@inproceedings{HeineKleinerKlostermeyeretal.2022,
  author    = {Heine, Felix and Kleiner, Carsten and Klostermeyer, Philip and Ahlers, Volker and Laue, Tim and Wellermann, Nils},
  title     = {Detecting Attacks in Network Traffic Using Normality Models: The Cellwise Estimator},
  booktitle = {Foundations and Practice of Security : 14th International Symposium, FPS 2021, Paris, France, December 7-10, 2021, Revised Selected Papers},
  editor    = {A{\"i}meur, Esma and Laurent, Maryline and Yaich, Reda and Dupont, Beno{\^i}t and Garcia-Alfaro, Joaquin},
  isbn      = {978-3-031-08147-7},
  issn      = {1611-3349},
  doi       = {10.25968/opus-3462},
  institution = {Fakult{\"a}t IV - Wirtschaft und Informatik},
  pages     = {265 -- 282},
  year      = {2022},
  abstract  = {Although machine learning (ML) for intrusion detection is attracting research, its deployment in practice has proven difficult. Major hindrances are that training a classifier requires training data with attack samples, and that trained models are bound to a specific network. To overcome these problems, we propose two new methods for anomaly-based intrusion detection. Both are trained on normal-only data, making deployment much easier. The first approach is based on One-class SVMs, while the second leverages our novel Cellwise Estimator algorithm, which is based on multidimensional OLAP cubes. The latter has the additional benefit of explainable output, in contrast to many ML methods like neural networks. The created models capture the normal behavior of a network and are used to find anomalies that point to attacks. We present a thorough evaluation using benchmark data and a comparison to related approaches showing that our approach is competitive.},
  subject      = {Netzwerk},
  language  = {en}
}