Anomaly Detection as a Service: Challenges, Advances, and Opportunities (Synthesis Lectures on Information Security, Privacy, and Trust)

Anomaly detection has been a long-standing security approach with versatile applications, ranging from securing server programs in critical environments, to detecting insider threats in enterprises, to anti-abuse detection for online social networks. Despite the seemingly diverse application domains, anomaly detection solutions share similar technical challenges, such as how to accurately recognize various normal patterns, how to reduce false alarms, how to adapt to concept drifts, and how to minimize performance impact. They also share similar detection approaches and evaluation methods, such as feature extraction, dimension reduction, and experimental evaluation.



The main purpose of this book is to help advance the real-world adoption and deployment anomaly detection technologies, by systematizing the body of existing knowledge on anomaly detection. This book is focused on data-driven anomaly detection for software, systems, and networks against advanced exploits and attacks, but also touches on a number of applications, including fraud detection and insider threats. We explain the key technical components in anomaly detection workflows, give in-depth description of the state-of-the-art data-driven anomaly-based security solutions, and more importantly, point out promising new research directions. This book emphasizes on the need and challenges for deploying service-oriented anomaly detection in practice, where clients can outsource the detection to dedicated security providers and enjoy the protection without tending to the intricate details.

Long Cheng is currently pursuing his second Ph.D. in the Department of Computer Science at Virginia Tech. His research interests include system and network security, cyber forensics, cyberphysical systems (CPS) security, mobile computing, and wireless networks. He received his first Ph.D. degree from Beijing University of Posts and Telecommunications in 2012. Dr. Cheng received the Best Paper Award from IEEE Wireless Communications and Networking Conference (WCNC) in 2013 and the prestigious Erasmus Mundus Scholar Award from the European Union in 2014.

Dr. Cheng's research activities span across the fields of cyber security and networking. He has published over 60 papers in peer-reviewed journals and conferences, including IEEE Transactions on Information Forensics and Security (TIFS), IEEE/ACM Transactions on Networking (ToN), Annual Computer Security Applications Conference (ACSAC), and Privacy Enhancing Technologies Symposium (PETS). He was invited to write a review article on enterprise data breach in Wiley's WIREs Data Mining and Knowledge Discovery. Dr. Cheng has extensive experiences collaborating with researchers in the industry and academia across multiple continents. He holds a patent for his sensor network routing method.

Salvatore J. Stolfo is a Professor of Computer Science at Columbia University. He received his Ph.D. from NYU Courant Institute in 1979 and has been on the faculty of Columbia ever since. He won the IBM Faculty Development Award early in his academic career in 1983. He has published several books and over 250 scientific papers and received several Best Paper Awards. His research spans across the areas of parallel computing, AI knowledge-based systems, data mining, and most recently computer security and intrusion detection systems.

Professor Stolfo has been granted 33 patents in the areas of parallel computing and database inference and computer security, most of which have been licensed. His research has been supported by DARPA, NSF, ONR, NSA, CIA, IARPA, AFOSR, ARO, NIST, DHS, and numerous companies and state agencies. Professor Stolfo has mentored over 30 Ph.D. students and many Master's students. His most recent research is devoted to payload anomaly detection for zero-day exploits, secure private querying, private and anonymous network trace synthesis, and automatic bait generation for trap-based defense to mitigate the insider threat.