Unsupervised Streaming Cyber-Analytics

Опубликовано 4 апреля 2018, 22:52

The supervised learning approach to cyber-analytics has proven rather successful. However, there are challenges with this approach, including a frequent dearth of labelled data, the issue of temporal variation, and fundamentally, problems of data volume and velocity. In this talk, we describe simple unsupervised analytics intended to complement and enhance supervised methods. These approaches are based on detecting departures from normal behaviour, under a variety of definitions of normal. In particular we are concerned with streaming analytics, procedures which analyse and update on the fly, as data arrives. We describe adaptive estimation and change point methods for reasoning about a variety of objects, including multinomial distributions and Markov Chains. Examples of such methods operating on enterprise network data are provided.

See more at microsoft.com/en-us/research/v...