Abstract
We discuss an approach to reducing the number of events accepted by anomaly detection systems, based on alternative schemes for interest-ranking. The basic assumption is that regular and periodic usage of a system will yield patterns of events that can be learned by data-mining. Events that deviate from this pattern can then be filtered out and receive special attention. Our approach compares the anomaly detection framework from Cfengine and the EventRank algorithm for the analysis of the event logs. We show that the EventRank algorithm can be used to successfully prune periodic events from real-life data.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Keogh, E., Kasetty, S.: On the Need for Time Series Data Mining Benchmarks: A Survey and Empirical Demonstration. In: SIGKKD ’02, ACM Press, New York (2002)
The CFengine website, http://www.cfengine.org
Burgess, M.: Two dimensional time-series for anomaly detection and regulation in adaptive systems. In: Feridun, M., Kropf, P.G., Babin, G. (eds.) DSOM 2002. LNCS, vol. 2506, p. 169. Springer, Heidelberg (2002)
O’Madahain, J., Smyth, P.: EventRank: A Framework for Ranking Time-Varying Networks. LinkKDD’05. ACM Press, New York (2005)
O’Madahain, J., Hutchins, J., Smyth, P.: Prediction and Ranking Aldorithms for Event-Based Network Data. In: SIGKDD Explor. Newsl. 2005, ACM Press, New York (2005)
Cochran, W G.: Some Methods for Strengthening the Common χ 2 Tests. Biometrics 10(4), 417–451 (1954), doi:10.2307/3001616
Bortz, J., Lienert, G.A.: Kurzgefasste Statistik die klinishe Forschung, 2. Auflage, p. 347. Springer, Heidelberg (2003)
Begnum, K., Burgess, M.: Principle components and importance ranking of distributed anomalies. Machine Learning Journal 58, 217–230 (2005)
Yang, J., Wang, W., Yu, P.S.: InfoMiner: Mining Surprising Periodic Patterns. In: KDD ’01. Proceedings of the seventh ACM SIGKDD international conference on Knowledge discovery and data mining, ACM Press, New York (2001)
Cover, T.M., Thomas, J.A.: Book: Elements of Information Theory. J.Wiley & Sons, Chichester (1991)
Burgess, M.: Probabilistic anomaly detection in distributed computer networks. Science of Computer Programming 60(1), 1–26 (2006)
Burgess, M., Haugerud, H., Reitan, T., Straumsnes, S.: Measuring host normality, ACM Transactions on Computing Systems (2001)
Author information
Authors and Affiliations
Editor information
Rights and permissions
Copyright information
© 2007 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Begnum, K., Burgess, M. (2007). Improving Anomaly Detection Event Analysis Using the EventRank Algorithm. In: Bandara, A.K., Burgess, M. (eds) Inter-Domain Management. AIMS 2007. Lecture Notes in Computer Science, vol 4543. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-72986-0_13
Download citation
DOI: https://doi.org/10.1007/978-3-540-72986-0_13
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-72985-3
Online ISBN: 978-3-540-72986-0
eBook Packages: Computer ScienceComputer Science (R0)