Novel Geometric Area Analysis Technique for Anomaly Detection Using Trapezoidal Area Estimation on Large-Scale Networks

TLDR

Interconnected appliances and ubiquitous computing face serious threats from network attackers, and conventional IDSs suffer high false positive rates. The study proposes a novel Geometric Area Analysis (GAA) technique using Trapezoidal Area Estimation on Beta Mixture Model–derived parameters to detect anomalies. The GAA method constructs normal observation areas from a normal profile and compares them with testing set areas, incorporates a scalable framework with a decision engine, and evaluates performance on NSL‑KDD and UNSW‑NB15 datasets after reducing dimensionality with PCA. Empirical results show higher detection rate, lower false‑positive rate, and reduced processing time compared to competing methods.

Abstract

The prevalence of interconnected appliances and ubiquitous computing face serious threats from the hostile activities of network attackers. Conventional Intrusion Detection Systems (IDSs) are incapable of detecting these intrusive events as their outcomes reflect high false positive rates (FPRs). In this paper, we present a novel Geometric Area Analysis (GAA) technique based on Trapezoidal Area Estimation (TAE) for each observation computed from the parameters of the Beta Mixture Model (BMM) for features and the distances between observations. As this GAA-based detection depends on the methodology of anomaly-based detection (ADS), it constructs the areas of normal observations in a normal profile with those of the testing set estimated from the same parameters to recognise abnormal patterns. We also design a scalable framework for handling large-scale networks, and our GAA technique considers a decision engine module in this framework. The performance of our GAA technique is evaluated using the NSL-KDD and UNSW-NB15 datasets. To reduce the high-dimensional data of network connections, we apply the Principal Component Analysis (PCA) and evaluate its influence on the GAA technique. The empirical results show that our technique achieves a higher detection rate and lower FPR with a lower processing time than other competing methods.