![](bg6.png)
in an increasing number of false positives (normal se-
quences that are erroneously detected as anomalies).
5 CONCLUSIONS AND
RESEARCH OUTLOOK
Our ATM fraud detection approach is based on the
assumption that a significant deviation from the nor-
mal behavior is a strong indicator of an attack. To the
best of our knowledge, we are the first who utilize the
data stream produced inside an ATM to automatically
generate a model of normal behavior, which is then
used to detect anomalies (or attacks respectively).
The formulation of this approach as a sequence-based
anomaly detection problem and the empirical evalu-
ation of three respective methods using a real-world
data set show its practical applicability.
This paper constitutes a proof of concept. Our
current research targets the further elaboration of the
problem formulation based on the lessons learned and
the investigation of tailored anomaly detection meth-
ods. In particular, this includes the following aspects:
• Incorporating the time intervals between subse-
quent events by representing the data stream as a
continuous sequence (or time series).
• Exploiting the information comprised in the mes-
sage payload by applying a multidimensional
event model (Budalakoti et al., 2006).
• Analyzing training and test sequences of different
length by combining the anomaly scores of sub-
sequences (Ghosh et al., 1999; Warrender et al.,
1999).
• Investigating unsupervised anomaly detection ap-
proaches, i.e., training and test sequences are not
differentiated (Leung and Leckie, 2005; Zhang
and Zulkernine, 2006).
Regarding the evaluation, we plan to investigate dif-
ferent strategies to derive anomaly examples, which
includes the generation of uniformly distributed out-
liers (Tax, 2001) as well as the explicit specification
of known attacks by domain experts.
ACKNOWLEDGEMENTS
This work was partly funded by the German Federal
Ministry of Education and Research (BMBF) within
the Leading-Edge Cluster “Intelligent Technical Sys-
tems OstWestfalenLippe” (it’s OWL).
REFERENCES
Aggarwal, C. (2013). Outlier Analysis. Springer.
Budalakoti, S., Srivastava, A., Akella, R., and Turkov, E.
(2006). Anomaly detection in large sets of high-
dimensional symbol sequences. Technical Report
TM-2006-214553, NASA Ames Research Center.
Cabrera, J., Lewis, L., and Mehra, R. (2001). Detection and
classification of intrusions and faults using sequences
of system calls. ACM SIGMOD Record, 30(4).
Chandola, V., Banerjee, A., and Kumar, V. (2012).
Anomaly detection for discrete sequences: A survey.
IEEE Transactions on Knowledge and Data Engineer-
ing, 24(5).
Chandola, V., Mithal, V., and Kumar, V. (2008). Compar-
ative evaluation of anomaly detection techniques for
sequence data. In Proceedings of the 8th IEEE Con-
ference on Data Mining (ICDM’08). IEEE.
Chapelle, O., Schölkopf, B., and Zien, A., editors (2006).
Semi-Supervised Learning. MIT Press.
Florez-Larrahondo, G., Bridges, S., and Vaughn, R. (2005).
Efficient modeling of discrete events for anomaly de-
tection using hidden Markov models. In Proceed-
ings of the 8th Conference on Information Security
(ISC’05). Springer.
Ghosh, A., Schwartzbard, A., and Schatz, M. (1999).
Learning program behavior profiles for intrusion de-
tection. In Proceedings of the USENIX Workshop on
Intrusion Detection and Network Monitoring (ID’99).
USENIX Association.
Hofmeyr, S., Forrest, S., and Somayaji, A. (1998). Intrusion
detection using sequences of system calls. Journal of
Computer Security, 6(3).
Juang, B. and Rabiner, L. (1990). The segmental K-means
algorithm for estimating parameters of hidden Markov
models. IEEE Transactions on Acoustics, Speech and
Signal Processing, 38(9).
Leung, K. and Leckie, C. (2005). Unsupervised anomaly
detection in network intrusion detection using clus-
ters. In Proceedings of the 28th Australasian Con-
ference on Computer Science (ACSC’05). Australian
Computer Society, Inc.
Rabiner, L. (1989). A tutorial on hidden Markov models
and selected applications in speech recognition. Pro-
ceedings of the IEEE, 77(2).
Tax, D. (2001). One-class Classification: Concept-learning
in the Absence of Counter-examples. Ph.d. thesis,
Delft University of Technology.
Warrender, C., Forrest, S., and Pearlmutter, B. (1999). De-
tecting intrusions using system calls: Alternative data
models. In Proceedings of the 1999 IEEE Symposium
on Security and Privacy (PS’99). IEEE.
Zhang, J. and Zulkernine, M. (2006). Anomaly based net-
work intrusion detection with unsupervised outlier de-
tection. In IEEE International Conference on Commu-
nications (ICC’06). IEEE.
Zhang, X., Fan, P., and Zhu, Z. (2003). A new anomaly de-
tection method based on hierarchical HMM. In Pro-
ceedings of the 4th Conference on Parallel and Dis-
tributed Computing, Applications and Technologies
(PDCAT’03). IEEE.
ICPRAM2014-InternationalConferenceonPatternRecognitionApplicationsandMethods
764