Anomaly detection (Computer security)
Enlarge text Shrink text-
Topic
-
Save successfulThe item can be found in your Personal ZoneשגיאהLog in to your account to save
Information for Authority record
Other Identifiers
- Work cat.: Nassehi, M.M. Anomaly detection for Markov models, 1998:p. 1 (Anomaly detection is an intrusion-detection technique in which any significant deviation of the current characteristics of a process from its expected characteristics generates an alarm)
- McGraw-Hill dictionary of scientific and technical terms, 2003(anomaly detection -- The technology that seeks to identify an attack on a computer system by looking for behavior that is out of the norm)
- TechEncyclopedia, via WWW, Nov. 17, 2005(Anomaly detection ... An approach to intrusion detection that establishes a baseline model of behavior for users and components in a computer system or network. Deviations from the baseline cause alerts that direct the attention of human operators to the anomalies)
- Glossary of web application security terms, via WWW, Nov. 17, 2005(Anomaly detection -- Behavior-based anomaly detection compares a profile of all allowed application behavior to actual traffic. Any deviation from the profile is flagged as a potential attack. It is commonly referred to as a positive security model because it seeks only to identify all known good behaviors and assumes that everything else is bad)
- Information Systems Audit and Control Association glossary, via WWW, Nov. 17, 2005(Anomaly detection -- Detection on the basis of whether the system activity matched that defined as abnormal)
Wikipedia description:
In data analysis, anomaly detection (also referred to as outlier detection and sometimes as novelty detection) is generally understood to be the identification of rare items, events or observations which deviate significantly from the majority of the data and do not conform to a well defined notion of normal behavior. Such examples may arouse suspicions of being generated by a different mechanism, or appear inconsistent with the remainder of that set of data. Anomaly detection finds application in many domains including cybersecurity, medicine, machine vision, statistics, neuroscience, law enforcement and financial fraud to name only a few. Anomalies were initially searched for clear rejection or omission from the data to aid statistical analysis, for example to compute the mean or standard deviation. They were also removed to better predictions from models such as linear regression, and more recently their removal aids the performance of machine learning algorithms. However, in many applications anomalies themselves are of interest and are the observations most desirous in the entire data set, which need to be identified and separated from noise or irrelevant outliers. Three broad categories of anomaly detection techniques exist: Supervised anomaly detection techniques require a data set that has been labeled as "normal" and "abnormal" and involves training a classifier. However, this approach is rarely used in anomaly detection due to the general unavailability of labelled data and the inherent unbalanced nature of the classes. Semi-supervised anomaly detection techniques assume that some portion of the data is labelled. This may be any combination of the normal or anomalous data, but more often than not, the techniques construct a model representing normal behavior from a given normal training data set, and then test the likelihood of a test instance to be generated by the model. Unsupervised anomaly detection techniques assume the data is unlabelled and are by far the most commonly used due to their wider and relevant application.
Read more on Wikipedia >