Abstract:Due to the rapidly increasing number of Internet-connected objects, a huge amount of data is created, stored, and shared. Depending on the use case, this data is visualized, cleaned, checked, visualized, and processed for various purposes. However, this data may encounter many problems such as inaccuracy, duplication, absence, etc. Such issues can be regarded as anomalies that deviate from a referential point, which can be caused by malicious attackers, abnormal behavior of systems, and a failure of devices, transmission channels, or data processing units. Anomaly detection is still one of the most important issues in cybersecurity, especially when it comes to system monitoring, automated forensics, and post-mortem analysis, which require anomaly detection mechanisms. In the literature, different approaches have been developed to detect anomalies, which can be classified as statistic-based, semantic-based, clustering-based, classification-based, and deep learning-based, depending on the algorithms used. This survey focuses on knowledge-based approaches, a sub-category of semantic-based approaches, as opposed to statistical/learning approaches. We provide a detailed comparison of the recent work in knowledge-based subcategories, namely, rule-based, score-based, and hybrid. We described the components of a knowledge-based system and the steps required to process raw data for anomaly detection. Furthermore, we have collected for each approach, when available, information about its semantic expressiveness, computational complexity, and application domain. Finally, we identify the challenges and discuss some future research directions in knowledge-based anomaly detection. Identifying such approaches and challenges can help cybersecurity engineers design better models that meet their application requirements.

Anomaly Detection for Space Information Networks: A Survey of Challenges, Techniques, and Future Directions

An overview of anomaly detection techniques: Existing solutions and latest technological trends

Survey on security issues of routing and anomaly detection for space information networks

Detection of Sparse Anomalies in High-Dimensional Network Telescope Signals

Anomaly-based network intrusion detection: Techniques, systems and challenges

A Survey of Network Anomaly Visualization

Anomaly Detection in Connected and Autonomous Vehicles: A Survey, Analysis, and Research Challenges

Survey on Incremental Approaches for Network Anomaly Detection

A Survey of Graph-based Deep Learning for Anomaly Detection in Distributed Systems

Anomaly Detection Methods in Autonomous Robotic Missions

Knowledge-based anomaly detection: Survey, challenges, and future directions

Machine Learning in Network Anomaly Detection: A Survey

Anomaly Detection in Graph Structured Data: A Survey

A Survey of AI-Based Anomaly Detection in IoT and Sensor Networks

Anomaly Detection Based on Isolation Mechanisms: A Survey

Anomaly Detection in Dynamic Graphs: A Comprehensive Survey

Anomaly Detection in Spatio-Temporal Data: Theory and Application

A survey and classification of the security anomaly detection mechanisms in software defined networks

Anomaly detection in online social networks

Real-time big data processing for anomaly detection: A Survey

A Comprehensive Study of Anomaly Detection Schemes in IoT Networks Using Machine Learning Algorithms