On the Inefficient Use of Entropy for Anomaly Detection

摘要: Entropy-based measures have been widely deployed in anomaly detection systems (ADSes) to quantify behavioral patterns. The entropy measure has shown significant promise detecting diverse set of anomalies present networks and end-hosts. We argue that the full potential entropy-based is currently not being exploited because its inefficient use. In support this argument, we highlight three important shortcomings existing ADSes. then propose efficient usage --- supported by preliminary evaluations mitigate these shortcomings.