Automated Anomaly Detection Using Time-Variant Normal Profiling

Anomaly detection provides automated detection of unauthorized intrusion into a computer system by creating a normal profile of the system's behavior, then raising an alert when the system's behavior does not fit the system's normal profile. Approaches to anomaly detection that focus on investigating user's behavior typically assume that a user's command sequences will not vary significantly over time and so tend to flag "unusual" but safe activities as anomalies. We propose the use of "time-variant normal" user profiles that assume a user will change activities over time. The approach combines string-matching algorithms from machine intelligence and sequence alignment algorithms from biomedical informatics to dynamically evaluate user behavior.