Real-time anomaly detection using a nonparametric pattern recognition approach

Obstacles to achieving anomaly detection in real time include the large volume of data associated with user behavior and the nature of that data. The paper describes preliminary results from a research project which is developing a new approach to handling such data. The approach involves nonparametric statistical methods which permits considerable data compression and which supports pattern recognition techniques for identifying user behavior. This approach applies these methods to a combination of measurements of resource usage and structural information about the behavior of processes. Preliminary results indicate that both accuracy and real time response can be achieved using these methods.<>