异常检测器的检测延迟：一个被忽视的视角？
Detection Latencies of Anomaly Detectors: An Overlooked Perspective ?
AI总结：
本文提出评估异常检测器时需考虑检测延迟，通过工业案例验证延迟与误报率的关系，为配置检测器提供指导。
摘要：
随着攻击的不断发展和ICT系统的复杂性增加，构建基于异常的入侵检测器（ID）和错误检测器（ED）变得困难：它们必须准确检测攻击，并且迅速执行检测。尽管大多数研究关注提高和比较检测能力，但检测的及时性往往被忽视且评估不足。本文论证了测量攻击和错误的时间延迟的相关性，并提出了一种评估方法，以确保正确检测和及时检测之间的务实平衡。简而言之，该方法将误报率与攻击和错误的时间延迟相关联，最终导致配置检测器的指南。我们通过评估不同ED和ID解决方案在两个工业案例中的表现，即优化公共交通的嵌入式铁路车载系统和工业互联网的边缘设备，应用了我们的方法。结果表明，除了传统指标如误报率、精度和覆盖率外，考虑延迟能提供对检测器实际性能的额外基本视角，应在评估和配置异常检测器时予以考虑。
英文摘要：
The ever-evolving landscape of attacks, coupled with the growing complexity of ICT systems, makes crafting anomaly-based intrusion detectors (ID) and error detectors (ED) a difficult task: they must accurately detect attacks, and they should promptly perform detections. Although improving and comparing the detection capability is the focus of most research works, the timeliness of the detection is less considered and often insufficiently evaluated or discussed. In this paper, we argue the relevance of measuring the temporal latency of attacks and errors, and we propose an evaluation approach for detectors to ensure a pragmatic trade-off between correct and in-time detection. Briefly, the approach relates the false positive rate with the temporal latency of attacks and errors, and this ultimately leads to guidelines for configuring a detector. We apply our approach by evaluating different ED and ID solutions in two industrial cases: i) an embedded railway on-board system that optimizes public mobility, and ii) an edge device for the Industrial Internet of Things. Our results show that considering latency in addition to traditional metrics like the false positive rate, precision, and coverage gives an additional fundamental perspective on the actual performance of the detector and should be considered when assessing and configuring anomaly detectors.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
