Show simple item record

dc.contributor.advisorJacob, Paul
dc.contributor.advisorFallon, Sheila
dc.contributor.authorChawla, Ashima
dc.identifier.citationChawla, A. (2022). Interpretability and performance of deep neural network based anomaly detection in cyber security and telecommunications. Thesis (Doctor of Philosophy - PhD). Technological University of the Shannon: Midlands Midwest.en_US
dc.description.abstractThe rapid development of technology and proliferation of data have driven businesses to pursue anomaly detection research. The application of artificial neural networks (ANNs) in anomaly detection achieves the state-of-the-art, but the end user cannot easily interpret their output. Therefore, to leverage ANNs in the field of Anomaly Detection, it is important to interpret the neural network models. This thesis addresses the question of whether it is possible to design and develop high performance and interpretable anomaly detection solutions based on artificial neural networks. Anomaly detection is an important technique in Cyber Security as, compared to signature based methods, an anomaly detection based approach is capable of detecting previously unseen attacks. One approach to develop a Host Based Intrusion Detection System for Cyber Security is to examine sequences of traces of operating system calls. Two approaches to anomaly detection for sequential data are a prediction based approach and a reconstruction error based approach. A prediction based approach predicts the next element in a sequence based on the previously observed sequence. The work incorporates stacked Convolutional Neural Network (CNNs) with Gated Recurrent Units (GRUs) to analyse the operation system call sequences with an order of magnitude smaller training times. The reconstruction error based approach leverage bidirectional autoencoders to detect the anomalous system call se quences. This approach achieved better Area Under the Curve (AUC) when compared to the predictive approach. This approach to anomaly detection forms the basis for an interpretability framework. Anomaly Detection is also an important technique in telecommunications monitoring. The Cluster Characterized Autoencoder (CCA) Framework was designed, implemented, and evaluated to identify candidate anomalies and interpret the model predictions. This framework addresses the neural network interpretability to support network engineers to perform troubleshooting and aid in root cause analysis.en_US
dc.publisherTechnological University of the Shannon: Midlands Midwesten_US
dc.rightsAttribution-Non-Commercial-Share-Alike-3.0 United States*
dc.subjectAnomaly detectionen_US
dc.subjectSystem call tracesen_US
dc.titleInterpretability and performance of deep neural network based anomaly detection in cyber security and telecommunicationsen_US
dc.contributor.affiliationTechnological University of the Shannon: Midlands Midwesten_US
dc.subject.departmentDepartment of Computer & Software Engineering: TUS Midlandsen_US

Files in this item


This item appears in the following Collection(s)

Show simple item record

Attribution-Non-Commercial-Share-Alike-3.0 United States
Except where otherwise noted, this item's license is described as Attribution-Non-Commercial-Share-Alike-3.0 United States