Predictive Anomaly Detection

Wassim Berriche (1) , Françoise Sailhan (2, 3, 4)

1 CEDRIC - ROC - CEDRIC. Réseaux et Objets Connectés
2 IMT Atlantique - INFO - Département Informatique
3 Lab-STICC - Laboratoire des sciences et techniques de l'information, de la communication et de la connaissance
4 Lab-STICC_MATHNET - Equipe Math & Net

Cyber attacks are a significant risk for cloud service providers and to mitigate this risk, near real-time anomaly detection and mitigation plays a critical role. To this end, we introduce a statistical anomaly detection system that includes several auto-regressive models tuned to detect complex patterns (e.g. seasonal and multi-dimensional patterns) based on the gathered observations to deal with an evolving spectrum of attacks and a different behaviours of the monitored cloud. In addition, our system adapts the observation period and makes predictions based on a controlled set of observations, i.e. over several expanding time windows that capture some complex patterns, which span different time scales (e.g. long term versus short terms patterns). We evaluate the proposed solution using a public dataset and we show that our anomaly detection system increases the accuracy of the detection while reducing the overall resource usage.

Mots clés: Anomaly detection ARIMA Time series Forecasting; Anomaly detection; ARIMA; Time series; Forecasting

Domaines: Informatique [cs]

Wassim Berriche, Françoise Sailhan. Predictive Anomaly Detection. 18th International Conference on Information Assurance and Security, Dec 2022, KLE, India. ⟨hal-03879940⟩