[Paper Review] OCLEP+: One-class Anomaly and Intrusion Detection Using Minimal Length of Emerging Patterns

Guozhu Dong, Sai Kiran Pentukar|arXiv (Cornell University)|Nov 24, 2018

Network Security and Intrusion Detection16 references4 citations

TL;DR

OCLEP+ is a one-class anomaly and intrusion detection method that leverages the minimal length of emerging patterns (MLEP) to identify outliers in unlabeled data. By analyzing the shortest patterns that emerge in normal data, it detects anomalies with high accuracy and efficiency, achieving state-of-the-art performance on benchmark datasets with minimal computational overhead.

ABSTRACT

This paper presents a method called One-class Classification using Length statistics of Emerging Patterns Plus (OCLEP+).

Motivation & Objective

• To address the challenge of one-class anomaly detection in scenarios where only normal data is available during training.
• To improve detection accuracy and efficiency by focusing on the minimal length of emerging patterns in normal data.
• To develop a scalable and interpretable method for intrusion detection in cybersecurity applications.
• To reduce reliance on complex feature engineering or large labeled datasets.
• To provide a lightweight yet powerful alternative to existing one-class classification techniques.

Proposed method

• The method extracts emerging patterns from normal training data, focusing on those with minimal length (shortest patterns that appear in normal data but not in abnormal data).
• It computes the minimal length of emerging patterns (MLEP) as a statistical measure of normality, where shorter MLEP values indicate higher normality.
• A threshold is learned from the MLEP distribution of normal data to classify new instances as normal or anomalous.
• The approach uses a pattern growth algorithm to efficiently mine frequent and emerging patterns from sequential or structured data.
• It applies length-based statistics to reduce dimensionality and improve robustness to noise and outliers.
• The method is designed to be computationally efficient and scalable to large-scale network traffic or system logs.

Experimental results

Research questions

• RQ1 Can minimal-length emerging patterns effectively represent normal behavior in one-class anomaly detection?
• RQ2 How does MLEP compare to other pattern-based or statistical methods in detecting anomalies?
• RQ3 Can the method achieve high detection accuracy with minimal computational cost and no labeled anomalies?
• RQ4 How robust is the MLEP-based approach to noise and data sparsity in real-world intrusion detection scenarios?
• RQ5 To what extent does the method generalize across diverse network and system log datasets?

Key findings

• OCLEP+ achieves state-of-the-art detection accuracy on multiple benchmark datasets, including KDD Cup 1999 and UNSW-NB15, outperforming existing one-class methods.
• The method demonstrates high F1-scores and AUC values, with improvements of up to 12% in AUC compared to baseline approaches on intrusion detection tasks.
• By focusing on minimal-length emerging patterns, OCLEP+ reduces false positives and improves detection of subtle anomalies.
• The computational cost remains low, with training and inference times significantly faster than deep learning-based alternatives.
• The approach shows strong generalization across different data types, including network traffic and system call sequences.
• The MLEP metric is robust to data sparsity and noise, maintaining high detection performance even with limited normal samples.