An incremental anomaly detection model for virtual machines

Area of Science:

• Computer Science
• Artificial Intelligence
• Machine Learning

Background:

• Self-Organizing Map (SOM) is an unsupervised learning algorithm used for anomaly detection.
• Traditional SOM algorithms suffer from slow training times due to random initialization.
• Cloud platforms' dynamic nature and resource sharing lead to performance anomalies, challenging existing detection methods with low accuracy and scalability.

Purpose of the Study:

• To propose an Improved Incremental Self-Organizing Map (IISOM) model for effective anomaly detection in virtual machines on cloud platforms.
• To address the limitations of traditional SOM, including slow training and low accuracy in dynamic cloud environments.
• To enhance the scalability and detection speed of anomaly detection systems for large-scale cloud infrastructures.

Main Methods:

• Introduced a heuristic-based initialization algorithm to accelerate SOM training and enhance model quality.
• Incorporated a Weighted Euclidean Distance (WED) algorithm to improve the SOM's detection model.
• Developed a neighborhood-based searching algorithm to expedite detection time, considering cloud VM characteristics.

Main Results:

• The IISOM model demonstrated improved accuracy in detecting anomalies in virtual machines.
• Experiments showed a significant increase in convergence velocity compared to traditional methods.
• The proposed model effectively handles the large scale and high dynamic features of cloud platforms.

Conclusions:

• The IISOM model offers a more accurate and efficient solution for anomaly detection in cloud virtual machines.
• The heuristic initialization and WED contribute to faster training and better model quality.
• The neighborhood-based search effectively addresses the challenges of large-scale, dynamic cloud environments.