{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,17]],"date-time":"2026-04-17T16:28:24Z","timestamp":1776443304748,"version":"3.51.2"},"reference-count":44,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2022,9,29]],"date-time":"2022-09-29T00:00:00Z","timestamp":1664409600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2022,9,29]],"date-time":"2022-09-29T00:00:00Z","timestamp":1664409600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Cloud Comp"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>With the development of cloud computing, more and more security problems like \u201cfuzzy boundary\u201d are exposed. To solve such problems, unsupervised anomaly detection is increasingly used in cloud security, where density estimation is commonly used in anomaly detection clustering tasks. However, in practical use, the excessive amount of data and high dimensionality of data features can lead to difficulties in data calibration, data redundancy, and reduced effectiveness of density estimation algorithms. Although auto-encoders have made fruitful progress in data dimensionality reduction, using auto-encoders alone may still cause the model to be too generalized and unable to detect specific anomalies. In this paper, a new unsupervised anomaly detection method, MemAe-gmm-ma, is proposed. MemAe-gmm-ma generates a low-dimensional representation and reconstruction error for each input sample by a deep auto-encoder. It adds a memory module inside the auto-encoder to better learn the inner meaning of the training samples, and finally puts the low-dimensional information of the samples into a Gaussian mixture model (GMM) for density estimation. MemAe-gmm-ma demonstrates better performance on the public benchmark dataset, with a 4.47% improvement over the MemAe model standard F1 score on the NSL-KDD dataset, and a 9.77% improvement over the CAE-GMM model standard F1 score on the CIC-IDS-2017 dataset.<\/jats:p>","DOI":"10.1186\/s13677-022-00328-z","type":"journal-article","created":{"date-parts":[[2022,9,29]],"date-time":"2022-09-29T05:02:34Z","timestamp":1664427754000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":12,"title":["Research on unsupervised anomaly data detection method based on improved automatic encoder and Gaussian mixture model"],"prefix":"10.1186","volume":"11","author":[{"given":"Xiangyu","family":"Liu","sequence":"first","affiliation":[]},{"given":"Shibing","family":"Zhu","sequence":"additional","affiliation":[]},{"given":"Fan","family":"Yang","sequence":"additional","affiliation":[]},{"given":"Shengjun","family":"Liang","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2022,9,29]]},"reference":[{"key":"328_CR1","doi-asserted-by":"crossref","unstructured":"Sengupta S, Kaulgud V, Sharma VS (2011) Cloud computing security--trends and research directions. In: 2011 IEEE World Congress on Services. IEEE, Washington, DC","DOI":"10.1109\/SERVICES.2011.20"},{"key":"328_CR2","doi-asserted-by":"publisher","first-page":"72650","DOI":"10.1109\/ACCESS.2020.2988160","volume":"8","author":"C Iwendi","year":"2020","unstructured":"Iwendi C et al (2020) KeySplitWatermark: zero watermarking algorithm for software protection against cyber-attacks. IEEE Access 8:72650\u201372660. https:\/\/doi.org\/10.1109\/ACCESS.2020.2988160","journal-title":"IEEE Access"},{"issue":"1","key":"328_CR3","doi-asserted-by":"publisher","first-page":"9","DOI":"10.7906\/indecs.13.1.2","volume":"13","author":"ES Rub\u00f3czki","year":"2015","unstructured":"Rub\u00f3czki ES, Rajnai Z (2015) Moving towards cloud security. Interdiscip Description Complex Syst 13(1):9\u201314","journal-title":"Interdiscip Description Complex Syst"},{"key":"328_CR4","doi-asserted-by":"publisher","first-page":"42","DOI":"10.1109\/CSCloud-EdgeCom52276.2021.00018","volume-title":"2021 8th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud)\/2021 7th IEEE International Conference on Edge Computing and Scalable Cloud (EdgeCom)","author":"T Eltaeib","year":"2021","unstructured":"Eltaeib T, Islam N (2021) Taxonomy of challenges in cloud security. In: 2021 8th IEEE International Conference on Cyber Security and Cloud Computing (CSCloud)\/2021 7th IEEE International Conference on Edge Computing and Scalable Cloud (EdgeCom), pp 42\u201346. https:\/\/doi.org\/10.1109\/CSCloud-EdgeCom52276.2021.00018"},{"issue":"10","key":"328_CR5","first-page":"17","volume":"21","author":"L Zheng","year":"2021","unstructured":"Zheng L, Zhang J (2021) Threats and future development trends to the cloud security. Netinfo Secur 21(10):17\u201324","journal-title":"Netinfo Secur"},{"issue":"2","key":"328_CR6","first-page":"110","volume":"8","author":"Z Peng","year":"2022","unstructured":"Peng Z, Xing G, Chen X (2022) A review of the applications and technologies of artificial intelligence in the field of cyber security. Inf Secur Res 8(2):110\u2013116","journal-title":"Inf Secur Res"},{"issue":"5","key":"328_CR7","doi-asserted-by":"publisher","first-page":"363","DOI":"10.1002\/sam.11161","volume":"5","author":"A Zimek","year":"2012","unstructured":"Zimek A, Schubert E, Kriegel H-P (2012) A survey on unsupervised outlier detection in high-dimensional numerical data. Stat Anal Data Min 5(5):363\u2013387","journal-title":"Stat Anal Data Min"},{"key":"328_CR8","first-page":"3861","volume-title":"Proceedings of the 34th international conference on machine learning","author":"B Yang","year":"2017","unstructured":"Yang B, Fu X, Sidiropoulos ND et al (2017) Towards K-means-friendly spaces: simultaneous deep learning and clustering. In: Proceedings of the 34th international conference on machine learning, pp 3861\u20133870"},{"key":"328_CR9","first-page":"153","volume-title":"Advances in neural information processing systems","author":"Y Bengio","year":"2007","unstructured":"Bengio Y, Lamblin P, Popovici D, Larochelle H (2007) Greedy layer-wise training of deep networks. In: Advances in neural information processing systems, pp 153\u2013160"},{"key":"328_CR10","volume-title":"International conference on learning representations (ICLR)","author":"DP Kingma","year":"2014","unstructured":"Kingma DP, Welling M (2014) Auto-encoding variational bayes. In: International conference on learning representations (ICLR)"},{"issue":"18","key":"328_CR11","first-page":"25","volume":"16","author":"M Liu","year":"2019","unstructured":"Liu M, Chen W, Liu G (2019) A research on network traffic anomaly detection model based on K-means algorithm. Wirel Interconnect Technol 16(18):25\u201327","journal-title":"Wirel Interconnect Technol"},{"issue":"02","key":"328_CR12","first-page":"64","volume":"52","author":"B Xie","year":"2020","unstructured":"Xie B, Dong X, Liang H (2020) Intrusion detection algorithm based on three-branch dynamic threshold K-means clustering. J Zhengzhou Univ Sci Ed 52(02):64\u201370","journal-title":"J Zhengzhou Univ Sci Ed"},{"key":"328_CR13","first-page":"1071","volume-title":"Advances in neural information processing systems","author":"L Xiong","year":"2011","unstructured":"Xiong L, P\u00f3czos B, Schneider J (2011) Group anomaly detection using flexible genre models. In: Advances in neural information processing systems, pp 1071\u20131079"},{"key":"328_CR14","doi-asserted-by":"publisher","unstructured":"Wang J, Jiang J (2021) Unsupervised deep clustering via adaptive GMM modeling and optimization,\nNeurocomputing 433:199-211. https:\/\/doi.org\/10.1016\/j.neucom.2020.12.082.","DOI":"10.1016\/j.neucom.2020.12.082"},{"key":"328_CR15","first-page":"84","volume-title":"International conference on neural information processing","author":"X Yang","year":"2014","unstructured":"Yang X, Huang K, Zhang R (2014) Unsupervised dimensionality reduction for gaussian mixture model. In: Loo CK, Yap KS, Wong KW, Teoh A, Huang K (eds) Neural information processing. ICONIP 2014. Springer, Cham, pp 84-92."},{"issue":"02","key":"328_CR16","first-page":"121","volume":"48","author":"C-M Zou","year":"2021","unstructured":"Zou C-M, Chen D (2021) Unsupervised anomaly detection method for high-dimensional big data analysis. Comput Sci 48(02):121\u2013127","journal-title":"Comput Sci"},{"issue":"5","key":"328_CR17","first-page":"178","volume":"41","author":"Z Chen","year":"2014","unstructured":"Chen Z, Huang Y, Zou H (2014) Anomaly detection of industrial control system based on outlier mining. Comput Sci 41(5):178\u2013181","journal-title":"Comput Sci"},{"issue":"z11","key":"328_CR18","first-page":"24","volume":"44","author":"JF Wu","year":"2017","unstructured":"Wu JF, Jin YD, Tang P (2017) Survey on monitoring techniques for data abnormalities. Comput Sci 44(z11):24\u201328","journal-title":"Comput Sci"},{"key":"328_CR19","doi-asserted-by":"publisher","first-page":"1094","DOI":"10.1007\/978-3-642-04898-2_455","volume-title":"International encyclopedia of statistical science","author":"I Jolliffe","year":"2011","unstructured":"Jolliffe I (2011) Principal component analysis. In: Lovric M (ed) International encyclopedia of statistical science, vol 28243034. Springer, Cham, pp 1094\u20131096."},{"key":"328_CR20","volume-title":"The IEEE conference on computer vision and pattern recognition (CVPR)","author":"J Kim","year":"2009","unstructured":"Kim J, Grauman K (2009) Observing locally, infer globally: a space-time mrf for detecting abnormal activities with incremental updates. In: The IEEE conference on computer vision and pattern recognition (CVPR)"},{"issue":"03","key":"328_CR21","first-page":"140","volume":"35","author":"JH Zeng","year":"2018","unstructured":"Zeng JH (2018) A kernel PCA-based algorithm for network traffic anomaly detection. Comput Appl Softw 35(03):140\u2013144","journal-title":"Comput Appl Softw"},{"key":"328_CR22","doi-asserted-by":"publisher","first-page":"49","DOI":"10.1109\/BigDataSecurity-HPSC-IDS.2016.79","volume-title":"2016 IEEE 2nd International Conference on Big Data Security on Cloud (BigDataSecurity), IEEE International Conference on High Performance and Smart Computing (HPSC), and IEEE International Conference on Intelligent Data and Security (IDS)","author":"K Veeramachaneni","year":"2016","unstructured":"Veeramachaneni K, Arnaldo I, Korrapati V, Bassias C, Li K (2016) AI^2 : training a big data machine to defend. In: 2016 IEEE 2nd International Conference on Big Data Security on Cloud (BigDataSecurity), IEEE International Conference on High Performance and Smart Computing (HPSC), and IEEE International Conference on Intelligent Data and Security (IDS), pp 49\u201354"},{"key":"328_CR23","unstructured":"Shyu ML, Chen SC, Sarinnapakorn K, Chang L (2003) A novel anomaly detection scheme based on principal component classifier. In: IEEE Foundations and New Directions of Data Mining Workshop, in conjunction with the Third IEEE International Conference on Data Mining (ICDM\u201903), IEEE, Melbourne, FL."},{"key":"328_CR24","doi-asserted-by":"publisher","first-page":"381","DOI":"10.23919\/ICACT.2018.8323766","volume-title":"2018 20th international conference on advanced communication technology (ICACT)","author":"DH Hoang","year":"2018","unstructured":"Hoang DH, Nguyen HD (2018) A PCA-based method for IoT network traffic anomaly detection. In: 2018 20th international conference on advanced communication technology (ICACT), pp 381\u2013386. https:\/\/doi.org\/10.23919\/ICACT.2018.8323766"},{"key":"328_CR25","first-page":"1100","volume-title":"International conference on machine learning (ICML)","author":"S Zhai","year":"2016","unstructured":"Zhai S, Cheng Y, Lu W, Zhang Z (2016) Deep structured energy based models for anomaly detection. In: International conference on machine learning (ICML), pp 1100\u20131109"},{"key":"328_CR26","doi-asserted-by":"crossref","unstructured":"Zhou C, Paffenroth RC (2017) Anomaly Detection with Robust Deep Autoencoders. In: Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Association for Computing Machinery, Halifax, NS.","DOI":"10.1145\/3097983.3098052"},{"key":"328_CR27","doi-asserted-by":"crossref","unstructured":"Zhao Y, Deng B, Shen C, Liu Y, Lu H, Hua X-S (2017) Spatio-temporal autoencoder for video anomaly detection. In: Proceedings of the 25th ACM international conference on Multimedia, Association for Computing Machinery, Mountain View, CA.","DOI":"10.1145\/3123266.3123451"},{"key":"328_CR28","first-page":"2720","volume-title":"The IEEE international conference on computer vision (ICCV)","author":"C Lu","year":"2013","unstructured":"Lu C, Shi J, Jia J (2013) Abnormal event detection at 150 fps in matlab. In: The IEEE international conference on computer vision (ICCV), pp 2720\u20132727"},{"key":"328_CR29","first-page":"34","volume-title":"International conference on image processing","author":"Y Chen","year":"2001","unstructured":"Chen Y, Zhou XS, Huang TS (2001) One-class svm for learning in image retrieval. In: International conference on image processing, vol 1, pp 34\u201337"},{"key":"328_CR30","first-page":"709","volume-title":"Proceedings ofICDM02","author":"G Williams","year":"2002","unstructured":"Williams G, Baxter R, He H, Hawkins S (2002) A comparative study of RNN for outlier detection in data mining. In: Proceedings ofICDM02, pp 709\u2013712"},{"key":"328_CR31","doi-asserted-by":"publisher","first-page":"440","DOI":"10.1109\/TSMCC.2002.807277","volume":"32","author":"Q Song","year":"2002","unstructured":"Song Q, Hu WJ, Xie WF (2002) Robust support vector machine with bullet hole image classification. IEEE Trans Syst Man Cybern 32:440\u2013448","journal-title":"IEEE Trans Syst Man Cybern"},{"key":"328_CR32","first-page":"89","volume-title":"Interspeech","author":"M Paulik","year":"2013","unstructured":"Paulik M (2013) Lattice-based training of bottleneck feature extraction neural networks. In: Interspeech, pp 89\u201393"},{"key":"328_CR33","first-page":"4270","volume-title":"ICASSP","author":"E Variani","year":"2015","unstructured":"Variani E, McDermott E, Heigold G (2015) A gaussian mixture model layer jointly optimized with discriminative features within a deep neural network architecture. In: ICASSP, pp 4270\u20134274"},{"key":"328_CR34","first-page":"5015","volume-title":"ICASSP","author":"C Zhang","year":"2017","unstructured":"Zhang C, Woodland PC (2017) Joint optimisation of tandem systems using gaussian mixture density neural network discriminative sequence training. In: ICASSP, pp 5015\u20135019"},{"key":"328_CR35","volume-title":"International conference on learning representations","author":"B Zong","year":"2018","unstructured":"Zong B, Song Q, Min MR et al (2018) Deep autoencoding Gaussian mixture model for un-supervised anomaly detection. In: International conference on learning representations"},{"issue":"08","key":"328_CR36","first-page":"40","volume":"11","author":"N Hu","year":"2020","unstructured":"Hu N, Fang LT, Qin CY (2020) An unsupervised intrusion detection method based on random forest and deep self-coding Gaussian mixture model. Cyberspace Secur 11(08):40\u201344+50","journal-title":"Cyberspace Secur"},{"key":"328_CR37","volume-title":"International conference on machine learning (ICML)","author":"A Santoro","year":"2016","unstructured":"Santoro A, Bartunov S, Botvinick M, Wierstra D, Lillicrap T (2016) One-shot learning with memory-augmented neural networks. In: International conference on machine learning (ICML)"},{"key":"328_CR38","volume-title":"Neural turing machines. arXiv preprint arXiv:1410.5401","author":"A Graves","year":"2014","unstructured":"Graves A, Wayne G, Danihelka I (2014) Neural turing machines. arXiv preprint arXiv:1410.5401"},{"key":"328_CR39","volume-title":"International conference on learning representations (ICLR)","author":"J Weston","year":"2015","unstructured":"Weston J, Chopra S, Bordes A (2015) Memory networks. In: International conference on learning representations (ICLR)"},{"key":"328_CR40","first-page":"1705","volume-title":"Proceedings of the IEEE international conference on computer vision","author":"D Gong","year":"2019","unstructured":"Gong D, Liu L, Le V et al (2019) Memorizing normality to detect anomaly: memory-augmented deep autoencoder for unsupervised anomaly detection. In: Proceedings of the IEEE international conference on computer vision, pp 1705\u20131714"},{"key":"328_CR41","doi-asserted-by":"publisher","first-page":"296","DOI":"10.1016\/j.eswa.2016.09.041","volume":"67","author":"WL Al-Yaseen","year":"2017","unstructured":"Al-Yaseen WL, Othman ZA, Nazri MZA (2017) Multi-level hybrid support vector machine and extreme learning machine based on modified k-means for intrusion detection system. Expert Syst Appl 67:296\u2013303","journal-title":"Expert Syst Appl"},{"key":"328_CR42","doi-asserted-by":"crossref","unstructured":"Liu FT, Ting KM, Zhou ZH (2008) Isolation forest. In: 2008 Eighth IEEE International Conference on Data Mining, IEEE, Pisa.","DOI":"10.1109\/ICDM.2008.17"},{"key":"328_CR43","doi-asserted-by":"publisher","unstructured":"Choi, H, Kim, M, Lee, G et al (2019) Unsupervised learning approach for network intrusion detection system using autoencoders. J Supercomput 75, 5597\u20135621. https:\/\/doi.org\/10.1007\/s11227-019-02805-w.","DOI":"10.1007\/s11227-019-02805-w"},{"key":"328_CR44","unstructured":"Tang C (2021) Research on network traffic anomaly detection based on unsupervised learning. Dissertation, Southwest University of Science and Technology, Chongqing."}],"container-title":["Journal of Cloud Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13677-022-00328-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s13677-022-00328-z\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13677-022-00328-z.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,9,30]],"date-time":"2022-09-30T21:02:55Z","timestamp":1664571775000},"score":1,"resource":{"primary":{"URL":"https:\/\/journalofcloudcomputing.springeropen.com\/articles\/10.1186\/s13677-022-00328-z"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,9,29]]},"references-count":44,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2022,12]]}},"alternative-id":["328"],"URL":"https:\/\/doi.org\/10.1186\/s13677-022-00328-z","relation":{},"ISSN":["2192-113X"],"issn-type":[{"value":"2192-113X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,9,29]]},"assertion":[{"value":"15 August 2022","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"13 September 2022","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"29 September 2022","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"58"}}