10.4 Anomaly Detection

10.4 Anomaly Detection

Anomaly detection software systems and services start first by establishing normal usage patterns for users by looking at their CPU and I/O behavior to build a profile. Anomaly detection techniques assume that all intrusive activities are necessarily anomalous. This means that if we could establish a "normal activity profile" for a system, we could, in theory, flag all system states varying from the established profile by categorizing statistically significant amounts as intrusion attempts. This can result in anomalous activities that are not intrusive being flagged as intrusive. Or, worse, intrusive activities that are not anomalous could result in false negatives, that is, events that are not flagged as intrusive, though they actually are. This is a dangerous problem, and is far more serious than the problem of false positives.