Making Anomaly Detection Interpretable & Actionable in Hostile Environments

异常检测在网络安全中起着至关重要的作用，可以识别隐藏在大量数据中的威胁模式。然而，目前的方法在嘈杂、异构和对抗性环境中具有很高的误报率。该项目旨在通过引入可操作异常的概念来识别和解释可能破坏系统性能的异常。它将通过开发算法来显著提高异常检测的有效性，该算法将数据的局部和全局结构转换为可操作的异常并解释其外围方面。项目成果将提高关键系统的安全性、可信度和容错能力，为网络安全方面的国际努力作出贡献。

Anomaly detection plays a vital role in cyber security to identify threat patterns hidden within large volumes of data. However, current approaches experience high false alarm rates in noisy, heterogeneous and adversarial environments. This project aims to identify and interpret anomalies that can disrupt system performance by introducing the concept of actionable anomalies. It will significantly advance the effectiveness of anomaly detection by developing algorithms that distil local and global structures of data to characterise actionable anomalies and explain their outlying aspects. Project outcomes will enhance the security, trustworthiness and fault-tolerance of critical systems, contributing to international efforts in cyber security.