Journal Editorial Board Editor-in-ChiefProf. Thomas Byeongnam YOON, PhD.
Founding Editor-in-Chief
ICACT Transactions on the Advanced Communications Technology (TACT) Editors
Prof. Jun-Chul Chun, Kyonggi University, Korea
Dr. JongWon Kim, GIST (Gwangju Institute of Science & Technology), Korea
Dr. Xi Chen, State Grid Corparation of China, China
Prof. Arash Dana, Islamic Azad university , Central Tehran Branch, Iran
Dr. Pasquale Pace, University of Calabria - DEIS - Italy, Italy
Dr. Mitch Haspel, Stochastikos Solutions R&D, Israel
Prof. Shintaro Uno, Aichi University of Technology, Japan
Dr. Tony Tsang, Hong Kong Polytechnic UNiversity, Hong Kong
Prof. Kwang-Hoon Kim, Kyonggi University, Korea
Prof. Rosilah Hassan, Universiti Kebangsaan Malaysia(UKM), Malaysia
Dr. Sung Moon Shin, ETRI, Korea
Dr. Takahiro Matsumoto, Yamaguchi University, Japan
Dr. Christian Esteve Rothenberg, CPqD - R&D Center for. Telecommunications, Brazil
Prof. Lakshmi Prasad Saikia, Assam down town University, India
Prof. Moo Wan Kim, Tokyo University of Information Sciences, Japan
Prof. Yong-Hee Jeon, Catholic Univ. of Daegu, Korea
Dr. E.A.Mary Anita, Prathyusha Institute of Technology and Management, India
Dr. Chun-Hsin Wang, Chung Hua University, Taiwan
Prof. Wilaiporn Lee, King Mongkut’s University of Technology North, Thailand
Dr. Zhi-Qiang Yao, XiangTan University, China
Prof. Bin Shen, Chongqing Univ. of Posts and Telecommunications (CQUPT), China
Prof. Vishal Bharti, Dronacharya College of Engineering, India
Dr. Marsono, Muhammad Nadzir , Universiti Teknologi Malaysia, Malaysia
Mr. Muhammad Yasir Malik, Samsung Electronics, Korea
Prof. Yeonseung Ryu, Myongji University, Korea
Dr. Kyuchang Kang, ETRI, Korea
Prof. Plamena Zlateva, BAS(Bulgarian Academy of Sciences), Bulgaria
Dr. Pasi Ojala, University of Oulu, Finland
Prof. CheonShik Kim, Sejong University, Korea
Dr. Anna bruno, University of Salento, Italy
Prof. Jesuk Ko, Gwangju University, Korea
Dr. Saba Mahmood, Air University Islamabad Pakistan, Pakistan
Prof. Zhiming Cai, Macao University of Science and Technology, Macau
Prof. Man Soo Han, Mokpo National Univ., Korea
Mr. Jose Gutierrez, Aalborg University, Denmark

Copyright ⓒ 2018 GiRI (Global IT Research Institute)Dr. Youssef SAID, Tunisie Telecom, Tunisia
Dr. Noor Zaman, King Faisal University, Al Ahsa Hofuf, Saudi Arabia
Dr. Srinivas Mantha, SASTRA University, Thanjavur, India
Dr. Shahriar Mohammadi, KNTU University, IranProf. Beonsku An, Hongik University, korea
Dr. Guanbo Zheng, University of Houston, USA
Prof. Sangho Choe, The Catholic University of Korea, korea
Dr. Gyanendra Prasad Joshi, Yeungnam University, korea
Dr. Tae-Gyu Lee, Korea Institue of Industrial Technology(KITECH), korea
Prof. Ilkyeun Ra, University of Colorado Denver, USA
Dr. Yong Sun, Beijing University of Posts and Telecommunications, China
Dr. Yulei Wu, Chinese Academy of Sciences, China
Mr. Anup Thapa, Chosun University, korea
Dr. Vo Nguyen Quoc Bao, Posts and Telecommunications Institute of Technology, Vietnam
Dr. Harish Kumar, Bhagwant institute of technology, India
Dr. Jin REN, North china university of technology, China
Dr. Joseph Kandath, Electronics & Commn Engg, India
Dr. Mohamed M. A. Moustafa, Arab Information Union (AIU), Egypt
Dr. Mostafa Zaman Chowdhury, Kookmin University, Korea
Prof. Francis C.M. Lau, Hong Kong Polytechnic University, Hong Kong
Prof. Ju Bin Song, Kyung Hee University, korea
Prof. KyungHi Chang, Inha University, Korea
Prof. Sherif Welsen Shaker, Kuang-Chi Institute of Advanced Technology, China
Prof. Seung-Hoon Hwang, Dongguk University, Korea
Prof. Dal-Hwan Yoon, Semyung University, korea
Prof. Chongyang ZHANG, Shanghai Jiao Tong University, China
Dr. H K Lau, The Open University of Hong Kong, Honh Kong
Prof. Ying-Ren Chien, Department of Electrical Engineering, National Ilan University, Taiwan
Prof. Mai Yi-Ting, Hsiuping University of Science and Technology, Taiwan
Dr. Sang-Hwan Ryu, Korea Railroad Research Institute, Korea
Dr. Yung-Chien Shih, MediaTek Inc., Taiwan
Dr. Kuan Hoong Poo, Multimedia University, Malaysia
Dr. Michael Leung, CEng MIET SMIEEE, Hong Kong
Dr. Abu sahman Bin mohd Supa'at, Universiti Teknologi Malaysia, Malaysia
Prof. Amit Kumar Garg, Deenbandhu Chhotu Ram University of Science & Technology, India
Dr. Jens Myrup Pedersen, Aalborg University, Denmark
Dr. Augustine Ikechi Ukaegbu, KAIST, Korea
Dr. Jamshid Sangirov, KAIST, Korea
Prof. Ahmed Dooguy KORA, Ecole Sup. Multinationale des Telecommunications, Senegal
Dr. Se-Jin Oh, Korea Astronomy & Space Science Institute, Korea
Dr. Rajendra Prasad Mahajan, RGPV Bhopal, India
Dr. Woo-Jin Byun, ETRI, Korea
Dr. Mohammed M. Kadhum, School of Computing, Goodwin Hall, Queen's University , Canada
Prof. Seong Gon Choi, Chungbuk National University, Korea
Prof. Yao-Chung Chang, National Taitung University, Taiwan
Dr. Abdallah Handoura, Engineering school of Gabes - Tunisia, Tunisia
Dr. Gopal Chandra Manna, BSNL, India

Copyright ⓒ 2018 GiRI (Global IT Research Institute)Dr. Il Kwon Cho, National Information Society Agency, Korea
Prof. Jiann-Liang Chen, National Taiwan University of Science and Technology, Taiwan
Prof. Ruay-Shiung Chang, National Dong Hwa University, Taiwan
Dr. Vasaka Visoottiviseth, Mahidol University, Thailand
Prof. Dae-Ki Kang, Dongseo University, Korea
Dr. Yong-Sik Choi, Research Institute, IDLE co., ltd, Korea
Dr. Xuena Peng, Northeastern University, China
Dr. Ming-Shen Jian, National Formosa University, Taiwan
Dr. Soobin Lee, KAIST Institute for IT Convergence, Korea
Prof. Yongpan Liu, Tsinghua University, China
Prof. Chih-Lin HU, National Central University, Taiwan
Prof. Chen-Shie Ho, Oriental Institute of Technology, Taiwan
Dr. Hyoung-Jun Kim, ETRI, Korea
Prof. Bernard Cousin, IRISA/Universite de Rennes 1, France
Prof. Eun-young Lee, Dongduk Woman s University, Korea
Dr. Porkumaran K, NGP institute of technology India, India
Dr. Feng CHENG, Hasso Plattner Institute at University of Potsdam, Germany
Prof. El-Sayed M. El-Alfy, King Fahd University of Petroleum and Minerals, Saudi Arabia
Prof. Lin You, Hangzhou Dianzi Univ, China
Mr. Nicolai Kuntze, Fraunhofer Institute for Secure Information Technology, Germany
Dr. Min-Hong Yun, ETRI, Korea
Dr. Seong Joon Lee, Korea Electrotechnology Research Institute, korea
Dr. Kwihoon Kim, ETRI, Korea
Dr. Jin Woo HONG, Electronics and Telecommunications Research Inst., Korea
Dr. Heeseok Choi, KISTI(Korea Institute of Science and Technology Information), korea
Dr. Somkiat Kitjongthawonkul, Australian Catholic University, St Patrick's Campus, Australia
Dr. Dae Won Kim, ETRI, Korea
Dr. Ho-Jin CHOI, KAIST(Univ), Korea
Dr. Su-Cheng HAW, Multimedia University, Faculty of Information Technology, Malaysia
Dr. Myoung-Jin Kim, Soongsil University, Korea
Dr. Gyu Myoung Lee, Institut Mines-Telecom, Telecom SudParis, France
Dr. Dongkyun Kim, KISTI(Korea Institute of Science and Technology Information), Korea
Prof. Yoonhee Kim, Sookmyung Women s University, Korea
Prof. Li-Der Chou, National Central University, Taiwan
Prof. Young Woong Ko, Hallym University, Korea
Prof. Dimiter G. Velev, UNWE(University of National and World Economy), Bulgaria
Dr. Tadasuke Minagawa, Meiji University, Japan
Prof. Jun-Kyun Choi, KAIST (Univ.), Korea
Dr. Brownson ObaridoaObele, Hyundai Mobis Multimedia R&D Lab , Korea
Prof. Anisha Lal, VIT university, India
Dr. kyeong kang, University of technology sydney, faculty of engineering and IT , Australia
Prof. Chwen-Yea Lin, Tatung Institute of Commerce and Technology, Taiwan
Dr. Ting Peng, Chang'an University, China
Prof. ChaeSoo Kim, Donga University in Korea, Korea
Prof. kirankumar M. joshi, m.s.uni.of baroda, India
Dr. Chin-Feng Lin, National Taiwan Ocean University, Taiwan
Dr. Chang-shin Chung, TTA(Telecommunications Technology Association), Korea

Copyright ⓒ 2018 GiRI (Global IT Research Institute)Dr. Che-Sheng Chiu, Chunghwa Telecom Laboratories, Taiwan
Dr. Chirawat Kotchasarn, RMUTT, Thailand
Dr. Fateme Khalili, K.N.Toosi. University of Technology, IranDr. Izzeldin Ibrahim Mohamed Abdelaziz, Universiti Teknologi Malaysia , Malaysia
Dr. Kamrul Hasan Talukder, Khulna University, Bangladesh
Prof. HwaSung Kim, Kwangwoon University, Korea
Prof. Jongsub Moon, CIST, Korea University, Korea
Prof. Juinn-Horng Deng, Yuan Ze University, Taiwan
Dr. Yen-Wen Lin, National Taichung University, Taiwan
Prof. Junhui Zhao, Beijing Jiaotong University, China
Dr. JaeGwan Kim, SamsungThales co, Korea
Prof. Davar PISHVA, Ph.D., Asia Pacific University, Japan
Ms. Hela Mliki, National School of Engineers of Sfax, Tunisia
Prof. Amirmansour Nabavinejad, Ph.D., Sepahan Institute of Higher Education, Iran

Copyright ⓒ 2018 GiRI (Global IT Research Institute)

Editor Guide
 Introduction for Editor or Reviewer
All the editor group members are to be assigned as a evaluator(editor or reviewer) to submitted journal
papers at the discretion of the Editor-in-Chief. It will be informed by eMail with a Member Login ID and
Password.
Once logined the Website via the Member Login menu in left as a evaluator, you can find out the paper
assigned to you. You can evaluate it there. All the results of the evaluation are supposed to be shown in
the Author Homepage in the real time manner. You can also enter the Author Homepage assigned to
you by the Paper ID and the author's eMail address shown in your Evaluation Webpage. In the Author
Homepage, you can communicate each other efficiently under the peer review policy. Please don't missit!
All the editor group members are supposed to be candidates of a part of the editorial board, dependingon their contribution which comes from history of ICACT TACT as an active evaluator. Because the main
contribution comes from sincere paper reviewing role.

 Role of the Editor
The editor's primary responsibilities are to conduct the peer review process, and check the final cameraready manuscripts for any technical, grammatical or typographical errors.
As a member of the editorial board of the publication, the editor is responsible for ensuring that the
publication maintains the highest quality while adhering to the publication policies and procedures of
the ICACT TACT(Transactions on the Advanced Communications Technology).
For each paper that the editor-in-chief gets assigned, the Secretariat of ICACT Journal will send theeditor an eMail requesting the review process of the paper.
The editor is responsible to make a decision on an "accept", "reject", or "revision" to the Editor-in-Chief
via the Evaluation Webpage that can be shown in the Author Homepage also.

 Deadlines for Regular Review
Editor-in-Chief will assign a evalaution group( a Editor and 2 reviewers) in a week upon receiving acompleted Journal paper submission. Evaluators are given 2 weeks to review the paper. Editors are
given a week to submit a recommendation to the Editor-in-Chief via the evaluation Webpage, once all or
enough of the reviews have come in. In revision case, authors have a maximum of a month to submit
their revised manuscripts. The deadlines for the regular review process are as follows:

Copyright ⓒ 2018 GiRI (Global IT Research Institute)Evalution Procedure

Deadline

Selection of Evaluation Group
Review processing
Editor's recommendation
Final Decision Noticing

1 week2 weeks
1 week
1 week Making Decisions on Manuscript
Editor will make a decision on the disposition of the manuscript, based on remarks of the reviewers. The
editor's recommendation must be well justified and explained in detail. In cases where the revision isrequested, these should be clearly indicated and explained. The editor must then promptly convey thisdecision to the author. The author may contact the editor if instructions regarding amendments to themanuscript are unclear. All these actions could be done via the evaluation system in this Website. The
guidelines of decisions for publication are as follows:

Decision

Description

AcceptAn accept decision means that an editor is accepting the paper withno further modifications. The paper will not be seen again by theeditor or by the reviewers.
The manuscript is not suitable for the ICACT TACT publication.
The paper is conditionally accepted with some requirements. A
revision means that the paper should go back to the original
reviewers for a second round of reviews. We strongly discourage
editors from making a decision based on their own review of themanuscript if a revision had been previously required.

RejectRevision Role of the Reviewer
Reviewer Webpage:
Once logined the Member Login menu in left, you can find out papers assigned to you. You can alsologin the Author Homepage assigned to you with the paper ID and author's eMail address. In there you
can communicate each other via a Communication Channel Box.

Quick Review Required:
You are given 2 weeks for the first round of review and 1 week for the second round of review. You must
agree that time is so important for the rapidly changing IT technologies and applications trend. Pleaserespect the deadline. Authors undoubtedly appreciate your quick review.

Copyright ⓒ 2018 GiRI (Global IT Research Institute)Anonymity:
Do not identify yourself or your organization within the review text.

Review:
Reviewer will perform the paper review based on the main criteria provided below. Please provide
detailed public comments for each criterion, also available to the author.
 How this manuscript advances this field of research and/or contributes something new to theliterature?
 Relevance of this manuscript to the readers of TACT?
 Is the manuscript technically sound?
 Is the paper clearly written and well organized?
 Are all figures and tables appropriately provided and are their resolution good quality?
 Does the introduction state the objectives of the manuscript encouraging the reader to read on?
 Are the references relevant and complete?

Supply missing references:
Please supply any information that you think will be useful to the author in revision for enhancing
quality of the paperor for convincing him/her of the mistakes.

Review Comments:
If you find any already known results related to the manuscript, please give references to earlier papers
which contain these or similar results. If the reasoning is incorrect or ambiguous, please indicate
specifically where and why. If you would like to suggest that the paper be rewritten, give specificsuggestions regarding which parts of the paper should be deleted, added or modified, and pleaseindicate how.

Copyright ⓒ 2018 GiRI (Global IT Research Institute)Journal Procedure
Dear Author,

 You can see all your paper information & progress.
 Step 1. Journal Full Paper Submission
Using the Submit button, submit your journal paper through ICACT Website, then you will get newpaper ID of your journal, and send your journal Paper ID to the Secretariat@icact.org for the review andeditorial processing. Once you got your Journal paper ID, never submit again! Journal Paper/CRF
Template Step 2. Full Paper Review
Using the evaluation system in the ICACT Website, the editor, reviewer and author can communicate
each other for the good quality publication. It may take about 1 month.

 Step 3. Acceptance Notification
It officially informs acceptance, revision, or reject of submitted full paper after the full paper review
process.

Status
Acceptance
Revision
RejectActionGo to next Step.
Re-submit Full Paper within 1 month after Revision Notification.
Drop everything.

 Step 4. Payment Registration
So far it's free of charge in case of the journal promotion paper from the registered ICACT conference
paper! But you have to regist it, because you need your Journal Paper Registration ID for submission of
the final CRF manuscripts in the next step's process. Once you get your Registration ID, send it to
Secretariat@icact.org for further process.

 Step 5. Camera Ready Form (CRF) Manuscripts Submission
After you have received the confirmation notice from secretariat of ICACT, and then you are allowed tosubmit the final CRF manuscripts in PDF file form, the full paper and the Copyright Transfer Agreement.
Journal Paper Template, Copyright Form Template, BioAbstract Template,

Copyright ⓒ 2018 GiRI (Global IT Research Institute)Journal Submission Guide
All the Out-Standing ICACT conference papers have been invited to this "ICACT Transactions on the
Advanced Communications Technology" Journal, and also welcome all the authors whose conference
paper has been accepted by the ICACT Technical Program Committee, if you could extend new contents
at least 30% more than pure content of your conference paper. Journal paper must be followed toensure full compliance with the IEEE Journal Template Form attached on this page.

 How to submit your Journal paper and check the progress?
Step 1. Submit Using the Submit button, submit your journal paper through ICACT

Step 2. Confirm

Step 3. Review

Website, then you will get new paper ID of your journal, and send yourjournal Paper ID to the Secretariat@icact.org for the review and editorial
processing. Once you got your Journal paper ID, never submit again! Using
the Update button, you can change any information of journal paper
related or upload new full journal paper.
Secretariat is supposed to confirm all the necessary conditions of yourjournal paper to make it ready to review. In case of promotion from theconference paper to Journal paper, send us all the .DOC(or Latex) files ofyour ICACT conference paper and journal paper to evaluate the differenceof the pure contents in between at least 30% more to avoid the self
replication violation under scrutiny. The pure content does not include any
reference list, acknowledgement, Appendix and author biography
information.
Upon completing the confirmation, it gets started the review process thru
the Editor & Reviewer Guideline. Whenever you visit the Author
Homepage, you can check the progress status of your paper there fromstart to end like this, " Confirm OK! -> Gets started the review process > ...", in the Review Status column. Please don't miss it!

Copyright ⓒ 2018 GiRI (Global IT Research Institute)Volume. 7 Issue. 5

6J

1 Detecting Anomalous Network Traffic in IoT Networks

1143

Dang Hai Hoang*, Ha Duong Nguyen***Posts and Telecommunication Institute of Technology, Hanoi, Vietnam**Faculty of Information Technology, National University of Civil Engineering, Hanoi, Vietnam

2 SEFL: Selective Ensemble Fuzzy Learner for Cognitive Detection of Bio-Modality Spoofing in MCPS

1153

Nishat I Mowla*, Inshil Doh**, Kijoon Chae**Department of Computer Science and Engineering, Ewha Womans University, 52, Ewhayeodaegil, Seodaemungu,
Seoul, Korea**Department of Cyber Security,Ewha Womans University, 52, Ewhayeodaegil, Seodaemungu, Seoul, Korea

Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 2018

1143

Detecting Anomalous Network Traffic in IoTNetworks
Dang Hai Hoang*, Ha Duong Nguyen***Posts and Telecommunication Institute of Technology, Hanoi, Vietnam**Faculty of Information Technology, National University of Civil Engineering, Hanoi, Vietnam
hdhai.hn@gmail.com, nghaduong@gmai.com
Abstract—Network operators need effective tools to quickly
detect anomalies in traffic data for identifying network attacks.
In contrast to traditional Internet, detection of anomalous
network traffic in IoT (Internet of Things) networks is
becoming a challenge task due to limited network resources andperformance. Comprehensive detection methods are no longer
effective for IoT networks, calling for developing lightweightsolutions. Principal Component Analysis (PCA) techniques canhelp to reduce computing complexity, thus, anomaly detection
techniques based on PCA received a lot of attention in the past.
However, PCA techniques could not be directly applied to IoT
networks with constrained resources and limited performance.
This paper investigates PCA techniques for detecting
anomalous network traffic in IoT networks. We propose a novel
detection scheme with two levels using PCA techniques. The
first level is for quick detection with few principal components
while the second level is for detailed detection with a number ofprincipal components. We investigate the selection ofparameters in a distance calculation formula using several
experiments to show the feasibility of our proposed scheme.
Keyword— IoT Network Traffic Anomaly, Anomaly
Detection, Principal Component Analysis, Information
Security, Network Security

I. INTRODUCTIONT

HE world of interconnected things - the Internet ofThings (IoT) opens a number of challenges regarding
security. IoT can bring huge interested services nowadays,
but there is still a lack of suitable security measures for mixed
IoT environment [1]. IoT devices have constrained resources
and limited performance and are attractive to the attackers[2,3]. Cyber attacks in IoT networks are becoming moredifficult to detect. Traditional mechanisms are usuallycomprehensive and no longer effective for IoT networks,
calling for developing new paradigm. Given the growing
complexity of connected things and many constraints of IoT
environment, there is a strong demand for developing new
effective security solutions.
Network traffic anomaly detection (NTAD) is a promised
approach for identifying network attacks since it can detect
new attacks without pre-recorded signature. That’s why———————————————————————
Manuscript received on December 17th, 2017. This work is follow-up of
the invited journal to an accepted paper of the 20th International Conference
on Advance Communication Technology (ICACT2018). The work is
supported by the ASEAN IVO Project “A Hybrid Security Framework for
IoT Networks”.
Dang Hai Hoang is with the Posts and Telecommunication Institute ofTechnology, Hanoi, Vietnam (Corresponding author to provide phone:+84-4- 3854-4451; fax: +84-4-3756-2036; e-mail: haihd@ptit.edu.vn).
Ha Duong Nguyen is with the National University of Civil Engineering,
Hanoi, Vietnam (e-mail: nghaduong@gmail.com).

NTAD received a lot of attention in recent years [4,5]. The
definition of anomaly was formally given by Hawkins as “anobservation which deviates so much from other observations
as to arouse uncertainties that it was produced by analternative mechanism” [4]. Network anomalies are unusual
patterns in traffic data that do not conform to expected
normal behaviour. Anomalies may be performance related(due to network failures, changes in link traffic, flash crowd,
etc...) or security related (due to attacks such as denial ofservice attacks, network scans, etc…). NTAD is a very
critical task of network operators. Effective tools arenecessary for quick detection of exceptional non-conforming
patterns in traffic data in order to identify abnormal traffic
flows or the causes of anomalies for further handling.
Many anomaly detection techniques have been proposed in
the past within diverse research areas and application
domains, see e.g. [4-11]. Traditional techniques consideredanomalies as outlier and typically proposed to use statisticalproperties of observed data to construct a normal profile
based on normal traffic data. The current collected data will
be compared to this profile for checking any deviation to
detect anomalies [5-8, 11]. General speaking, the mainprinciple of NTAD is to build the baseline (the normal
region) using features of network traffic in normal condition
and to compare online collected traffic data to this baseline tofind out deviation (anomalies). However, this process isdifficult in practice due to many factors such as: multivariate
features of traffic data, correlation of various data features,complex dataset, required accuracy and detection speed, etc.
On the other hand, NTAD for IoT networks is facing otherissues such as: heterogeneity, constrained resources andlimited performance of IoT devices. In IoT networks, we can
not use complex methods as in traditional Internet.
Lightweight techniques with less complexity, low resource
usage and lower computation requirement are necessary. The
development of such techniques remains a challenging
research task.
Among broad existing anomaly detection techniques[4-11] for the Internet, multivariate statistical approaches foranomaly detection received a lot of attention. Principal
Component Analysis (PCA) is one of the best-known
multivariate statistical analysis techniques for detecting
anomalies in the context of constrained network resources
like IoT networks. PCA is a dimension reduction technique,which transforms a set of correlated original variables into a
set of few uncorrelated variables, called Principal
Components (PC). These PCs are linear combinations of theoriginal variables. The number of PCs is less than or equal to

Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 2018

the number of original variables. Thus, PCA allows lower
complexity. PCA is considered as a simple but effective
method for NTAD [5, 9-19].
Using PCA for NTAD is an attractive approach presented
in pioneer research works by Shyu et al. [12], Lakhina et al.
[13], Brauchkoff et al. [14], Ringberg et al. [15] and Kwitt etal. [19]. A variety number of further works has been proposed
based on PCA with several enhancements such as [9-11,
16-29]. However, several issues in applying PCA have still
not been considered as described in [4, 5, 7, 10, 16] including
sensitivity, effectiveness, dimension-depending computation
complexity, feature selection. Two main issues for the
goodness of PCA based anomaly detection are: how many
PCs are to select and how to calculate the distance (thedeviation measure).
The issue of selecting PCs has been investigated in several
works including the selection of major PCs and minor PCs[11, 12, 18, 20, 23], the selection of PC subspace [14-18,
28-30]. However, heuristic is the common way of choosing
PCs. It is not clear, how many PCs and which PCs are toselect. On the other hand, the choice of distance formula is
not clear in most of the research works. Distance is aquantitative metric for deviation of traffic pattern. Most of
the proposed methods are using either T2 distribution formula[4-6, 10-13], or Euclidean distance [7, 11, 23, 26], or
Mahalanobis distance [7, 10-18, 20-22, 24-29]. It is not clear
how the choice of the distance formula will affect thedetection accuracy and the computation complexity. On theother hand, the high complexity of such formulas is notsuitable for a quick online detection of traffic anomalies.
Such problems will have impact on further development
network traffic anomaly detection based on PCA.
This paper addresses the problems for detection of
network traffic anomaly in the context of IoT networks withresource constraints. We investigate PCA techniques using a
new general formula for deviation (distance) calculation. We
show that distance formulas used in previous typical researchworks can be derived from our general formula. To our best
knowledge, the proposed formula is the first one forinterpreting the parameters in different distance formulas.
Based on selecting PCs using this general formula, we
propose a novel detection scheme with two levels using PCA
techniques. The first level is for quick detection with few k
principal components in order to reduce the complexity toO(k) while retaining acceptable detection results incomparison to previous methods. The second level is fordetailed detection with a number of principal components.
The rest of this paper is organized as follows. Section II
presents the basic PCA techniques and related works. conceptof PCA and anomaly detection. Section III describes related
works. Section IV proposes a new distance formula and our
PCA scheme. Section V presents the experiments. Section VI
concludes the paper.
II. PCA TECHNIQUES AND RELATED WORKS
A. The Basic Concept of PCA
Anomaly detection often requires a high dimension data
including many features (attributes) collected from networks.
Therefore, the analysis has high computation complexity,
needs much time, and is not suitable for quick detection

1144

requirement. PCA is the most common technique to reducehigh dimension of data [4-8]. It converts the original data into
new set of axes called principal components (PC) by keeping
the most essential features of the original data.
Let X be the original observed dataset with n rows and p
columns {X1, X2, …, Xp}. The dataset is a n x p matrix, eachcolumn represents an attribute (feature) of data. Each column
is represented by a p-dimensional vector of p correlated
variables. Let R be a pxp sample correlation matrix of {X1, X2,…, Xp}. Let (1, e1), (2, e2), (3, e3),… (p, ep) be p
eigenvalue and eigenvector pairs of the matrix R. PCA
converts X into a new dataset Y using transformation matrix
R as follows:
Y = R.X(1)
We have the ith PC as follows:,(2)
where i = 1, 2, …, pis the ith eigenvector.

x is the observationis the sample mean of x.
The eigenvalues () are the roots of equation| R -  I | = 0.
Each eigenvalue has a corresponding non-zero eigenvector
e, which satisfies: Re =  e
Let z=(z1,z2,… zp)’ be the vector of standardized
observations, i.e. z = x - , we rewrite (2) as:(3)
PCA has the following important properties. The PCs areuncorrelated. The first PC has the highest variance; thesecond PC has the next highest variance, and so on. The total
variance in all PCs combined is equal to the total variance ofthe original variables X1, X2, …, Xp. The PCs are sorted indescending order of the eigenvalues, 1 ≥ 2 ≥ 3 ≥ … ≥ p >0. The quotient
describes the contribution of thethi PC on the variance of the data. The dataset X istransformed to PCA based on eigenvectors with the target
that the produced PCs have the highest possible variances.
B. Anomaly Detection Using PCA
The common principle for anomaly detection using PCA is
to calculate the statistical distance from each observed data to
the normal dataset (i.e. to the centroid or statistical average ofthe dataset). The distance calculation is performed in theprincipal component space. Mathematically, distance is aquantitative degree of how far two data instances apart fromeach other. Observed data instances which are at far distancefrom the new axes represented by PCs are considered asabnormal behaviour. For the comparison, a threshold value isestablished. If the calculated distance of the observed data islarger than the threshold, this data instance is considered as
an anomaly. The threshold value is usually determined by thestatistical distribution function of the distance [4-6, 30].
The most popular distance formulas used in previous
anomaly detection methods are the Euclidean distance, theMahalanobis distance or the statistic T 2 distribution formula.
We use the following notations in the formulas.
Let x = (x1, x2, …, xp) and µ = (µ1, µ2, …, µp) be theobserved data, where p is the number of original attributes,
and is the number of input variables.
Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 2018

Let d(x, µ) is the distance between two points x and µ in
the PCA space.
Let dN is the threshold, which is calculated using thenormal data profile as presented in [5-8,11].
1) The Euclidean DistanceIntuitively, the most common distance function is the
Euclidean distance. The Euclidean distance between x and µ
is [7, 11]:(4)
If µ is the vector of mean values of each input variable, theEuclidean distance in PCA space is given by:(5)
The data instance x can be determined as anomalous if
In order to reduce the square root computation complexity,
the square distance is also usually used:(6)
The Euclidean distance formula is simple, but does nottake into account the variance of each variable.
2) The Mahalanobis Distance
The Mahalanobis distance between x and µ is computed as[7, 10-12, 14-18, 20-22, 25-29]:(7)
Where S is the covariance matrix, S-1 is the transposition of
the sample covariance matrix between x and µ. The
covariance matrix is used as weights to reduce the different
variance between the variables. Thus, the covariance matrix
represents the relationship between variables more efficient.
In PCA space, the Mahalanobis distance is computed as:

The data instance x can be determined as anomalous if
The square distance is usually used as

The Mahalanobis distance formula takes into account not
only the average value but also the variance and covarianceof the variables. Instead of simply computing the distancefrom the mean value, it weights each variable by its standard
deviation and covariance [25].
3) Hotelling’s T2 Statistic
Another way to calculate the distance is using statistical
distribution, typically the Hotelling’s T 2 statistic [10-13,30].
This statistic gives the deviation (distance) from each vector
x to the centroid µ of the statistical distribution of the data.
(10)
Where S-1 is the transposition of the sample covariancematrix between x and the sample mean of x.
In PCA space, the statistic T2 distribution is computed as:
In comparison to (9), the statistic T2 is similar to theMahalanobis distance.
T2 is distributed as, where Fp,n-p denotes arandom variable with an F-distribution with p and n-p

1145

degrees of freedom. A large value of T 2 indicates a deviationof the observation x from the centroid of the normal dataset
and the F-statistic can be used to test for an anomaly [12, 30].
C. Related Works on NTAD using PCA
The research works on NTAD using PCA were initiated by
Shyu et al. [12] and Lakhina et al. [13]. In [12], the authors
proposed a principal component classifier (PCC) consistingof two functions of PC scores, one for major components(Major PCs) and one for minor components (Minor PCs).
The major PCs are used to detect extreme observations withlarge values on some original variables. The minor PCs areused to detect observations that do not conform to the normal
correlation structure. The Mahalanobis distance is used with
two thresholds, one for major PCs and another for minor PCs.
The detection rate is depending on the quality and theaccuracy of PCC. Thus, some other authors [20, 21] proposed
to improve PCC with multivariate trimming for robustness,threshold calculation.
Lakhina et al. [12] proposed to divide the network traffic
data into normal subspace consisting of typical behaviour
pattern and anomalous subspace accounting foruncharacteristic circumstances by mean of PCA. The
Euclidean distance is employed to check the dissimilarity
between data instances. Anomaly detection is using the first
PCs and the mean value of the distance. However, there areseveral remaining issues to be solved such as the choice ofPCs, the separation of normal and anomalous subspaces.
Further improving approaches were indicated in [17, 26] withthe concept of traffic matrix including a number of original/
destination flows (OD flows). The authors proposed to
extract a list of few PCs, which contain the maximum
variance of the original data. The authors in [16] proposed acontrol approach for pre-processing the network data to beanalysed with PCA. The authors in [18] proposed todecompose the traffic variations into normal and anomalous
components. A new method for identifying the anomalous
flows inside the aggregated flows was introduced.
The works of Shyu et al [11] and Lakhina et al. [12]received a lot of attention in the research community. The
authors in [14] presented the issue of temporal correlation inprevious works of Shyu and Lakhina, and proposed a
predictive filter for classical PCA in order to improvecorrelation effect. Ringberg et al. [15] indicated that PCA
techniques are very sensitive for traffic anomaly detection,
especially for the selected parameters. The authors showedthat current methods for tuning PCA parameters are
inadequate and presented several challenges of using PCA.
However, they concluded that PCA is a promising statisticalanalysis technique that can be used effectively for detecting
network anomalies.
In recent years, a variety number of research works has
been developed based on the application of PCA for
anomalous traffic detection. The authors in [9] presented theapplication of PCA subspace method for anomaly detection
in backbone networks. PCA is used for investigate theexplored data with a lower approximation. Zargar et al [22]discussed category-based selection of the features for PCA
based anomaly detection. By classifying network traffic into
six typical groups, the paper proposed to select mostimportant features in order to reduce the amount of data to be

Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 2018

analyzed by PCA. Huang et al. [26] presented three major
approaches for network traffic anomaly detection:
PCA-based, sketch-based and signal-analysis-based. The
authors tried to combine these approaches into a unified
frame. Lee at al. [23] proposed an online over-sampling PCA
algorithm for anomaly detection. Unlike other PCA based
approaches, this method does not store the entire data matrix.
Instead, it uses an online updating technique to update theprincipal direction without solving eigenvalue decomposition
problems. The authors claimed that this method is favored foronline applications. Camacho et al. [17] proposed asketch-based algorithm in addition to traditional PCA for
traffic anomaly detection. In this algorithm, each local
monitor only maintains a series of sketches for each traffic
flow in order to reduce the raw data. The anomaly detection isfollowing the method proposed by Lakhina [12] with thenovel concept of residual subspace. Horrou et al. [10]proposed an integration of PCA, Hotelling’s T 2 and Q
statistics to detect small or moderate anomalies in the process
mean. The authors showed that T 2 statistic can result in false
negatives (missed detection) and cannot detect anomalies thatare orthogonal to the first PCs.
Anomalies can be considered as outliers. The authors in [6]provided a survey on outlier detection techniques andapplications. The authors in [11] discussed three statisticaltechniques in intrusion detection: PCA-based, Chi-square
distribution and Gaussian mixture distribution and discussed
the comparative performance of them. The authors in [19]presented a multi-step outlier-based approach for anomaly
detection in network-wide traffic. A subset of dataset iscalled a cluster consisting of similar data objects.
The choice of a reasonable number of PCs is important foralleviate the autocorrelation of the residual PCs. The authors[7, 10, 25-29] concluded that the goodness of the PCA model
depends on a good choice of how many PCs are retained. The
paper [10, 28] indicated that techniques such as Scree plot
and cumulative percentage variance (CPV) can be used todetermine the number of PCs for the PCA model.
Nevertheless, a threshold value of cumulative variance isneeded to determine the number of PCs to use. Bhuyan et al.
[8] presented an overview of various facets of network
anomaly detection. The paper provided a broad survey of theexisting research on network anomaly detection methods inthe context of network security.
Anomalies are usually detected by the help of a distancemeasure [19]. A good survey of distance measures usedwithin network anomaly detection was given in [7]. The
paper discussed the theoretical background in distancemeasures and various types of distance measures published inprevious papers. The authors discussed two common distancemeasures including Euclidean distance [7, 11, 22, 24-26] andMahalanobis distance [10-12, 14-21, 25-29], and several
equivalent distance measures such as weighted Euclidean
distance, Manhattan distance, distribution law distance T 2.
The paper [7] also indicated the limitation on identifying andselecting distance measures for network anomaly detection.
The paper [29] discussed the use of Mahalanobis distance foranomaly detection in time series in the context of an
unsupervised learning algorithm. Fan et al. [27] proposed amodified PCA scheme which uses multiple similarity
measurements to generate multiple subspaces. The similarity1146

is measured by the Mahalanobis distance. Unlike other PCA
based subspace methods that use only one measurement,
MPCA uses multiple measurements. This scheme has themain disadvantage of computation complexity. It has
proposed mainly for learning approaches, in particular forimage processing, and it is not suitable for quick detection of
anomalous network traffic. In [8], the appropriateness ofproximity measures (distance measures) was discussed, but
not in details. A summary of distance measures was given but
there is no explanation for the choice of measures.
Bayarjargal et al. [25] proposed a combination of entropy
distribution and Mahalanobis distance for anomaly detection.
First, entropy of selected attributes is computed for defining
suspicious traffic area. After that, Mahalanobis distance iscalculated to check anomalies.
D. Issues of Previous PCA Based Methods
PCA allows dimensionality reduction, thus, it is suitable tohandle high dimensional data sets. It converts a multivariate
high dimensional data into uncorrelated individual PCs. In
principle, tests for anomaly can be applied on individual PCs.
However, standard PCA based techniques are typically
proportional quadratic in the number of variables regarding
the distance calculation. The complexity is typically O(kn2)with k is the number of PCs and n is the number of originalvariables [4, 17, 23, 26]. Thus, many research works tried
using a subset of PCs in order to reduce the computation
complexity [6-11, 23, 26-29].
As presented in section II.A, the PCA transformation is
performed in such a way that the first PCs account for themost of the variance in the original data, and the last PCs
represent linear functions of the original variables with verysmall variance. The first PCs represent the large cumulative
proportion of the total variance of the original data. Thus,
these PCs tend to be strongly related to the anomalies on one
or more original variables. Intuitively, it is reasonable todetect anomalies by looking at few first PCs [18]. If most of
the variance of an n-dimensional data set is accounted by k <n principal components, it is possible to select only first k PCs.
The dimension of the data is then reduced to k [26]. However,
it is still not clear how many PCs to be selected for aneffective detection.
On the other hand, last PCs are sensitive to the observationthat are inconsistent with the correlation structure of the data
as indicated in several works such as [12-16]. Large values on
few last PCs will reflect multivariate anomalies that are notdetectable using the criterion based on large values of theoriginal variables [10]. It is useful to check the last PCs for asignificant variation of an observation. That is why many
works suggested using few first PCs and few last PCs.
Typically, two thresholds are used: one for major PCs (qfirst PCs) and one for minor PCs (last r PCs). As indicated in[12, 17, 20, 21], a data instance x is anomalous if

and is normal iforandWhere c1 and c2 are the thresholds, which are calculatedwith the help of the chi-square distribution. These thresholds

Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 2018

are very sensitive to the detection results.
Several works followed the subspace approach andproposed the decomposition of the data into normal andanomalous subspaces using projection of data on the first PCs
and the last PCs respectively [13, 24, 26]. The subspacemethods are also called residual analysis methods. One issue
with this approach is that PCA based anomaly detection
techniques are sensitive to the number of PCs in each of thetwo subspaces [5, 7, 16].
The choice of distance formula is one issue of most of the
PCA based anomaly detection methods. As presented in theabove section, most of the proposed methods are using either
T2 formula [4-6, 30], or Euclidean distance [7, 17, 24, 26] or
Mahalanobis distance [10, 11, 16, 20, 21, 25]. The
computation of the distance is quadratic proportional to of thevariables. With high dimensional dataset, the distancecalculation will increase the computational cost, and a quick(online) detection is not possible.
The application of PCA techniques for NTAD in IoT
networks has been just investigated in few recent researchworks, e.g. [31-37]. A general security framework wasrecently proposed in [31], which is based on three parts of
IoT systems, namely physical part, network part andapplication part. However, there is still not clear how to apply
detection methods for network traffic anomalies. The paper
just described the general scheme, which is mainly forauthentication. The paper [32] provided basic three layered
IoT architecture and discussed several security issuesof IoT that exist in such architectures. There is a good survey
on previous research works on IoT security. The authors in[33] provided a survey of several security architectures forembedded IoT systems. These architectures are mainly basedon hardware-specific environment and are typically designed
for specific tasks. Pajouh et al. [34] investigated the demandon detecting intrusion and malicious activities within IoT
networks and proposed a model for intrusion detection basedon two-layer dimension reduction and two-tier classification
module. The model is using PCA and linear discriminate
analysis. Sharma et al. [35] proposed a framework forcoordinated processing between edge and cloud computing /processing. The paper discussed the issue of hue amount ofdata generated from heterogeneous wireless IoT devices.
Ferrando et al. [36] investigated the issue of streaming
analytical techniques for detecting events in traffic feature
distribution, which can allow the classification of abnormal
behaviour within an IoT network. Recently, Zhao et al. [37]proposed a model for intrusion detection based on dimension
reduction algorithm using PCA and a classifier for IoT
networks.
In fact, in contrast to the traditional networks, IoT opens acompletely new dimension to security, where attack threats
move from manipulating information to controlling actuation(in other words, moving from the digital to the physicalworld). In our best knowledge, there is still very few works
investigating PCA based methods for NTAD in IoT
networks. Moreover, there are still several issues for network
traffic anomaly detection using PCA, which have been notadequately investigated for IoT environment regarding theconstrained resource and limited performance. Threechallenges are of most interested by applying PCA for IoT
networks including: 1) selection of PCs for an effective

1147

detection regarding the IoT network constraints, 2) distancemeasure for lower complexity and 3) quick detection of
network traffic anomalies. These issues are the topics of thispaper.
III. A NOVEL NETWORK ANOMALY DETECTION SCHEME
USING PCA FOR IOT NETWORKS
A. Overview of the Proposed Concept
Figure 1 describes the network model we use for our
network anomaly detection scheme. The concept of fog wasintroduced. A fog is a network architecture for processing
data and events from IoT devices closer to the sources of datain contrast to the central data network (known as “Cloud
infrastructure”. In other words, fog architecture extends the“cloud” (the cyber world) into the physical world of things(the world of IoT devices). Within the network model, thenetwork traffic anomaly detection (NTAD) can be
implemented into two levels. NTAD Level 1 (NTAD-L1) isfor the fog architecture (IoT network segment closed todevices) with constrained resources and performance. Thisdetection level requires lower complexity. NTAD Level 2 isfor the cloud infrastructure with powerful resources andcomputing performance. NTAD Level 1 uses PCA techniquewith few PCs for quick detection, while NTAD Level 2 candeploy more PCs for detailed detection. One NTAD Level 2
module can serve several NTAD Level 1 modules (e.g.
NTAD-L1-1, NTAD-L1-2, NTAD-L1-3).

Cyber
World

Cloud Infrastructure
NTAD-L2

Physical WorldNTAD-L1-1

NTAD-L1-2

NTAD-L1-3

IoT Network(Fog 1)IoT Network(Fog 2)

IoT Network(Fog 3)Fig. 1. The Network Model.

Figure 2 depicts the general flow of our anomaly detection
scheme using two levels. Network traffic is collected fromthe IoT network (the fog) by a flow capture (like in otherworks such as [24]).
Collecting network
traffic data
Detailed detection
required?

Building
Pattern Profile

PCA Analysis(Level 1)

PCA Analysis(Level 2)

Quick
Anomaly
Detection (L1)

Anomaly
Detection (L2)Quick Alert

Detailed Alert

Fig. 2. The Detection Flow.

Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 2018

The captured data is standardized and transformed into
PCA. Based on traffic data in normal condition (no attacks),
the model builds a pattern profile (the baseline) forcomparison later. The Level 1 detection module uses few PCs(e.g. 3 PCs) for quick anomaly detection. The number ofsuitable PCs will be given in the next section. If the network
operator wants to have more detailed detection alerts, he canproceed the Level 2 detection module, which uses more PCs(e.g. major PCs and minor PCs as presented in [12, 17-22,
24-26]) for providing detailed detection.
In the following section, we present our detection scheme
in details.
B. A Novel Distance Formula for the Detection Scheme
As presented in Section II, popular NTAD methods use
Euclidean distance or Mahalanobis distance or statistic T2
distribution with high computing complexity. Thus, suchmethods are not suitable for online anomaly detection,
especially for IoT networks (the fogs).
For quick online anomaly detection, we suggest to use
only few PCs and a simple distance formula as possible.
Intuitively, the price to be paid is the accuracy. However, thedetection can be implemented into two steps as describedabove. At the first step, network operators just want to knowwhether there are abnormal traffic flows or not. A quick
detection with acceptable accuracy is desirable. At the next
step, network operators can apply a detailed analysis forhigher accuracy.
For implementing our proposed detection scheme with
two levels, we want to develop a general distance calculation
formula, which can use few PCs as well as a number of PCs.
Our idea is to use the well-known Minkowski formula [38]for developing the new formula. The derivation of the generalformula is as follows.
As indicated in [38], the Minkowski distance between two
observed data x = (x1, x2, …, xp) and µ = (µ 1, µ 2, …, µp) is asfollows:

1148

Lemma 1: The formula (17) is a general form of the
Euclidean distance.
Proof: Since c is arbitrary variable, we can choose c=2. All
PCs can be considered equally, i.e. no variance of each input
variable, the weight wi can be set to 1. Thus, from (17) we canhave:

The formula (18) is the square Euclidean distance. In case
we have consider variance of the input variables, i.e. PCs
have different impacts on the distance calculation, we get:

The formula (19) is the weighted Euclidean distance. Lemma 2: The formula (17) is a general form of theMahalanobis distance.
Proof: Since c is arbitrary variable, we can choose c=2. The
impact of PCs is inverse proportional to their eigenvalues[38]. PCs with lower eigenvalues have large contribution on
distance deviation, and PCs with large eigenvalues have lesscontribution on distance deviation, respectively. Thus, from(17) we can have:

The formula (20) is the Mahalanobis distance. Lemma 3: The formula (17) is a general form of theMahattan distance.
Proof: Since c is arbitrary variable, we can choose c=1. Thus,
from (17) we can have:

All PCs can be considered equally, i.e. no variance of each
input variable, the weight wi can be set to 1. Thus, from (17)
we have:

By transforming into PCA domain with yi principal
components, we derive the Minkowski distance from eachobservation to the centre (the origin of PC axes) as follows:

Since each variable can have different variance, we canfollow the approach of weighted Euclidean distance as
illustrated in [16, 30] to give a weight to each PC in theequation (16) as follows:

Where wi is the weight for the ith PC (wi ≠ 0).
The formula (17) is our new proposed distance formula,which has the following properties.

The formula (22) is the Mahalanobis distance. Conclusion:
We can use the general formula (17) for distancecalculation in our proposed NTAD scheme based on PCA.
For quick detection (Level 1 detection), we can use formula(21) or formula (22) with few PCs. In our previous works [28,39], we have indicated that 3 or 4 PCs are enough for quick
detection with an acceptable detection true rate of 92%. In
this case, the computation complexity is O(k) with k=3 or 4.
For detailed detection (Level 2 detection), we can use
more PCs using the formula (21) or (22), or even the formula(19) or (20), depending on the performance of the detection
module NTAD-L2 in the cloud infrastructure.
C. Description of the Novel NTAD Scheme
In this section, we describe how to use the distanceformula for our novel NTAD scheme.
At the initial stage, we have to collect the normal network

Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 2018traffic (in case of no attacks) in order to build the patternprofile. The captured data is standardized and transformed
into PCA dataset. By transforming into PCA space, weclassify PCs into m major PCs and p-m minor PCs similar to
the approach in [12, 17-22, 24- 27]. As suggested in [12, 26],
the major PCs include the PCs representing 50% of thevariance of total eigenvalues. The minor PCs haveeigenvalues smaller than or equal to 0.2.
From the pattern profile, we can use the empiricalcumulative distribution function (ECDF) to determine thethresholds d1N for major PCs and d2N for minor PCs,
respectively. The ECDF function is defined as follows:
That means the probability for a distance d smaller or
equal to the threshold dN. With the assumption of statistical
distribution and an estimation rate α for false estimation, we
can look at the table for FECDF - distribution function and seek
for the values of dN corresponding to (1-α) of the ECDF. For
instance, if α = 5%, the thresholds dN can be determinedcorresponding to 95% of ECDF.
At the detection stage, online traffic data will be gathered
into datasets. Similar to the previous stage, the collected
dataset will be standardized and transformed into PCA
domain using two subspaces, one for m major PCs and p-m
minor PCs (see e.g. [12].
For quick detection (NTAD-L1), we apply the formula (22)with 3 or 4 PCs as follows:1149

The determination of the thresholds d1N and d2N is using
the empirical cumulative distribution function (ECDF) as
described above.
IV. EXPERIMENTS
A. Dataset and Metrics
The dataset Kyoto Honeypot [40] is a real dataset collectedfrom networks using a Honeypot at the Kyoto University.
This dataset was used in many works for anomaly detection.
The dataset includes most of the anomalies originated by theInternet. Thus, this dataset reflects objectively the anomalous
events of collected network traffic.
We use in our experiments 14 essential features of the
Kyoto Honeypot dataset including the most importantfeatures (attributes) of the network layer and transport layer
traffic data. These features (attributes) are selected similar tothe previous works [9, 12-21, 23-27] for comparison purpose.
For the experiments, we select three random datasets of the
Kyoto Honeypot datasets collected from networks as
indicated in the Table I.
TABLE I
THREE RANDOM DATASETS FOR EXPERIMENTS

Where k=3 or k=4.
The quick alert for traffic anomaly is determined if:

DatasetDataset 1
Dataset 2
Dataset 3

The threshold value dNL1 is determined using ECDF
function as described above.
For detailed detection (NTAD-L2), we apply the formula(17) for q first PCs (q<p) including m major PCs and q-r
minor PCs with 1<m<q-r<p. An observed dataset isconsidered as anomaly if:

Where d1 and d2 are the distances according to major PCs
and minor PCs respectively, d1N and d2N
are thecorresponding thresholds of d1 and d2, OR and AND are thelogic operations.
An observed dataset is considered as normal if:

In case of c=1 and wi =1, the formulas for d1 and d2 will be:

Numberof flows
125643114148120857

Number ofanomalous flows
84476
38790
57337

Number of
normal flows
41167
75358
63520

Following parameters are used for checking the accuracy:

Where TPR is True Positive Rate, FPR is False Positive
Rate, TP is the number of true positive alerts, FN is thenumber of false negative alerts, FP is the number of false
positive alerts, and TN is the number of true negative alerts.
The total number of anomalous events is TP+FN; the total
number of normal events is TN+FP.
B. Experiment Results
To build the sample dataset (the profile), we use traffic
data from 5000 connections (similar to previous works in[12,13] for the consequent comparison). We transform thisdataset into PCA space; calculate the centroid of the datausing the distance formula. We determine the threshold using
the empirical cumulative distribution function as described in
the previous section. The thresholds are 95% of the ECDF
function.
In the detection phase, the scheme uses the online
collected datasets from Kyoto Honeypot datasets [40] andcarries out the following steps: data standardization, PCA
transformation, distance calculation, threshold comparison.
Table II shows the experiment result with dataset 1 using
the threshold 95% for different combination of the
Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 2018

parameters k (number of PCs), c and wi (three cases). As
indicated in the grey row, our scheme provides acceptable
TPR (94.3%) and FRP (4.8%) while keeping a low
complexity with k=3 (only 3 PCs), c=1 and wi =1.
TABLE IIRESULTS WITH DATASET 1, THRESHOLD 95%

Case
1
1
1
2
2
2
3
3
3

k
3
5
14
3
5
14
3
5
14

c
2
2
2
2
2
2
1
1
1

wi
1
1
1
1 / λi1 / λi1 / λi1
1
1

TPR (%)
92.4
91.8
94.4
94.6
91.9
93.8
94.3
91.3
92.1

FPR (%)
4.7
5.2
5.3
4.9
5.6
5.0
4.8
5.2
5.4

Table III shows the number of anomalous flows that aretrue detected in dataset 1 for case 1, 2 and 3, respectively. In
fact, the total number of anomalous flows in dataset 1 is84476.
TABLE IIINUMBER OF TRUE DETECTED ANOMALY FLOWS (TP), DATASET 1

CaseParameters123

c=2, wi=1
c=2, wi= 1/λic=1, wi=1

TP
k=3
78106
79951
79783

k=4
77430
78626
77678

k=5
77611
77633
78465

k=14
80082
79302
78431

Figure 3 shows the number of true detected anomalous
flows in dataset 1 for three cases regarding different k(number of PCs)..

Fig. 3. TP for Anomalous Flows in Dataset 1.

1150

As showed in figure 4, our scheme provides acceptable
TPR (94.3%) in comparison to other works by k=3. The
Group Mahalanobis gives better TPR (94.6%), but thecomplexity of our scheme is O(3), while the complexity ofGroup Mahalanobis is O(w32). Thus, our scheme can be used
for quick detection using k=3.
Table IV and Table V show the experiment results withdataset 2 and dataset 3, respectively. Threshold is 95%. The
results are showed for different combination of theparameters k (number of PCs), c and wi. The grey row in thetable indicates that our scheme (k=3, c=1, wi =1) provides
acceptable TPR and FPR with lower complexity incomparison to other previous works.
TABLE IVNUMBER OF TRUE DETECTED ANOMALY FLOWS (TP), DATASET 2

Case
1
1
1
2
2
2
3
3
3

k
3
5
14
3
5
14
3
5
14

c
2
2
2
2
2
2
1
1
1

wi
1
1
1
1 / λi1 / λi1 / λi1
1
1

TPR (%)
95.9
99.9
93.1
93.8
96.9
99.0
95.9
92.3
93.8

FPR (%)
5.4
5.1
4.6
4.7
4.8
4.9
5.0
4.7
5.1

TABLE VNUMBER OF TRUE DETECTED ANOMALY FLOWS (TP), DATASET 3

Case
1
1
1
2
2
2
3
3
3

k
3
5
14
3
5
14
3
5
14

c
2
2
2
2
2
2
1
1
1

wi
1
1
1
1 / λi1 / λi1 / λi1
1
1

TPR (%)
99.4
99.9
99.9
99.7
99.8
99.9
98.6
97.6
100

FPR (%)
5.6
5.3
5.4
4.9
5.0
5.3
4.9
5.3
4.9

Table VI shows the number of normal traffic flows that aretrue detected in dataset 2 for case 1, case 2 and case 3,
respectively. The total number of actual normal flows indataset 2 is 75358.
TABLE VI
TRUE DETECTED ANOMALY FLOWS (TP) IN DIFFERENCE CASES

.

Case

Parameters123

c=2, wi=1
c=2, wi= 1/λic=1, wi=1

TN
k=3
71275
71820
71586

k=4
71385
71417
71699

k=5
71500
71668
71767

k=14
71886
71675
71504

Fig. 4. TPR Comparison using Dataset 1.

Figure 4 shows the comparison of TPR between ourscheme and typical previous works according to the numberof PCs used. As presented in the Section II, the Group
Euclidean represents the TPR using Euclidean distanceformula, which is used in previous works such as [7, 11, 17,
24-26]. The Group Mahalanobis represents the TPR using
Mahalanobis distance formula, which is used in previous
works such as [10, 12, 14-16, 18, 20-22].

Fig. 5. TN for Normal Flows in Dataset 2.

Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 2018

Figure 5 shows the number of true detected normal flows
in dataset 2 for three cases according to the number of PCs.
The reason for TN results is that the last PCs are responsible
for the variance of the anomalies.
The experiment results showed that our scheme canprovide comparable accuracy with lower complexity (O(kn)instead of O(kn2) in other schemes) in comparison to typical
works using Euclidean distance formula (Group Euclidean)or using Mahalanobis distance formula (Group Mahalanobis).
For quick network anomaly detection, we can use the general
distance formula with few PCs instead of using all PCs or alarge number of PCs as presented in previous works.
V. CONCLUSION
Network traffic anomaly detection is one of thechallenging tasks of network operators, especially in IoT
network environment due to many constraints such as limited
resource and performance. The detection scheme should be
simple (lower complexity) and quick as possible. Althoughmany detection methods have been proposed in the past,methods based on Principal Component Analysis (PCA)
received a lot of attention. PCA based methods promise
suitable solutions for IoT networks, but the remaining issues
need to be investigated including selection of principal
components, distance formula, complexity reduction. Thereis still very few works investigating PCA based methods for
network anomaly detection in IoT networks
The paper investigated problems of PCA based methods
for IoT networks including: 1) selection of PCs for aneffective detection regarding the IoT network constraints, 2)
distance measure for lower complexity and 3) quick detectionof network traffic anomalies. Based on selecting few PCs
using our developed general distance formula, we proposed anovel detection scheme with two levels. The first level is forquick detection with few k principal components in order toreduce the complexity to O(k) while keeping an acceptabledetection rate in comparison to previous methods. The
second level is for detailed detection with a number ofprincipal components. The paper presented various
experiments using three random datasets from Kyoto
Honeypot to show the feasibility of our proposed scheme.
ACKNOWLEDGMENT
This work is supported by the ASEAN IVO project “AHybrid Security Framework for IoT Networks”.
The authors thank the National Institute of Information
and Communications (NICT, Japan) and NES (NEC, Japan)
for the supports.
REFERENCES
[1]
[2]

[3]

[4]

Q.Jing, et al., "Security of the IoT: Perspectives and Challenges".
Wireless Networks, Vol 20, Issue 8, Nov. 2014, pp.2481-2501
Y.M. Pa pa, S. Suzuki, K. Yoshioka, T. Matsumoto, T. Kasama, C.
Rossow. "IoTPOT: A Novel Hoeypot for Revealing Current IoT.
Threats". Journal of Information Processing, Vol 24, No.3, May 2016,
pp.522-533.
A.V. Vijayalakshmi, L. Arockiam, "A Study on Security Issues andChallenges in IoT". Engineering Sciences & Management Research.
Vol 3, No 11, Nov. 2016, pp. 34-43
V. Chandola, A. Banerjee, V. Kumar, “Anomaly detection: a survey”,
ACM Computing Surveys, 2009, 41, (3), pp. 1-58.

1151

M. Ahmed, A. Mahmood, J. Hu, “A survey of network anomaly
detection techniques”, Network & Computer Applications, 2016, 60(2016), pp. 19-31.
[6] R. Bansal, et al., “Outlier detection: applications and techniques in data
mining”, Cloud Syst./Big Data Eng. 2016, pp. 373-377.
[7] D. Weller-Fahy, B. Borgehtti, A. Sodemann, “A survey of distance andsimilarity measures used within network intrusion anomaly detection”,
IEEE Communication Survey & Tutorials, 2015, 17, (1), pp. 70-91.
[8] M. Bhuyan, D. Bhattacharyya, J. Kalita, “Network anomaly detection:
methods, systems and tools”, IEEE Com. 2014, 16, 303-336.
[9] M. Molina, et al., “Operational experiences with anomaly detection inbackbone networks”, Computer & Security, 2012, 31, (3), pp. 273-285.
[10] F. Harrou, et al.,“Amalgamation of anomaly detection indices forenhanced process monitoring”, Loss Prevention in the Process
Industries, 2016, 40, (3), pp. 365-377.
[11] H. Om, T. Hazra, “Statistical techniques in anomaly intrusion detection
system”, Advanced in Eng. & Technology, 2012, 5, (1), pp.387-398.
[12] M. Shyu, S. Chen, K. Sarinnapakorn, L. Chang, “A novel anomaly
detection scheme based on principle component classifier”, Proc. IEEE
foundation and New Directions of Data Mining Workshop, Florida,
USA, Nov. 2003, pp. 172-179.
[13] A. Lakhina, M. Crowella, C. Diot, “Diagnosing network-wide traffic
anomalies”, Proc. ACM SIGCOMM '04, Portland, Oregon, USA, Aug.
2004, pp. 219-230.
[14] D. Brauckhoff, K. Salamatian, M. May, “Applying PCA for traffic
anomaly detection: problems and solutions”, Proc. INFOCOM’09, Riode Janeiro, Brazil, Apr. 2009, pp. 2866-2870.
[15] H. Ringberg, A. Soule, J. Rexford, C. Diot, “Sensitivity of PCA for
traffic anomaly detection”, Proc. ACM SIGMETRICS ’07, San Diego,
USA, Jun.2007, pp. 109–120.
[16] J.
Camacho,A.
Perez-Villegas,
P.
Garcia-Teodoro,
G.Macia-Fernandez, “PCA-based multivariate statistical network
monitoring for anomaly detection”, Computer & Security, 2016, 59(2016), pp. 118-137.
[17] Y. Liu, L. Zhang, Y. Guan, “Sketch-based streaming PCA algorithm
for network-wide traffic anomaly detection”, Proc. IEEE 30th Int. Conf.
on Dist. Computing Systems, June 2010, Genoa, Italy, pp. 807-816.
[18] C. Callegari, L. Gazzarrini, S. Giordano, M. Pagano, T. Pepe, “A novel
PCA-based network anomaly detection”, Prof. IEEE Int. Conf. on
Communications, Kyoto, Japan, Jun. 2011, pp. 1-5.
[19] M. Bhuyan, D. Bhattacharyya, J. Kalita, “A multi-step outlier-based
anomaly detection approach to network-wide traffic”, Information
Sciences 2016, 348 (2016), pp. 243-271.
[20] U. Kwitt, Hofmann, “Robust methods for unsupervised PCA-based
anomaly detection”, Proc. IEEE/IST Work-shop on Monitoring, Attack
Detection and Mitigation, Tubingen, Germany, 2006, pp. 1-3.
[21] A. Das, S. Misra, S. Joshi, J. Zambreno, G. Memik, A. Choudhary, “An
efficient FPGA implementation of principle component analysis based
network intrusion detection system”, Proc. Design, Automation andTest in Europe, Munic, Germany, Mar. 2008, pp. 1160-1165.
[22] G. Zargar, T. Baghaie, “Category-based intrusion detection using
PCA”, Journal of Information Security, 2012, (3), pp. 259-271.
[23] Y. Lee, Y. Yeh, Y. Wang, “Anomaly detection via online
oversampling principal component analysis”, IEEE Trans. On
Knowledge & Data Engineering, 2013, 25, (7), pp. 1460-1470.
[24] M. Elrawy, T. Abdelhamid, A. Mohamed, “IDS in telecommunication
network using PCA”, International Journal of Computer Networks &Communications, 2013, 5, (4), pp.147-157.
[25] D. Bayarjargal, G. Cho, “Detecting an anomalous traffic attack area
based on entropy distribution and Mahalanobis distance”, International
Journal of Security and Its Applications, 2014, 8, (2), pp. 87-94.
[26] H. Huang, H. Al-Azzawi, H. Brani, “Network Traffic Anomaly
Detection”, arXiv:1402.0856 preprint, 2014.
[27] Z. Fan, Y. Xu, W. Zuo, J. Yang, J. Tang, Z. Lai, D. Zhang, “Modified
principal component analysis: an integration of multiple similarity
subspace models”, IEEE Trans. On Neural Networks & Learning
Systems, 2014, 25, (8), pp. 1538-1552.
[28] H.D. Nguyen, D.H. Hoang, “A model for network traffic anomaly
detection”, ICACT Trans. on Advanced Communications Technology,
2015, 4, (4), pp.644-650.
[29] E.G. Nascimento, O. Tavares, A.F. Souza, “A cluster-based algorithm
for anomaly detection in time series using Mahalanobis distance”, Proc.
Int. Conf. Artificial Intelligence, July 2015, Nevada, USA, pp.
622-628.
[30] S. Franklin, M. Brodeur, “A practical application of a robust
multivariate outlier detection method”, Proc. of Survey researchmethods section, American Statistical Association, 1997, pp. 186-191,
http://www.amstat.org/ sections/srms/proceedings.
[5]

Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 20181152

[31] M. Pasha, S.M. Waqas Shah, U. Pasha, "Security Framework for IoT
Systems" International Journal of Computer Science and Information
Security (IJCSIS), Vol 14, No 11, Nov. 2016, pp.99-104.
[32] A.V. Vijayalakshmi, L. Arockiam. "A Study on Security Issues andChallenges in IoT", Intl. Journal of Engineering Sciences &Management Research. Vol 3, No 11, Nov. 2016, pp. 34-43.
[33] N.C. Winget, Aa.R. Sadeghi, Y. Jin. "INVITED: Can IoT be Secured:
Emerging Challenges in Connecting the Unconnected". DAC' 2016,
June 05-09, 2016, Austin, TX, USA.
[34] H.H. Pajough, R. Javidan, R. Khayami, D. Ali, K.K. Raymond Choo,“A Two-layer Dimention Reduction and Two-tier Classification Modelfor Anomaly-based Intrusion Detection in IoT Backbone Networks”,
IEEE Trans. On Emerging Topics in Computing, 29 Nov. 2016.
[35] S.K. Sharma, X. Wang, “Live Data Analytics with Collaborative Edge
and Cloud Processing in Wireless IoT Networks”, IEEE Access, Vol 5,
March 2017, pp. 4621-4635.
[36] R. Ferrando, P. Stacey, “Classification of Device Behaviour in Internetof Things Infrastructures”, Proc. of International Conference on
Internet of Things and Machine Learning, Oct. 2017.
[37] S. Zhao, W.Li, T. Zia, A.Y. Zomaya, “A Dimension Reduction Model
and Classifier for Anomaly-Based Intrusion Detection in Internet ofThings”, IEEE 15th International Conference on Pervasive Intelligence
and Computing (PICom 2017), Nov. 2017.
[38] J.P. Geer, “Some aspects of Minkowski distance”, research report,
University of Leiden (1995), pp. 1-31.
[39] H.D. Nguyen, D.H. Hoang. "Network traffic anomaly detection in thecondition of noisy training dataset". Journal of Science & Technology
onInformation
andCommunications,
Vol
1,
CS01,
2016, pp.5-18.
[40] Traffic data from Kyoto University’s Honeypots, http://www.
takakuara.com/Kyoto_data/
Dang Hai Hoang, A/Prof. Dr. DSc., PhD (1999),
DSc (2002) at TU Ilmenau, Germany. Current
institution: Posts and Telecommunication Institute ofTechnology. Research interests: Communication
network, IoT networks, information security,
network security.

Ha Duong Nguyen, BSc (2001), MSc (2003) at TU
Hanoi, PhD (2017) at PTIT, Vietnam. Current
institution: Faculty of Information Technology.
Research interests: Communication network,
telecommunication networks, information security,
network security.

Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 2018

1153

SEFL: Selective Ensemble Fuzzy Learner for
Cognitive Detection of Bio-Modality Spoofingin MCPS
Nishat I Mowla*, Inshil Doh**, Kijoon Chae**Department of Computer Science and Engineering, Ewha Womans University, 52, Ewhayeodaegil,
Seodaemungu, Seoul, 03760, Korea**Department of Cyber Security,Ewha Womans University, 52, Ewhayeodaegil, Seodaemungu, Seoul, 03760,
Korea Namenishat.i.mowla@gmail.com, isdoh1@ewha.ac.kr, kjchae@ewha.ac.kr

Abstract—User authentication in a Medical Cyber Physical
Systems (MCPS) can be effectively done using biometricfeatures. Biometric features, widely used for user authentication,
are equally important to national and global technology systems.
Biometric features, such as face, iris, fingerprint, are commonlyused while more recently palm, vein and gait are also getting
attention. To fail the traditional biometric detection systems,
various spoofing approaches have also been developed over time.
Among various methods, image synthesis with play-doh, gelatin,
ecoflex etc. are some of the more common ways for spoofing
bio-modalities. Success of traditional detection systems are
related to custom tailored solutions where feature engineering
for each attack type must be developed. However, this is not afeasible process when we consider countless attack possibilities.
Also, a slight change in the attack can cause the whole system tobe redesigned and therefore becomes a limiting constraint. The
recent success of machine learning inspires this paper to explore
weak and strong learners with ensemble learning approaches
using AdaBoost. In essence, the paper proposes a selective
ensemble fuzzy learner approach using Ada Boost, feature
selection and combination of weak and strong learners toenhance the detection of bio-modality spoofing for MCPS. Our
proposal was experimented on real datasets and verified on thefingerprint and iris benchmark.
Keyword—MCPS, Biometric spoofing, Spoofing Detection,
Ensemble Learning, Feature selection

I. INTRODUCTIONM

EDICAL Cyber Physical Systems are a four-layerarchitecture which extends from users in the acquisition———————————————————————
Manuscript received on Jan. 15, 2018. This work is sponsored by Basic
Science Research Program through the National Research Foundation of
Korea(NRF) grant funded by the Korea government (MSIP), and a follow-up
of the invited journal to the accepted & presented paper of the 19thInternational Conference on Advanced Communication Technology(ICACT2017), and Grant ID is 2016R1A2B4015899. Kijoon Chae is thecorresponding author.
Chae. Kijoon. Author is with Ewha Womans University, Seoul, 120750
Korea (corresponding author to provide phone: +82-10-3726-6157; e-mail:kjchae@ ewha.ac.kr).
Mowla Nishat. Author, is with Ewha Womans University, Seoul, 120750
Korea. (e-mail: nishat.i.mowla@gmail.com).
Doh Inshil. Author is with Ewha Womans University, Seoul, 120750
Korea. (e-mail: isdoh1@ewha.ac.kr).

layer to cloudlet to cloud and then to the caregiver. As it is asensory network composed of medical aspects, biometricfeatures can be effectively used for user authentication. An
increasing interest in the evaluation of biometric systems inrecent years have been observed for user identification andauthentication leveraging traditional fingerprint, iris and more
recently vein, blood flow etc. In the other hand, various
spoofing attacks have also been developed to defeat thesesystems. Given these attacks are performed in an analog
domain with heavy device dependency following regular
protocol, digital protection schemes such as encryption,
digital signature or watermarking are unsuitable. The successof detection mechanism for such types of attacks are often
linked to custom tailored solution where feature engineering
plays a major role. Nevertheless, in a pool of myriad possible
attacks, a slight change in the attack model can cause thewhole mechanism to be redesigned to adopt the newmechanism which surely becomes a limiting constraint [1].
The past few years have witnessed the success of Deep
Learning techniques such as Convolutional Neural Network(CNN) for efficient image classification and Recurrent Neural
Network (RNN) for its special recurrence capabilities incontextual image recognition [2]. While high accuracy can beachieved, the computation can take long time which becomesa limiting constraint for time-critical systems such as MCPS.
Previously, we proposed a fuzzy ensemble learner based
cognitive detection scheme for fingerprint spoofing in an
MCPS where a selective ensemble architecture was proposedusing Ada Boost and feature selection [31]. In this paper, we
extend the research to more complex modality of the iris
benchmark to further verify the effectiveness of the selective
ensemble architecture to make the problem space simpler andenhance the overall performance. The performance of thestrong learner is further substantiated with the more complex
representation of the iris benchmark to provide further
insight.
We discuss some of the related works in sections II. In section
III we discuss our proposed mechanism and evaluation results
followed by the conclusion in section IV.

Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 2018

II. RELATED WORKSIn this section, we review anti-spoofing related work forbio-identifiable modalities focusing on fingerprint spoofing.
A. Bio-identifiable Modality Spoofing Detection
For fingerprint spoofing detection, both hardware-based(exploring extra sensors) and software-based solutions(relying only on the information acquired by the standard
acquisition sensor of the authentication system) have been
explored. In [3] quality measures such as ridge strength ordirectionality, ridge continuity, ridge clarity, and integrity of
the ridge-valley structure was used as a set of features forfingerprint liveness detection. In [4], the presence of gummy
fingers was explored using various methods. In [5], a method
for representing all spectrum characteristics in a compact
feature representation form was explored. In [6], well suited
to high contrast patterns such as the ridges and valleys offingerprints images, Weber Local Image Descriptor (WLD)
for liveness detection was considered. In [7] Multi-Scale
Block Local Ternary Patterns (MBLTP) was proposed as aliveness detection scheme. In [8], Binarized Statistical Image
Features (BSIF) was explored which was originally proposedin [9]. According to reports in the LivDet 2013 Fingerprint
Liveness Detection Competition [28], the fingerprint
spoofing attack detection task remains an open problem withresults still far from a perfect classification rate. Mostly
hard-coded features, sometimes exploring quality metrics
related to the modality (e.g., directionality and ridge strength),
general texture patterns (e.g., LBP-, MBLTP-, andLPQ-based methods), and filter learning through natural
image statistics are heavily followed.
For iris spoofing spoofing detection, the use of Fast Fourier
Transform was proposed in [10] to verify the high frequency
spectral magnitude in the frequency domain for iris spoofing
detection. Solutions for iris liveness detection range from
hardware-based solutions [11] [12] [13] to software-based
solutions relying on texture analysis for detecting an attacker
using contact lenses with someone else’s printed pattern [14].
Software-based solutions considering cosmetic contact lenses[15], [16], [17], [18]; pupil constriction [19]; and multibiometrics of electroencephalogram (EEG) and iris together[20] had been explored rigorously. In [21], best features are
selected through sequential floating feature selection (SFFS)[22] to feed a quadratic discriminant classifier. In [23], image
quality measures were explored, and three classification
techniques were proposed. In [24], the previous work was
extended by using a feature selection step on the features ofthe studied methods to obtain the "best features" and thenused well-known classifiers for the decision making. In [25],iris segmentation was proposed to obtain the iris contour andfeature extraction processes were adapted to the resulting
non-circular iris regions. In [26], a general framework for iris
image classification based on a Hierarchical Visual Codebook(HVC) encoding the texture primitives of iris images was
proposed. For iris spoofing detection, features have been
profoundly studied through image-quality metrics, texture
patterns, bags-of-visual-words and noise artifacts.

1154

B. Machine Learning based Bio-modality Spoofing
Detection
A couple of machine learning based methods was proposed
for bio-modality spoofing detection in recent years. A deeparchitecture based on Convolutional Neural Network using
Architecture Optimization (AO) and Filter Optimization (FO)was proposed in [1]. The results were verified in threedifferent modalities and in multiple real datasets. In [2], a
combination of Recurrent Neural Network and Convolutional
Neural Network was used to create a deep architecture whichis context aware as well as capable of detecting high levelfeatures. Different existing datasets are used to evaluate theperformance bio-identifiable modality spoofing using
machine learning algorithms in many research works [1].
However, these architectures require heavy weight algorithms
which cannot run fast enough without the use of GPU which
incurs another level of computational cost. In [27], alightweight Adaboost based model with k-means clustering
was used to optimize detection accuracy of images. Whilesome considered various deep and boosting algorithms, notmany explored the role of features and ensemble learning in a
profound way. Our proposed approach, therefore, aims toleverage low computation weak learners and moderately
strong learners with boosting ensemble and feature selection
for detecting fingerprint and iris benchmark spoofing
detection as an authentication verification scheme in Medical
Cyber Physical Systems.
III. PROPOSED MECHANISM
Machine Learning performs various levels of learning. It
has effectively explored various boosting techniques such as
Ada Boost. The main idea of Ada Boost is to set a bunch of
weak classifiers or learners working together to outperform asingle strong learner [27]. The idea can also be verified withvarious weak learner architectures such as one-level Decision
Tree. Boosting is also a form of ensemble learning where theoutput of the most efficient learner is incorporated into thefinal result [27]. However, there are certain features that arelearned well by weak learners and certain features that arelearned better by strong learners. Based on such facts, ourpaper is inspired to propose training light weight strong
learners parallelly with the weak learners, as a combo learner,
which undergoes selective ensemble learning with Ada Boostand feature selection in order to come up with the final
decision algorithm. The following sub-section describes ourscheme in more detail.
In our proposed scheme, the bio-modality spoofing islearned with one strong learner and one weak learner using
Ada Boost. Both learners are represented in different feature
selected environments. The fuzzy ensemble algorithm, then,chooses the best combination of the machine learningalgorithm and feature selection value as the final
decision-making algorithm. Fig 1 shows the basic workflow
of our proposed fuzzy ensemble learning algorithm using Ada
Boost, feature selection and strong and weak learnercombinations.

Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 20181155

features. Therefore, the best feature selection value is saved
for both the weak learner and the strong learner.
3) Combo Selection: The feature selection value withhigher accuracy, among the two best feature selection values
saved in the feature selection step, is selected. Therefore, thefinal decision-making algorithm uses this feature selection
value along with its corresponding machine learningalgorithm which could either be a weak or a strong learningalgorithm based on the attained accuracy.
The algorithm of our proposed selective fuzzy ensemble
learner using Ada Boost and feature selection is shown below.

Fig. 1 Selective Ensemble Fuzzy Learning [31].

In the above figure, the DB is used to provide a two-classproblem containing spoofed bio-identifiable modality andlive bio-identifiable modality. The two-class problem is thenlearned by one strong learning algorithm and one weaklearning algorithm. FS1, FS2, FSn are the different feature
selection environments where n is the total number of features
used in the experimentation. FSnMLs represents the best
feature selected environment of the strong learning algorithm.
Similarly, FSnMLw represents the best feature selectedenvironment of the weak learning algorithm. Finally, the best
combination out of these two environments, FSnMLs and
FSnMLw, is selected as the decision-making algorithm
combination for the final decision process.
The combination of weak and strong learners with Ada
Boost is an unexplored field with potential. This is because, it
is believed that weak learners together can perform better but
it is not explored how a moderately strong learner with lower
computational overhead added to this environment could help
the overall detection performance. Besides, ensemble
learning is computationally expensive. Hence, selective
ensemble learning is proposed which can reduce the numberof features. The latter is further enhanced by introducing afeature selection methodology to aid in the selective ensemble
approach.
LiveDet 2015 [28] and Warsaw [29] dataset provides
different kinds of modality spoofing benchmark along withlive dataset benchmark. On these different spoofing datasets,
we apply our selective fuzzy ensemble learning with feature
selection and Ada boost which, as discussed before, can besummarized to follow three major steps as discussed below.
1) Fuzzy Learning: One strong learner and one weaklearner is used to learn the spoofed and non-spoofed instances.
Both learners are processed with boosting algorithm by using
Ada Boost.

After pre-processing the data to form a 2-class problem where
one is the spoofed class and the other is the non-spoofed class.
Class spoofed is initialized as 1 and class live or non-spoofed
is initialized as 0. The feature selection algorithm is run forboth the strong and weak learner. The combo of the learnerand feature selection is compared to find the best combo.
IV. PEROFORMANCE EVALUATIONThe LiveDet 2015 [28] and Warsaw dataset [29] dataset
provides a set of spoofed and live biometric dataset. For our
experimentation, we used the benchmark for the fingerprint
and iris dataset containing spoofed and live instances. The
benchmarks were pre-processed to extract features from eachspoofed and live image and stored as ARFF
(Attribute-Relation File Format) files.
After pre-processing the benchmarks to extract the features,a two-class problem is created containing spoofed andnon-spoofed instances. We used Knime Analytics tool[30] forpre-processing the dataset and simulating the boosted strong
and weak learners. Therefore, the dataset is then learned by
one boosted strong learner and one boosted weak learner. For
strong learner we used Naïve Bayes and for weak learner weused a One-Level Decision Tree. Fig. 4 and Fig. 5 shows our
simulation of the dataset classification with the learners using
Ada Boosting and feature selection.

2) Feature Selection: This is done in two inter-linked
steps. Both learners in the fuzzy learning approach isrepresented in different feature selected environments. It is
known that best performance is not always obtained by using
the most number of features but by using the most relevant

Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 2018

1156

Fig. 5. Different feature selected values for Boosted Strong and Weak
Learner for iris benchmark.

Fig. 2. Data partitioning and forwarding feature selection [31].

Fig. 3. Boosting Learner and Feature Selction [31].

The combined learning of these two learners aremonitored for all feature selection environment to extract thebest selection values. As can be seen from Fig. 4, in terms of
average accuracy, we get highest performance (98.485%)with 2,5 and 12 feature selection value for the boosted strong
learner and 3,4,7 and 14 feature selection value for theboosted weak learner. Combinedly, we can get achieve
highest performance with 2,3,4,5,7,12 and 14 features. From
Fig. 5, we get highest performance (99.495%) with 2 features
for boosted strong learner and with 3,4,5,7 and 9 features forthe boosted weak learner. Thus, based on the available
features and preferred algorithm between the strong and weaklearner, we can choose the final combination as the decisionalgorithm. Table 1 summarizes a list of comparable
algorithms to our proposed Selective Ensemble Fuzzy
Boosted Learner algorithm.
TABLE I
BIO-MODALITY DETECTION OF FINGERPRINT BENCHMARK
AlgorithmNaïve Bayes
Decision Tree
Boosted Naïve Bayes
Boosted Decision Tree
Multi-Layer Perceptron
Selective Fuzzy
Ensemble Learner

Fig. 4. Different feature selected values for Boosted Strong and Weak
Learner for fingerprint benchmark.

92.40796.41894.62897.27895.98998.485

Number of Features
20
20
20
20
20
Min: 2
Max: 14TABLE II
BIO-MODALITY DETECTION OF IRIS BENCHMARK
Algorithm

The learning is performed for a range of feature selectedenvironments ranging from 1-feature selection to all
20-feature selection. Fig. 4 and Fig. 5 shows the results for theselective ensemble strong boosted learner, Naïve Bayes andweak boosted learner, 1-level Boosted Decision Tree, indifferent feature selected environments for fingerprint and iris
benchmark respectively.

Average AccuracyNaïve Bayes
Decision Tree
Boosted Naïve Bayes
Boosted Decision Tree
Multi-Layer Perceptron
Selective Fuzzy
Ensemble Learner

Average Accuracy
92.40796.41889.39394.94981.5
99.495

Number of Features
20
20
20
20
20
Min: 2
Max: 2

As can be seen from the above two tables, the learning is
optimum for our proposed selective ensemble fuzzy learner interms of average accuracy metric. For fingerprint, this highperformance can be achieved by the lowest feature selection
using 2 features with a strong boosted learner, or the highest
feature selection using 14 features with a weak boosted
learner.
In this case, the highest number of features used is 14 which isstill lower than the total number of features that is used by the
Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 2018

other algorithms. Besides 5 features and 12 features with astrong boosted learner and 3,4 and 7 features with a weakboosted learner can also be used giving the same highest
accuracy of 98.485 percent. In our approach, since thenumber of features used will be less than the total number offeatures and the algorithm can alternate between a weak andmoderately strong learner, the overall overhead can besignificantly reduced in best cases with 2,3,4 and 5 features,moderate cases with 7 features and in worst cases with 12 or
14 features which is still lesser than the total number offeatures. For iris, the highest performance can be achieved by
the feature selection using 2 features with a strong boosted
learner. Since this feature selection alone provides the highest
performance, we do not need to consider other feature
selection and learner combos. As can be seen, in this case, astrong boosted learner outperforms a weak boosted learner.
And since we can alternate between the strong learner andweak learner we can utilize both the learners depending on thekind of learning environment.

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

The performance gain of this paper is credited to the factthat learning is flexible and able to move between amoderately strong and a weak learner. While the statement,
weak learners together can perform better than a strong
learner holds, it is also shown that strong learners working
together with weak learners can also gain promising
performance in desired feature selected values. Ensemble
learning is computationally expensive but, in our case, thefeature selected ensemble is helping to make the problem
space smaller and simpler. Thus, while the performance isimproving, the overall complexity is not rising significantly.

[11]

[12]

[13]

[14]

[15]

V. CONCLUSION
In this paper, we have proposed a selective ensemble fuzzylearner with Ada Boost and Feature Selection in order todetect bio-identifiable modality spoofing of fingerprint andiris benchmark that can be used for authentication in a
Medical Cyber Physical System. We have shown that our
proposed mechanism enhances the performance of the
traditional boosted learning algorithms. Our mechanism also
considers a selective ensemble learning approach to reduce
the overall computational overhead. In future work, we hope
to apply our proposed mechanism in other bio-identifiable
modality spoofing.

[16]

[17]

[18]

[19]

[20]

ACKNOWLEDGMENT
The work was supported by the National Research
Foundation of Korea (NRF) funded by the Korea government(MSIP)(2016R1A2B4015899).
KijoonChaeiscorresponding author
REFERENCES
[1]

[2]

D. Menotti, G. Chiachia, A. Pinto, W. R. Schwartz, H. P. A. X. Falcao,
and A. Rocha. "Deep representations for iris, face, and fingerprint
spoofing detection." IEEE Transactions on Information Forensics
and Security, vol. 10, no. 4, pp. 864-879, 2015.
M. Liang, and X. Hu. "Recurrent convolutional neural network for
object recognition." In Proceedings of the IEEE Conference on
Computer Vision and Pattern Recognition, pp. 3367-3375. 2015.

[21]

[22]

[23]

[24]

[25]

1157

J. Galbally, F. Alonso-Fernandez, J. Fierrez, and J. Ortega-Garcia,“Fingerprint liveness detection based on quality measures,” in Proc.
Int. Conf. Biometrics, Identity, Secur. (BIdS), pp. 1–8, 2009.
J. Galbally, F. Alonso-Fernandez, J. Fierrez, and J. Ortega-Garcia, “Ahigh performance fingerprint liveness detection method based on
quality related features,” Future Generat. Comput. Syst., vol. 28, no.
1, pp. 311–321, 2012.
L. Ghiani, G. L. Marcialis, and F. Roli, “Fingerprint liveness detection
by local phase quantization,” in Proc. 21st Int. Conf. Pattern
Recognit. (ICPR), Nov. 2012, pp. 537–540.
D. Gragnaniello, G. Poggi, C. Sansone, and L. Verdoliva,“Fingerprint liveness detection based on weber local image
descriptor,” in Proc. IEEE Workshop Biometric Meas. Syst. Secur.
Med. Appl., pp. 46–50, Sep. 2013.
X. Jia et al., “Multi-scale block local ternary patterns for fingerprints
vitality detection,” in Proc. IAPR Int. Conf. Biometrics (ICB), pp. 1–6,
2013.
L. Ghiani, A. Hadid, G. L. Marcialis, and F. Roli, “Fingerprint
liveness detection using binarized statistical image features,” in Proc.
IEEE Int. Conf. Biometrics, Theory, Appl., Syst. (BTAS), pp. 1–6,
Sep./Oct. 2013.
J. Kannala and E. Rahtu, “BSIF: Binarized statistical image features,”in Proc. 21st Int. Conf. Pattern Recognit. (ICPR), pp. 1363–1366,
Nov. 2012.
J. Daugman, “Recognizing persons by their iris patterns,” inBiometrics:Personal Identification in Networked Society, Boston,
MA, USA:Kluwer, pp. 103-121, 1999.
C. Lee, K. R. Park, and J. Kim, “Fake iris detection by using purkinje
image,” in Advances in Biometrics (Lecture Notes in Computer
Science), New York, NY, USA: Springer-Verlag, vol. 3832, pp.
397-403, 2005.
A. Pacut and A. Czajka, “Aliveness detection for iris biometrics,” inProc. 40th Annu. IEEE Int. Carnahan Conf. Secur. Technol., pp.
122-129, 2006.
M. Kanematsu, H. Takano, and K. Nakamura, “Highly reliable
liveness detection method for iris recognition,” in Proc. Annu. Conf.
SICE, pp. 361-364, 2007.
Z. Wei, X. Qiu, Z. Sun, and T. Tan, “Counterfeit iris detection basedon texture analysis,” in Proc. 19th Int. Conf. Pattern Recognit.
(ICPR), pp. 1-4, 2008.
K. W. Bowyer and J. S. Doyle, “Cosmetic contact lenses and irisrecognition spoofing,” in Computer, vol. 47, no. 5, pp. 96-98, 2014.
D. Yadav, N. Kohli, J. S. Doyle, R. Singh, M. Vatsa, and K. W.
Bowyer, “Unraveling the effect of textured contact lenses on irisrecognition,” in IEEE Transactions on Information Forensics andSecurity, vol. 9, no. 5, pp. 851-862, 2014.
N. Kohli, D. Yadav, M. Vatsa, and R. Singh, “Revisiting irisrecognition with color cosmetic contact lenses,” in Proc. IAPR Int.
Conf. Biometrics (ICB), pp. 1-7, 2013.
J. S. Doyle, K. W. Bowyer, and P. J. Flynn, “Variation in accuracy of
textured contact lens detection based on sensor and lens pattern,”inProc. IEEE 6th Int. Conf. Biometrics, Theory, Appl., Syst. (BTAS), pp.
1-7, 2013.
X. Huang, C. Ti, Q.-Z. Hou, A. Tokuta, and R. Yang, “Anexperimental study of pupil constriction for liveness detection,” inProc. IEEE Workshop Appl. Comput. Vis. (WACV), pp. 252-258,
2013.
T. Kathikeyan and B. Sabarigiri, “Countermeasures against IRIS
spoofing and liveness detection using Electroencephalogram (EEG),”in Proc. Int. Conf. Comput., Commun., Appl. (ICCA), pp. 1-5, 2012.
J. Galbally, J. Ortiz-Lopez, J. Fierrez, and J. Ortega-Garcia, “Irisliveness detection based on quality related features,” in Proc. IAPR
Int. Conf. Biometrics (ICB), pp. 271-276, 2012.
P. Pudil, J. Novovicova, and J. Kittler, “Floating search methods infeature selection,” in Pattern Recognit. Lett., vol. 15, no. 11, pp.
1119-1125, 1994.
A. F. Sequeira, J. Murari, and J. S. Cardoso, “Iris liveness detection
methods in mobile applications,” in Proc. Int. Conf. Comput. Vis.
Theory Appl. (VISAPP), pp. 22-33, 2014.
A. F. Sequeira, J. Murari, and J. S. Cardoso, “Iris liveness detection
methods in the mobile biometrics scenario,” in Proc. Int. Joint Conf.
Neural Netw. (IJCNN), pp. 3002-3008, 2014.
J. C. Monteiro, A. F. Sequeira, H. P. Oliveira, and J. S. Cardoso,“Robust iris localisation in challenging scenarios,” in Computer
Vision, Imaging and Computer Graphics: Theory and Applications(Communications in Computer and Information Science), Berlin,
Germany: Springer-Verlag, 2004.

Copyright ⓒ 2018 GiRI (Global IT Research Institute)

ICACT Transactions on Advanced Communications Technology (TACT) Vol. 7, Issue 5, September 20181158

[26] Z. Sun, H. Zhang, T. Tan, and J. Wang, “Iris image classification
based on hierarchical visual codebook,” in IEEE Trans. Pattern Anal.
Mach. Intell., vol. 36, no. 6, pp. 1120-1133, 2014.
[27] F. Smeraldi, M. Bicego, M. Cristani, and V. Murino. "CLOOSTING:
CLustering Data with bOOSTING." In MCS, pp. 289-298. 2011.
[28] L. Ghiani et al., “LivDet 2013—Fingerprint liveness detection
competition,” in Proc. Int. Conf. Biometrics (ICB), pp. 1–6, 2013.
[Online]. Available: http://prag.diee.unica.it/fldc/[29] A. Czajka, “Database of iris printouts and its application:
Development of liveness detection method for iris recognition,” inProc. 18th Int. Conf. Methods Models Autom. Robot. (MMAR), pp.
28-33, 2013.
[30] KNIME,
Knime
Analytics
Platform.
Availableathttps://www.knime.com/knime-analytics-platform[31] N. Mowla, I. Doh, K. Chae, “Selective fuzzy ensemble learner forcognitive detection of bio-identifiable modality spoofing in MCPS”,
in 20th International Conference on Advanced Communication
Technology (ICACT), pp. 63-37, 2018.

Nishat Mowla was born on 1st August, 1989. She
received the B.S degree in computer science from
Asian University for Women, Chittagong, Bangladesh
in 2013, an M.S. degree in computer science andengineering from Ewha Womans University, Seoul,
Korea in 2016.
She worked at Asian University for Women,
Chittagong, Bangladesh as a Senior Teaching Fellow.
She is currently a Ph.D. student at Ewha Womans
University, Seoul, Korea. Her research interests
include next generation network security, IoT network security andnetwork traffic analysis.
Ms. Mowla received the best thesis award for her Master’s thesis in
2016. She was awarded the best paper award in the Qualcomm 2017 paper
competition. She also received the outstanding paper award in the 19thInternational Conference on Advanced Communication Technology(ICACT) in 2017.

Inshil Doh was born on 3rd March, 1970. She received
the B.S. and M.S. degrees in computer science andengineering at Ewha Womans University, Korea, in
1993 and 1995, respectively. She received the Ph.D.
degree in computer science and engineering from
Ewha Womans University in 2007.
She was a research professor of Ewha Womans
University in 2009~2010 and of Sungkyunkwan
University in 2011. She is currently an assistantprofessor of Computer Science and Engineering at
Ewha Womans University, Seoul, Korea. Her research interests include
wireless network, sensor network security, and M2M network security.
From 1995-1998, Prof. Doh worked in Samsung SDS of Korea to develop
a marketing system. Prof. Doh received best paper award in Korea
information Processing Society in 2009. Prof. Doh also received best paper
award in Korea Institute of Information and Communication Engineering
Conference in 2015.
Prof. Chae was born on 22nd October, 1957. Hereceived the B.S. degree in mathematics from Yonsei
University in 1982, an M.S. degree in computer sciencefrom Syracuse University in 1984. He received a Ph.D.
degree in electrical and computer engineering from
North Carolina State University in 1990.
He is currently a professor in the Department ofComputer Science and Engineering at Ewha Womans
University, Seoul, Korea. His research interests include
sensor network, smart grid, CDN, SDN and IoT, network protocol design andperformance evaluation.
Prof. Chae was the advisory board member of ACM Transactions on
Internet Technology from 2000 to 2004. He was also a member of theInternational Who’s Who from 2001 to 2010.

Copyright ⓒ 2018 GiRI (Global IT Research Institute)