Anomaly Detection Using Data Mining Methods in IT Systems: A Decision Support Application
Künye
SÖNMEZ F, ZONTUL M, KAYNAR O, TUTAR H (2018). Anomaly Detection Using Data Mining Methods in IT Systems: A Decision Support Application. Sakarya Üniversitesi Fen Bilimleri Enstitüsü Dergisi, 22(4), 1109 - 1123. 10.16984/saufenbilder.365931Özet
Although there are various studies on anomaly detection, effective and simple anomaly detection
approaches are necessary as the inadequacy of appropriate ways for substantial network environments. In
the existing analysis methods, it is seen that the methods of preliminary analysis are generally used, the
extrapolations and probabilities are not taken into account and the unsupervised neural network (NN)
methods are not used enough. As an alternative, the use of the Self-Organizing Maps has been preferred in
the study. In other studies, analysis of data obtained from network traffic is analyzed, here, analysis of other
information systems data and suggestions for alternative solutions are given, too. In addition, in-memory
database systems have been used in practice in order to enable faster processing in analysis studies, due to
the large size of data to be analyzed in large-scale network environments. An analysis of the application
log data obtained from the management tools in the information systems was carried out. After anomaly
detection results obtained and the verification test results are compared, it is found out that anomaly
detection process is successful by 96%. The advantage offered for the company and users at IT and security
monitoring processes is to eliminate the need for pre-qualification and to reduce the heavy workload. By
this way, it is thought that a significant cost item is eliminated. It is also contemplated that the security
vulnerabilities and problems associated with unpredictable issues will be detected through practice and thus
many attacks and problems will be prevented in advance.