Seurat: A Pointillist Approach to Anomaly Detection

DMCA

Seurat: A Pointillist Approach to Anomaly Detection (2004)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Yinglian Xie Hyang-Ah , Yinglian Xie , Hyang-ah Kim , David R. O’hallaron , Michael K. Reiter , Hui Zhang

Venue:

In RAID

BibTeX

@INPROCEEDINGS{Hyang-Ah04seurat:a,
    author = {Yinglian Xie Hyang-Ah and Yinglian Xie and Hyang-ah Kim and David R. O’hallaron and Michael K. Reiter and Hui Zhang},
    title = {Seurat: A Pointillist Approach to Anomaly Detection},
    booktitle = {In RAID},
    year = {2004}
}

OpenURL

Abstract

This paper proposes a new approach to detecting aggregated anomalous events by correlating host file system changes across space and time. Our approach is based on a key observation that many host state transitions of interest have both temporal and spatial locality. Abnormal state changes, which may be hard to detect in isolation, become apparent when they are correlated with similar changes on other hosts. Based on this intuition, we have developed a method to detect similar, coincident changes to the patterns of file updates that are shared across multiple hosts. We have implemented this approach in a prototype system called Seurat and demonstrated its effectiveness using a combination of real workstation cluster traces, simulated attacks, and a manually launched Linux worm.

Keyphrases

anomaly detection pointillist approach real workstation cluster trace linux worm file update similar change coincident change prototype system host file system change new approach spatial locality abnormal state change anomalous event multiple host key observation many host state transition simulated attack

DMCA