Seurat: A Pointillist Approach to Anomaly Detection

摘要: This paper proposes a new approach to detecting aggregated anomalous events by correlating host file system changes across space and time. Our is based on key observation that many state transitions of interest have both temporal spatial locality. Abnormal changes, which may be hard detect in isolation, become apparent when they are correlated with similar other hosts. Based this intuition, we developed method similar, coincident the patterns updates shared multiple We implemented prototype called Seurat demonstrated its effectiveness using combination real workstation cluster traces, simulated attacks, manually launched Linux worm.