3 ms·
Part of the problem in anomaly detection is that sometimes anomalies are of a "novel" type. It can be impossible to collect labelled data on all possible anomal
by jmmcd 10y ago
Part of the problem in anomaly detection is that sometimes anomalies are of a "novel" type. It can be impossible to collect labelled data on all possible anomalies. So learning a model of normal behaviour turns out better.
But if we're talking about a specific application, where there's only one (or a few) types of bad behaviour, then it's probably worthwhile to manually label some data and use binary classification as you suggested.
- graycat 10y agoYes, for your first point, you seem to be considering behavioral monitoring where we attempt to characterize the behavior of a healthy or normal system and decree and declare everything else a sick system or an anomaly. Yes, of your second, an example seems to be detecting malware in communications data streams or hard disk files by looking for specific, characterizing patterns of bits, that is, signatures extracted from earlier detections of such malware. In behavioral monitoring, we might have challenges with false alarm rate.