PCA based Anomaly Detection

Statistical Machine Learning methods are employed to improve network security (email spam filtering, intrusion detection, enterprise network fault diagnosis etc.) For intrusion detection, these methods model the “normal ” behaviour of network traffic. Deviations from the “normal ” behaviour is classified as an “intrusion” Vikram Ravindra (TUM) ANTIDOTE 23rd April 2013 3 / 30 Motivation contd... Such methods are suseptible to adversaries Adversaries can poison the training phase, thereby affecting the decision taken during the test phase Adversaries can affect systems which employ SVM, neural network, PCA etc. Vikram Ravindra (TUM) ANTIDOTE 23rd April 2013 4 / 30 Scope of this talk a PCA-based subspace method for detecting anomalies in backbone networks The effects of poisoning of such a method Poisoning strategies/scheme