论文标题
在延迟反馈下使用superexperts检测异常
Anomaly detection with superexperts under delayed feedback
论文作者
论文摘要
数据和网络物理系统的连通性的提高导致了越来越多的网络攻击。需要通过识别异常活动来实时检测此类攻击，以便可以有效，快速部署缓解和偶然的动作。我们提出了一种新的方法，用于汇总无监督的异常检测算法并在可用时结合反馈。我们将这种方法应用于开源真实数据集，并表明我们称为专家的汇总模型并合并反馈都大大提高了性能。所提出的方法的一个重要特性是他们的理论保证，即他们在累积的平均损失方面，它们可以接近最佳的superexpert，可以在最佳性能专家之间切换。
The increasing connectivity of data and cyber-physical systems has resulted in a growing number of cyber-attacks. Real-time detection of such attacks, through the identification of anomalous activity, is required so that mitigation and contingent actions can be effectively and rapidly deployed. We propose a new approach for aggregating unsupervised anomaly detection algorithms and incorporating feedback when it becomes available. We apply this approach to open-source real datasets and show that both aggregating models, which we call experts, and incorporating feedback significantly improve the performance. An important property of the proposed approaches is their theoretical guarantees that they perform close to the best superexpert, which can switch between the best performing experts, in terms of the cumulative average losses.
