Abstract:Anomaly detection significantly enhances the robustness of cloud systems.While neural network-based methods have recently demonstrated strongadvantages, they encounter practical challenges in cloud environments: thecontradiction between the impracticality of maintaining a unique model for eachservice and the limited ability to deal with diverse normal patterns by aunified model, as well as issues with handling heavy traffic in real time andshort-term anomaly detection sensitivity. Thus, we propose MACE, a multi-normal-pattern accommodated and efficientanomaly detection method in the frequency domain for time series anomalydetection. There are three novel characteristics of it: (i) a patternextraction mechanism excelling at handling diverse normal patterns with aunified model, which enables the model to identify anomalies by examining thecorrelation between the data sample and its service normal pattern, instead ofsolely focusing on the data sample itself; (ii) a dualistic convolutionmechanism that amplifies short-term anomalies in the time domain and hindersthe reconstruction of anomalies in the frequency domain, which enlarges thereconstruction error disparity between anomaly and normality and facilitatesanomaly detection; (iii) leveraging the sparsity and parallelism of frequencydomain to enhance model efficiency. We theoretically and experimentally provethat using a strategically selected subset of Fourier bases can not only reducecomputational overhead but is also profitable to distinguish anomalies,compared to using the complete spectrum. Moreover, extensive experimentsdemonstrate MACE's effectiveness in handling diverse normal patterns with aunified model and it achieves state-of-the-art performance with highefficiency.

Novel Method for Anomaly Detection of User Behavior Based on Shell Commands and DTMC Models

Anomaly Detection of User Behavior Based on DTMC with States of Variable-Length Sequences

Masquerade Detection Based on Shell Commands and High-Order Markov Chain Models

An Anomaly Detection Algorithm for the Power Industrial Terminal Security Monitoring

An Anomaly Intrusion Detection Method Based on Shell Commands

Host-based Intrusion Detection Using Dynamic and Static Behavioral Models.

User Profiling for Intrusion Detection Using Dynamic and Static Behavioral Models

Statistical Learning for Anomaly Detection in Cloud Server Systems: A Multi-Order Markov Chain Framework

Markov Chain Intrusion Detection Model Based on System Call Macro

Profiling Program and User Behaviors for Anomaly Intrusion Detection Based on Non-Negative Matrix Factorization

Profiling program behavior for anomaly intrusion detection based on the transition and frequency property of computer audit data

Modeling program behaviors by hidden Markov models for intrusion detection

A variable-length model for masquerade detection

A Markov Model of System Calls Sequence and Its Application in Anomaly Detection

An Ensemble Approach for Detecting Anomalous User Behaviors

Learning Multi-Pattern Normalities in the Frequency Domain for Efficient Time Series Anomaly Detection

Anomaly based multi-stage attack detection method

Online Detection of Anomaly Behaviors Based on Multidimensional Trajectories.

User BehaviorCycle-Based Statistical Approach for Anomaly Detecting on Mobile Devices

An Anomaly Detection Model Based on Dynamic Behavior and Character Patterns