Anomaly Detection as a Service Challenges, Advances, and Opportunities

Anomaly detection has been a long-standing security approach with versatile applications, ranging from securing server programs in critical environments, to detecting insider threats in enterprises, to anti-abuse detection for online social networks. Despite the seemingly diverse application domains, anomaly detection solutions share similar technical challenges, such as how to accurately recognize various normal patterns, how to reduce false alarms, how to adapt to concept drifts, and how to minimize performance impact. They also share similar detection approaches and evaluation methods, such as feature extraction, dimension reduction, and experimental evaluation.

The main purpose of this book is to help advance the real-world adoption and deployment anomaly detection technologies, by systematizing the body of existing knowledge on anomaly detection. This book is focused on data-driven anomaly detection for software, systems, and networks against advanced exploits and attacks, but also touches on a number of applications, including fraud detection and insider threats. We explain the key technical components in anomaly detection workflows, give in-depth description of the state-of-the-art data-driven anomaly-based security solutions, and more importantly, point out promising new research directions. This book emphasizes on the need and challenges for deploying service-oriented anomaly detection in practice, where clients can outsource the detection to dedicated security providers and enjoy the protection without tending to the intricate details.

Preface.- Acknowledgments.- Introduction.- Threat Models.- Local vs. Global Program Anomaly Detection.- Program Analysis in Data-driven Anomaly Detection.- Anomaly Detection in Cyber-Physical Systems.- Anomaly Detection on Network Traffic.- Automation and Evaluation for Anomaly Detection Deployment.- Anomaly Detection from the Industry's Perspective.- Exciting New Problems and Opportunities.- Bibliography.- Authors' Biographies.- Index.

Danfeng (Daphne) Yao is an Associate Professor of Computer Science at Virginia Tech. In the past decade, she has worked on designing and developing data-driven anomaly detection techniques for securing networked systems against stealthy exploits and attacks. Her expertise also includes software security, mobile security, cloud security, and applied cryptography. Professor Yao received her Ph.D. in Computer Science from Brown University. Professor Yao is an Elizabeth and James E. Turner Jr. '56 Faculty Fellow and L-3 Faculty Fellow. She received the NSF CAREER Award in 2010 for her work on human-behavior driven malware detection, and the ARO Young Investigator Award for her semantic reasoning for mission-oriented security work in 2014. She received several Best Paper Awards and Best Poster Awards. She was given the Award for Technological Innovation from Brown University in 2006. She holds multiple U.S. patents for her anomaly detection technologies. Professor Yao is an Associate Editorof IEEE Transactions on Dependable and Secure Computing (TDSC). She serves as the PC member in numerous computer security conferences, including ACM CCS, IEEE Security & Privacy Symposium. She has over 85 peer-reviewed publications in major security and privacy conferences and journals. Daphne is an active member of the security research community. She serves as the Secretary/Treasurer at ACM Special Interest Group on Security, Audit and Control (SIGSAC).