Principle Components and Importance Ranking of Distributed Anomalies

Abstract

Abstract.Correlations between locally averaged host observations, at different times and places, hint at information about the associations between the hosts in a network. These smoothed, pseudo-continuous time-series imply relationships with entities in the wider environment. For anomaly detection, mining this information might provide a valuable source of observational experience for determining comparative anomalies or rejecting false anomalies. The difficulties with distributed analysis lie in collating the distributed data and in comparing observables on different hosts, in different frames of reference. In the present work, we examine two methods (Principle Component Analysis and Eigenvector Centrality) that shed light on the usefulness of comparing data destined for different locations in a network.

A log mining approach for process monitoring in SCADA

“…The basic idea of our approach is that a frequent behaviour, over an extended period of time, is likely to be normal because event messages that reflect normal system activity are usually frequent [3,20,35].…”

Process matters: cyber security in industrial control systems

“…The basic idea of our approach is that a frequent behaviour, over an extended period of time, is likely to be normal because event messages that reflect normal system activity are usually frequent [20,74,108]. Similar to Burns et al [28], we found a large fraction of events that always appear with the same number of daily occurrences (e.g., timer-triggered event).…”

Localized Bridging Centrality for Distributed Network Analysis

“…Even two nodes with the same degree but need not have similar characteristics [1] (for example, see Figure 1). There are other centrality metrics, such as eigenvector centrality, which can help distinguish between nodes A and B that have the same degree centrality.…”

“…Let v i be the i th element of the vector v, representing the centrality measure of node i, where N (i) is the set of neighbors of node i and let A be the n × n adjacency matrix of the undirected network graph. Eigenvector centrality is defined using the following formulas [1]:…”