Collaborative Research: Real-Time Data-Driven Anomaly Detection for Complex Networks

异常检测是处理异常数据模式检测的重要问题。异常检测的重要性在于以下事实：观察到的数据中的异常可能是底层系统中不想要的并且通常可操作的事件（诸如故障、恶意活动等）的迹象。在许多实时系统中，及时准确地检测异常数据模式是至关重要的，并将允许及时采取适当的对策，以抵消任何可能的危害。虽然异常检测已经研究了很长时间，但今天的复杂网络呈现出新的挑战，例如：低延迟要求，数据大小，系统动态，未知分布，分布式性质和隐私。本提案的目的是研究在具有这些挑战的复杂系统中进行实时数据驱动异常检测的有效且可扩展的方法。该提案的主要主题解决了在一般复杂网络环境中早期检测异常和攻击的多个重要问题。考虑到网络安全在当今世界的重要性，了解和预警这种复杂网络的组织动态变化的方法具有重大意义。本项目首先考虑了（1）如何在具有动态性和隐藏异常的集中式高维系统中及时检测异常，（2）如何处理分布式系统监控中的资源约束，（3）如何在分布式系统中实时检测异常，（4）如何在分布式系统中实时检测异常，（5）如何在分布式系统中实时检测异常。以及（iii）如何在分布式系统中实现用于实时异常检测的隐私保护解决方案。本项目中提出的这些挑战和解决方法一般适用于各种复杂系统。具体来说，该项目重点关注两个具有挑战性的物联网网络：监控摄像头网络和智能家居网络。所提出的方法利用了一系列先进技术，包括顺序变化检测、深度强化学习、事件触发处理和差分隐私，将为异常检测的理论和应用带来重大创新。特别是，将展示所提出的算法的实际应用，并使用两个物联网网络（监控摄像机网络和智能家居网络）的硬件实现来评估其性能。该奖项反映了NSF的法定使命，通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Anomaly detection is an important problem dealing with the detection of abnormal data patterns. Importance of anomaly detection lies in the fact that an anomaly in the observed data may be a sign of an unwanted and often actionable event such as failure, malicious activity, etc. in the underlying system. In many real-time systems, timely and accurate detection of abnormal data patterns is crucial, and will allow proper countermeasures to be taken in a timely manner, to counteract any possible harm. Although anomaly detection has long been studied, today's complex networks exhibit new challenges, such as: low latency requirements, data size, system dynamics, unknown distributions, distributed nature, and privacy. The objective of this proposal is to investigate effective and scalable approaches for real-time data-driven anomaly detection in complex systems with these challenges. The main themes of this proposal address multiple important problems in the early detection of anomalies and attacks in a general complex network setting. Considering the importance of cybersecurity in today's world, methodologies to understand and forewarn changes in the organizational dynamics of such complicated networks is of immense significance. This proposal directly addresses these issues by bringing a fresh and novel set of engineering tools and ideas.Following a systematic approach, this project first considers (1) how to timely detect anomalies in centralized high-dimensional systems with dynamicity and hidden anomaly challenges; (ii) how to deal with resource constraints in monitoring distributed systems; and (iii) how to enable privacy-preserving solutions for real-time anomaly detection in distributed systems. These challenges and the solution methods presented in this project are generally applicable to a variety of complex systems. To be specific, this project focuses on two challenging IoT networks: surveillance camera network and smart home network. The proposed approaches exploit an array of advanced techniques including sequential change detection, deep reinforcement learning, event-triggered processing, and differential privacy, and will bring significant innovations to the theory and applications of anomaly detection. In particular, the practical use of proposed algorithms will be demonstrated and their performance will be evaluated with respect to the state of the art using hardware implementations of two IoT networks - a surveillance camera network and a smart home network.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.