Challenges for Anomaly Detection in Large-Scale Cyber-Physical Systems
Challenges for Anomaly Detection in Large-Scale Cyber-Physical Systems
复制标题
大规模信息物理系统中异常检测的挑战
DOI：
10.1162/99608f92.7b8b6a89
复制
发表时间：
2023
期刊：
影响因子：
--
通讯作者：
Michailidis, George
中科院分区：
文献类型：
--
作者：
Michailidis, George
作者的英雄等。（2023）文章很好地概述了大型企业系统中网络安全威胁所带来的问题和挑战，以及统计和数据科学方法在解决这些问题方面的作用。讨论的广泛方法论重点包括分布式统计推断，数据融合，异常检测和对抗机器学习。接下来，简要讨论了异常检测和变点检测的相关问题，指出异常检测和变点检测在网络物理系统中的应用范围比单纯的安全问题更广泛。例如，现代计算机和通信网络以及企业系统已经在个人生活中以及组织和政府的职能中变得无处不在。它们支持许多服务，从文件共享、电子邮件、Web浏览和云计算等成熟服务到远程教育和远程医疗等快速发展的服务。然而，为了实现其潜力，不同的利益攸关方，包括网络提供商、企业系统设计者和应用程序开发者，需要满足某些服务质量要求。此外，服务质量可能由于各种原因而降低，包括未经授权的用户的入侵，广泛的协同攻击（例如，分布式拒绝服务），甚至是网络提供商提供的资源不足或极度占用带宽的应用程序。此外，如Hero et al.（2023年），网络和企业系统的规模和复杂性不断增加，这也带来了挑战。
The authors of the Hero et al.(2023) article should be congratulated for their nice overview of problems and challenges arising from cybersecurity threats in large enterprise systems, and the role of statistical and data science methods to address them. The broad methodological thrusts discussed include distributed statistical inference, data fusion, anomaly detection, and adversarial machine learning. In the sequel, a number of issues related to the challenging anomaly detection problem and the associated one of change point detection are briefly discussed.The scope of anomaly and change point detection in cyber-physical systems is more general than simply security considerations. For example, modern computer and communications networks and enterprise systems have become ubiquitous in the lives of individuals, as well as the function of organizations and governments. They support many services, from mature ones such as file sharing, email, web browsing, and cloud computing to fast-evolving ones such as remote education and telemedicine. However, to achieve their potential, certain requirements on quality-of-service need to be met by different stakeholders, including network providers, designers of enterprise systems, and applications developers. Further, quality-of-service can degrade for various reasons, including intrusions by unauthorized users, broad coordinated attacks (eg, distributed denial of service), or even underprovision of resources by network providers or exceedingly bandwidth-hungry applications. Further, as pointed out in Hero et al.(2023), the ever-increasing scale and complexity of network and enterprise systems contribute to the challenges.