-water properties (pH, NaCl, organic matter) were studied. The effective flocculant dose that fulfilled fast settling rate was 10mg·L-1. Additional findings included that 1) increasing pH decreased the settling rate of soil particle;2) a positive relationship between the percentage of turbidity reduction and a level of salinity in Kaolin suspension was observed, and 3) organic matter in soil solution inhibited PAM adsorption onto soil particles, which caused the reduction of flocculation performance. The findings of this study revealed that flocculant polymer possess good results as a turbidity reducetion measure and couldfurther provide valuable information to make better decision on establishment of Best Management Practice for handling agricultural nonpoint source pollution.

Improving signature quality for network application identification

Network application identification is one of the core elements in network operations and management to provide enhanced network service and security. For accurate identification, an approach using common patterns called "signatures" is widely used to compensate the limitations of the traditional transport-layer port-based classification. However, our simulation results indicate that using the signatures generated from a set of well known algorithms may lead to very poor identification performance, with less than 60% of true positives even in an optimal case. To improve the quality of signatures, we present a technique in this paper, which consists of two steps:(i) pairwise merging to consider every possible combination of the initially collected signatures to reduce their specificity that causes the signatures to be less common;and (ii) signature reduction to identify effective signatures with greater importance from a large set of signatures produced in the merging step, so as to manage the space/time complexity in the identification process for greater scalability. Our experimental results show that the proposed technique can dramatically improve the performance, even with a small number of signatures (e.g., 95% true positives rate with 30 signatures per application) which is more compact than the initial signature set.

An L^(2)to L^(∞)Framework for the Landau Equation

Consider the Landau equation with Coulomb potential in a periodic box.We develop a new L^(2)to L^(∞)framework to construct global unique solutions near Maxwellian with small L^(∞)norm.The first step is to establish global L^(2)estimates with strong velocity weight and time decay,under the assumption of L^(∞)bound,which is further controlled by such L^(2)estimates via De Giorgi’s method(Golse et al.in Ann.Sc.Norm.Super.Pisa Cl.Sci.(5)19(1),253-295(2019),Imbert and Mouhot in arXiv:1505.04608(2015)).The second step is to employ estimates in S_(p)spaces to control velocity derivatives to ensure uniqueness,which is based on Hölder estimates via De Giorgi’s method(Golse et al.in Ann.Sc.Norm.Super.Pisa Cl.Sci.(5)19(1),253-295(2019),Golse and Vas-seur in arXiv:1506.01908(2015),Imbert and Mouhot in arXiv:1505.04608(2015)).

A New Approach to Multivariate Network Traffic Analysis

Network traffic analysis is one of the core functions in network monitoring for effective network operations and management.While online traffic analysis has been widely studied,it is still intensively challenging due to several reasons.One of the primary challenges is the heavy volume of traffic to analyze within a finite amount of time due to the increasing network bandwidth.Another important challenge for effective traffic analysis is to support multivariate functions of traffic variables to help administrators identify unexpected network events intuitively.To this end,we propose a new approach with the multivariate analysis that offers a high-level summary of the online network traffic.With this approach,the current state of the network will display patterns compiled from a set of traffic variables,and the detection problems in network monitoring(e.g.,change detection and anomaly detection)can be reduced to a pattern identification and classification problem.In this paper,we introduce our preliminary work with clustered patterns for online,multivariate network traffic analysis with the challenges and limitations we observed.We then present a grid-based model that is designed to overcome the limitations of the clustered pattern-based technique.We will discuss the potential of the new model with respect to the technical challenges including streaming-based computation and robustness to outliers.