ONE OF THESE THINGS IS NOT LIKE THE OTHERS: THE STATE OF ANOMALY DETECTION
Anomaly detection can be described as an alarm for strange system behavior. The concept stems from a paper fundamental to the field of security – An Intrusion Detection Model, by Dorothy Denning. In it, she describes building an “activity profile” of normal usage over an interval of time. Once in place, the profile is compared against real time events. Anything that deviates from the baseline, or the norm, is logged as anomalous. Full Story
