动态网络中的鲁棒异常检测
Robust Anomaly Detection in Dynamic Networks
摘要：
我们提出了两个强大的方法，在动态网络中的正常流量的属性是时变的异常检测。我们制定了强大的异常检测问题作为一个二元复合假设检验问题，并提出了两种方法：无模型和基于模型的一个，利用大偏差理论的技术。这两种方法都需要一个家庭的概率定律（PL），代表正常的业务属性。我们设计了一个两步的程序来估计这个家庭的PL。我们比较我们的强大的方法和他们的香草同行，它假设正常的流量是固定的，在一个网络上的一个昼夜正常的模式和一个共同的异常相关的数据泄漏的性能。仿真结果表明，我们的鲁棒方法在动态网络中的性能优于他们的香草同行。
英文摘要：
We propose two robust methods for anomaly detection in dynamic networks in which the properties of normal traffic are time-varying. We formulate the robust anomaly detection problem as a binary composite hypothesis testing problem and propose two methods: a model-free and a model-based one, leveraging techniques from the theory of large deviations. Both methods require a family of Probability Laws (PLs) that represent normal properties of traffic. We devise a two-step procedure to estimate this family of PLs. We compare the performance of our robust methods and their vanilla counterparts, which assume that normal traffic is stationary, on a network with a diurnal normal pattern and a common anomaly related to data exfiltration. Simulation results show that our robust methods perform better than their vanilla counterparts in dynamic networks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
