|
|
Papers on Anonomaly Detection
- Computer Immunology
Proceedings of the Twelfth Systems Administration Conference
(LISA XII) (USENIX Association: Berkeley, CA), page 283, 1998
Present day computer systems are fragile and unreliable. Human
beings are involved in the care and repair of computer systems at
every stage in their operation. This level of human involvement will
be impossible to maintain in future. Biological and social systems of
comparable and greater complexity have self-healing processes which
are crucial to their survival. It will be necessary to mimic such
systems if our future computer systems are to prosper in a complex and
hostile environment. This paper describes strategies for future
research and summarizes concrete measures for the present, building
upon existing software systems.
- Measuring Host Normality
ACM Transactions on Computing Systems, 20, p-125-160 (2001)
A comparative analysis of transaction time-series is made, for light
to moderately loaded hosts, motivated by the problem of anomaly
detection in computers. Criteria for measuring the statistical state
of hosts are examined. Applying a scaling transformation to the
measured data, it is found that the distribution of fluctuations about
the mean is closely approximated by a steady-state, maximum-entropy
distribution, modulated by a periodic variation. The shape of the
distribution, under these conditions, depends on the dimensionless
ratio of the daily/weekly periodicity and the correlation length of
the data. These values are persistent or even invariant. We
investigate the limits of these conclusions, and how they
might be applied in anomaly detection.
- Two dimensional time-series for anomaly detection and regulation in adaptive systems
Lecture Notes in Computer Science, 2506, p.169 (2002)
A two dimensional time approach is introduced in order to classify a
periodic, adaptive threshold for service level anomaly detection. An
iterative algorithm is applied to history analysis on this periodic
time to provide a the smooth roll-off in the significance of the data
with time. The algorithm described leads to an approximately ten-fold
compression in data storage, and thousand fold improvement in
computation cycles, compared to a naive time-series approach. The
behaviour of this anomaly detector is discussed, and the result is
implemented in cfengine for direct use in system management.
- Principle components and importance ranking of distributed anomalies
Machine Learning, 58, p.217-230 (2004)
Correlations between locally averaged host observations, at
different times and places, hint at information about the associations
between the hosts in a network. These smoothed, pseudo-continuous
time-series imply relationships with entities in the wider
environment. For anomaly detection, mining this information might
provide a valuable source of observational experience for determining
comparative anomalies or rejecting false anomalies. The difficulties
with distributed analysis lie in collating the distributed data and in
comparing observables on different hosts, in different frames of
reference. In the present work, we examine two methods (Principle
Component Analysis and Eigenvector Centrality) that shed light on the
usefulness of comparing data destined for different locations in a
network.
- Probabilistic anomaly detection in distributed computer networks
Science of Computer Programing 60, p. 1-26 (2006)
Distributed host-based anomaly detection has not yet proven
practical due to the excessive computational overhead during training
and detection. This paper considers an efficient algorithm for
detecting resource anomalies in event streams with either Poisson or
long tailed arrival processes. A form of distributed, lazy evaluation
is presented, which uses a model for human–computer interaction based
on two-dimensional time and a geometrically declining memory to yield
orders of magnitude improvements in memory requirements. A
three-tiered probabilistic method of classifying anomalous behaviour
is discussed. This leads to a computationally and memory economic
means of finding probable faults amongst the symptoms of network and
system behaviour.
|
| |
|
