Detekcija anomalija u podacima s ciljem otkrivanja sigurnosnih incidenata

master's thesis

• Title (english): Data anomaly detection for discovering cybersecurity incidents
• Author: Robert Travančić
• Mentor: Marin Vuković (mentor)
• Committee member: Marin Vuković (predsjednik povjerenstva)
• Committee member: Dragan Jevtić (član povjerenstva)
• Committee member: Miljenko Mikuc (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2024-02-27, Croatia

Abstract

Detekcija anomalija aktivno je područje istraživanja s rastućom važnošću u modernom
digitalnom dobu. Primjena detekcije anomalija proteže se kroz različite aspekte svijeta oko
nas od financijskih sustava, medicine pa sve do industrije.

U radu su istraženi različiti pristupi detekciji anomalija s opisanim prednostima i
nedostatcima. Implementiran je sustav za detekciju anomalija zasnovan na algoritmu
Isolation Forest. Performanse modela su uspoređene s modelima zasnovanim na
algoritmima Local Outlier Factor i One-class Support Vector Machine na različitim
skupovima podataka. Rad opisuje izazove koji proizlaze iz korištenja algoritma Isolation
Forest te je predloženo potencijalno rješenje u obliku hibridnog modela koji koristi
algoritme Autoenkoder i Isolation Forest.

Abstract (english)

Anomaly detection is an active area of research with growing importance in the modern
digital age. The application of anomaly detection extends across various aspects of the
world around us, from financial systems, medicine to various types of industries.

In this work, various approaches to anomaly detection are explored, with described
advantages and disadvantages. An anomaly detection system based on the Isolation Forest
algorithm has been implemented. The performance of the model was compared with
models based on the Local Outlier Factor and One-class Support Vector Machine
algorithms on different datasets. The work describes challenges arising from the use of the
Isolation Forest algorithm and proposes a potential solution in the form of a hybrid model
that uses Autoencoder and Isolation Forest algorithms.

• Keywords: Detekcija anomalija; statističke metode; strojno učenje; duboko učenje; hibridne metode; algoritam Isolation Forest; algoritam Autoenkoder; algoritam Local Outlier Factor; algoritam One-class Support Vector Machine; optimizacija hiperparametara; Tree-Structured Parzen Estimator; F1-score; pristup EDIFA; skupovi podataka za detekciju anomalija
• Keywords (english): Anomaly detection; statistical methods; machine learning; deep learning; hybrid methods; Isolation Forest algorithm; Autoencoder algorithm; Local Outlier Factor algorithm; One-class Support Vector Machine algorithm; hyperparameter optimization; Tree-Structured Parzen Estimator; F1-score; EDIFA hybrid model; Anomaly Detection Datasets
• Language: croatian
• URN:NBN: urn:nbn:hr:168:206797
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2024-03-28 07:56:09