Collaborative Research: Real-Time Data-Driven Anomaly Detection for Complex Networks

异常检测是处理异常数据模式检测的一个重要问题。异常检测的重要性在于，观察到的数据中的异常可能是底层系统中不需要的、通常是可操作的事件（如故障、恶意活动等）的标志。在许多实时系统中，及时准确地检测异常数据模式至关重要，并将允许及时采取适当的对策，以抵消任何可能的危害。尽管异常检测已经研究了很长时间，但今天的复杂网络呈现出新的挑战，例如：低延迟要求、数据大小、系统动态、未知分布、分布式性质和隐私。本提案的目的是研究在复杂系统中实时数据驱动异常检测的有效和可扩展的方法。该提案的主要主题解决了在一般复杂网络设置中早期检测异常和攻击的多个重要问题。考虑到当今世界网络安全的重要性，理解和预警这种复杂网络的组织动态变化的方法具有巨大的意义。该提案通过带来一套新颖的工程工具和想法，直接解决了这些问题。采用系统的方法，本项目首先考虑(1)如何及时发现具有动态性和隐藏异常挑战的集中式高维系统中的异常；（ii）如何处理监控分布式系统的资源限制；（iii）如何在分布式系统中实现实时异常检测的隐私保护解决方案。本课题提出的这些挑战和解决方法一般适用于各种复杂系统。具体而言，该项目侧重于两个具有挑战性的物联网网络：监控摄像头网络和智能家居网络。所提出的方法利用了一系列先进的技术，包括顺序变化检测、深度强化学习、事件触发处理和差分隐私，并将为异常检测的理论和应用带来重大创新。特别是，将演示所提议算法的实际使用，并使用两个物联网网络（监控摄像头网络和智能家居网络）的硬件实现来评估其性能。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Anomaly detection is an important problem dealing with the detection of abnormal data patterns. Importance of anomaly detection lies in the fact that an anomaly in the observed data may be a sign of an unwanted and often actionable event such as failure, malicious activity, etc. in the underlying system. In many real-time systems, timely and accurate detection of abnormal data patterns is crucial, and will allow proper countermeasures to be taken in a timely manner, to counteract any possible harm. Although anomaly detection has long been studied, today's complex networks exhibit new challenges, such as: low latency requirements, data size, system dynamics, unknown distributions, distributed nature, and privacy. The objective of this proposal is to investigate effective and scalable approaches for real-time data-driven anomaly detection in complex systems with these challenges. The main themes of this proposal address multiple important problems in the early detection of anomalies and attacks in a general complex network setting. Considering the importance of cybersecurity in today's world, methodologies to understand and forewarn changes in the organizational dynamics of such complicated networks is of immense significance. This proposal directly addresses these issues by bringing a fresh and novel set of engineering tools and ideas.Following a systematic approach, this project first considers (1) how to timely detect anomalies in centralized high-dimensional systems with dynamicity and hidden anomaly challenges; (ii) how to deal with resource constraints in monitoring distributed systems; and (iii) how to enable privacy-preserving solutions for real-time anomaly detection in distributed systems. These challenges and the solution methods presented in this project are generally applicable to a variety of complex systems. To be specific, this project focuses on two challenging IoT networks: surveillance camera network and smart home network. The proposed approaches exploit an array of advanced techniques including sequential change detection, deep reinforcement learning, event-triggered processing, and differential privacy, and will bring significant innovations to the theory and applications of anomaly detection. In particular, the practical use of proposed algorithms will be demonstrated and their performance will be evaluated with respect to the state of the art using hardware implementations of two IoT networks - a surveillance camera network and a smart home network.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.