Non-Pattern-Based Anomaly Detection in Time-Series

Abstract

Anomaly detection across critical infrastructures is not only a key step towards detecting threats but also gives early warnings of the likelihood of potential cyber-attacks, faults, or infrastructure failures. Owing to the heterogeneity and complexity of the cybersecurity field, several anomaly detection algorithms have been suggested in the recent past based on the literature; however, there still exists little or no research that points or focuses on Non-Pattern Anomaly Detection (NP-AD) in Time-Series at the time of writing this paper. Most of the existing anomaly detection approaches refer to the initial profiling, i.e., defining which behavior represented by time series is “normal”, whereas everything that does not meet the criteria of “normality” is set as “abnormal” or anomalous. Such a definition does not reflect the complexity and sophistication of anomaly nature. Under different conditions, the same behavior may or may not be anomalous. Therefore, the authors of this paper posit the need for NP-AD in Time-Series as a step toward showing the relevance of deviating or not conforming to expected behaviors. Non-Pattern (NP), in the context of this paper, illustrates non-conforming patterns or a technique of deviating with respect to some characteristics while dynamically adapting to changes. Based on the experiments that have been conducted in this paper, it has been observed that the likelihood of NP-AD in Time-Series is a significant approach based on the margins of data streams that have been used from the perspective of non-seasonal time series with outliers, the Numenta Anomaly Benchmark (NAB) dataset and the SIEM SPLUNK machine learning toolkit. It is the authors’ opinion that this approach provides a significant step toward predicting futuristic anomalies across diverse cyber, critical infrastructures, and other complex settings.