Event Recognition Beyond Signature and Anomaly
Jon Doyle, Isaac S. Kohane, William John Long, Howard E. Shrobe, Peter Szolovits · 2001
Abstract — Notions of signature and anomaly have formed the basis of useful methods in cyber defense, but even in combination provide only weak evidence for recognizing many events of interest. One can recognize many important events without requiring signatures of specific ways the events can take place and without treating every anomalous behavior as an event. We describe an approach to event recognition that subsumes and extends signature and anomaly methods by starting from a richer language for characterizing events. This paper explains how recognition methods based on this richer event-characterization language offer means for overcoming the limitations constraining signature and anomaly methods. I. Signature and anomaly methods NOTIONS of signature and anomaly form the backbone