Temporal sequence learning and data reduction for anomaly detection

摘要: The anomaly-detection problem can be formulated as one of learning to characterize the behaviors an individual, system, or network in terms temporal sequences discrete data. We present approach on basis instance-based (IBL) techniques. To cast task IBL framework, we employ that transforms discrete, unordered observations into a metric space via similarity measure encodes intra-attribute dependencies. Classification boundaries are selected from posteriori characterization valid user behaviors, coupled with domain heuristic. An empirical evaluation command data demonstrates accurately differentiate profiled alternative users when available features encode sufficient information. Furthermore, demonstrate system detects anomalous conditions quickly — important quality for reducing potential damage by malicious user. several techniques storage requirements profile, including instance-selection methods and clustering. shows new greedy clustering algorithm reduces size model 70%, only small loss accuracy.