A formal framework for positive and negative detection schemes
A formal framework for positive and negative detection schemes
复制标题
DOI：
10.1109/tsmcb.2003.817026
复制
发表时间：
2004-02-01
影响因子：
--
通讯作者：
Helman, P
中科院分区：
文献类型：
--
作者：
Esponda, F;Forrest, S;Helman, P
在异常检测中，过程的正常行为由模型来表征，与模型的偏差称为异常。在基于行为的异常检测方法中，正常行为的模型是从正常发生模式的观察样本中构建的。正常行为的模型可以表示允许模式的集合（正检测）或异常模式的集合（负检测）。给出了一个正式的框架，用于分析积极和消极的检测方案之间的权衡，需要最大限度地提高覆盖率的检测器的数量。对于实际规模的问题，可能模式的范围太大，无法精确表示（无论是正面还是负面方案）。部分匹配规则概括了允许（或不允许）模式的集合，并且匹配规则的选择影响正检测和负检测之间的权衡。引入了一种新的匹配规则，称为r-块，不同的部分匹配规则诱导的泛化的交叉闭包的特点。可以使用表示的排列来实现正常和异常模式之间的更精确的区分。给出了连续位匹配与排列相结合的识别能力的定量结果。
In anomaly detection, the normal behavior of a process is characterized by a model, and deviations from the model are called anomalies. In behavior-based approaches to anomaly detection, the model of normal behavior is constructed from an observed sample of normally occurring patterns. Models of normal behavior can represent either the set of allowed patterns (positive detection) or the set of anomalous patterns (negative detection). A formal framework is given for analyzing the tradeoffs between positive and negative detection schemes in terms of the number of detectors needed to maximize coverage. For realistically sized problems, the universe of possible patterns is too large to represent exactly (in either the positive or negative scheme). Partial matching rules generalize the set of allowable (or unallowable) patterns, and the choice of matching rule affects the tradeoff between positive and negative detection. A new match rule is introduced, called r-chunks, and the generalizations induced by different partial matching rules are characterized in terms of the crossover closure. Permutations of the representation can be used to achieve more precise discrimination between normal and anomalous patterns. Quantitative results are given for the recognition ability of contiguous-bits matching together with permutations.