Learning Rules for Anomaly Detection

Google Tech Talks August 10, 2007 ABSTRACT Anomaly detection has the potential to detect novel attacks, however, keeping the false alarm rate low is a challenging task. We discuss the LERAD algorithm that can learn concise and accurate rules for anomaly detection and demonstrate its effectiveness in network and host datasets. We will also discuss our recent work (KDD 07) on weighting versus pruning during the rule validation. If there is more time, I can also talk about: As mobile devices become more pervasive, we study the problem of spatial-temporal anomaly detection for identifying potential abuse. We discuss the STAD algorithm and show its performance on a cell phone dataset. Credits:...