{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/anomaly-detection","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/anomaly-detection/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/anomaly-detection/"},"term":{"en":"Anomaly detection","da":"Anomalidetektion"},"aka":{"en":["behaviour-based detection","outlier detection"],"da":["adfærdsbaseret detektion"]},"domain":["security","ai"],"cluster":"security-operations","layer":"application","status":"current","era":1987,"summary":{"en":"Learning what normal activity looks like and raising an alarm when something departs from it, even if no rule describes the attack.","da":"At lære, hvordan normal aktivitet ser ud, og slå alarm, når noget afviger fra den, også selv om ingen regel beskriver angrebet."},"body":{"formal":{"en":"A way of finding threats by building a model of normal behaviour for users, devices or network traffic - often with machine learning - and flagging events that differ from it by more than a set amount.","da":"En måde at finde trusler på ved at opbygge en model af normal adfærd for brugere, enheder eller netværkstrafik - ofte med maskinlæring - og markere hændelser, der afviger mere end en fastsat grænse fra den."},"plain":{"en":"Like a bank teller who knows a regular customer so well that she notices at once when he asks to move all his savings abroad on a Sunday.","da":"Som en bankassistent, der kender en fast kunde så godt, at hun straks lægger mærke til det, når han en søndag vil flytte hele sin opsparing til udlandet."},"inPractice":{"en":"A municipal finance clerk's account, which normally opens a few files a day, suddenly copies ten thousand files one night; no rule covers this, but the model flags it and the SOC finds malware.","da":"En bogholder i en kommune har en konto, der normalt åbner nogle få filer om dagen, men som pludselig kopierer ti tusind filer en nat; ingen regel dækker det, men modellen markerer det, og SOC'en finder malware."},"whyItMatters":{"en":"It can catch new attacks that no one has written a rule for yet, but unusual is not the same as harmful, so it brings many false alarms that people must judge.","da":"Den kan fange nye angreb, som ingen endnu har skrevet en regel for, men usædvanligt er ikke det samme som skadeligt, så den giver mange falske alarmer, som mennesker må vurdere."}},"deepDive":{"en":"Dorothy Denning's 1987 paper \"An Intrusion-Detection Model\", developed alongside SRI's IDES system, established the core idea: maintain statistical profiles of subjects (users, hosts, processes) acting on objects, and flag observations that deviate significantly from the profile. The classic contrast is with misuse or signature detection, which matches known-bad patterns. NIST SP 800-94 uses the terms anomaly-based and signature-based detection, and adds stateful protocol analysis as a third method. Chandola, Banerjee and Kumar's widely cited 2009 survey distinguishes point anomalies (a single outlying value), contextual anomalies (normal in one context, abnormal in another, such as a login at 03:00) and collective anomalies (a sequence that is abnormal only as a whole, such as slow periodic beaconing).\n\nTechniques range from simple statistics to machine learning. Baselines using mean and standard deviation (z-scores), exponentially weighted moving averages, and seasonal models that account for weekday and hour are still the workhorses in SIEM platforms. Unsupervised methods include isolation forest (Liu, Ting and Zhou, 2008), which scores points by how few random splits isolate them, local outlier factor, one-class SVMs, clustering and autoencoders whose reconstruction error serves as the anomaly score. User and entity behaviour analytics (UEBA) products apply these per identity and per device and add peer-group comparison, so that a finance clerk is compared with other finance clerks rather than with the whole organisation.\n\nThe central difficulty is the base-rate fallacy, analysed for intrusion detection by Axelsson (2000). Because genuinely malicious events are extremely rare, even a detector with a very low false-positive rate produces far more false alarms than true ones. Sommer and Paxson (2010) added that network anomaly detection differs from classic ML domains: the cost of errors is high, the \"normal\" class is extremely diverse and changing, ground truth is scarce, and a flagged anomaly often comes without an explanation an analyst can act on. Baselines also drift as organisations change, and patient attackers can deliberately stay within normal ranges or shift the baseline gradually, a form of poisoning. A new employee, a quarter-end batch job or a migration will look anomalous without being malicious.\n\nIn practice, effective deployments narrow the question: they model specific, well-understood behaviours (authentication geography, data egress volume, process parent-child relationships, service account usage), keep a training period free of known incidents, document the baseline window and thresholds, and route anomalies as context or risk scores that raise the priority of related rule-based alerts rather than as stand-alone alarms. Anomaly detection complements detection rules rather than replacing them: rules give precise, explainable coverage of known techniques, while anomaly models offer a chance to catch the unknown at the price of lower precision.","da":"Dorothy Dennings artikel \"An Intrusion-Detection Model\" fra 1987, udviklet sideløbende med SRI's IDES-system, fastlagde den grundlæggende idé: vedligehold statistiske profiler for subjekter (brugere, maskiner, processer), der handler på objekter, og markér observationer, der afviger markant fra profilen. Den klassiske modsætning er misbrugs- eller signaturdetektion, der matcher kendte ondsindede mønstre. NIST SP 800-94 bruger betegnelserne anomalibaseret og signaturbaseret detektion og tilføjer stateful protokolanalyse som en tredje metode. Chandola, Banerjee og Kumars meget citerede oversigtsartikel fra 2009 skelner mellem punktanomalier (en enkelt afvigende værdi), kontekstuelle anomalier (normale i én sammenhæng og unormale i en anden, fx et login kl. 03.00) og kollektive anomalier (en sekvens, der kun er unormal som helhed, fx langsom, periodisk beaconing).\n\nTeknikkerne spænder fra simpel statistik til maskinlæring. Baselines med middelværdi og standardafvigelse (z-scores), eksponentielt vægtede glidende gennemsnit og sæsonmodeller, der tager højde for ugedag og tidspunkt, er stadig arbejdshestene i SIEM-platforme. Blandt de usuperviserede metoder er isolation forest (Liu, Ting og Zhou, 2008), der vurderer punkter efter, hvor få tilfældige opdelinger der skal til for at isolere dem, local outlier factor, one-class SVM'er, klyngeanalyse og autoencodere, hvis rekonstruktionsfejl bruges som anomaliscore. Produkter til user and entity behaviour analytics (UEBA) anvender disse pr. identitet og pr. enhed og tilføjer sammenligning med peergrupper, så en bogholder sammenlignes med andre bogholdere frem for med hele organisationen.\n\nDen centrale vanskelighed er base rate-fejlslutningen, som Axelsson (2000) analyserede for intrusion detection. Fordi reelt ondsindede hændelser er ekstremt sjældne, giver selv en detektor med meget lav falsk positiv-rate langt flere falske end ægte alarmer. Sommer og Paxson (2010) tilføjede, at anomalidetektion i netværk adskiller sig fra klassiske ML-domæner: fejl er dyre, den \"normale\" klasse er meget varieret og foranderlig, der er sjældent facit at træne på, og en markeret anomali kommer ofte uden en forklaring, som en analytiker kan handle på. Baselines driver også, når organisationer ændrer sig, og tålmodige angribere kan bevidst holde sig inden for de normale intervaller eller flytte baselinen gradvist, en form for forgiftning. En ny medarbejder, en kørsel ved kvartalsafslutning eller en migrering ser unormal ud uden at være ondsindet.\n\nI praksis indsnævrer velfungerende installationer spørgsmålet: de modellerer specifikke, velforståede adfærdsmønstre (geografi ved login, mængden af udgående data, forholdet mellem forælder- og børneprocesser, brug af servicekonti), holder træningsperioden fri for kendte hændelser, dokumenterer baselinevindue og tærskler og sender anomalier videre som kontekst eller risikoscorer, der hæver prioriteten af relaterede regelbaserede alarmer, frem for som selvstændige alarmer. Anomalidetektion supplerer detektionsregler i stedet for at erstatte dem: regler giver præcis, forklarlig dækning af kendte teknikker, mens anomalimodeller giver en chance for at fange det ukendte mod en lavere præcision."},"edges":[{"type":"contrasts-with","to":"security/detection-rule","why":{"en":"A detection rule looks for an attack someone has already described; anomaly detection looks for anything that breaks the usual pattern.","da":"En detektionsregel leder efter et angreb, nogen allerede har beskrevet; anomalidetektion leder efter alt, der bryder det sædvanlige mønster."},"confidence":"high","strength":"primary"},{"type":"causes","to":"security/false-positive","why":{"en":"Harmless but unusual activity, such as a new staff member or a one-off job, also breaks the pattern and raises an alarm.","da":"Harmløs, men usædvanlig aktivitet, fx en ny medarbejder eller en engangskørsel, bryder også mønstret og udløser en alarm."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"ai/unsupervised-learning","why":{"en":"Learning normal behaviour from data with no answers attached is the usual way the model of normal is built.","da":"At lære normal adfærd ud fra data uden svar er den typiske måde, modellen af det normale bygges på."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"ai/machine-learning","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/siem","confidence":"high","strength":"normal"},{"type":"used-with","to":"ai/clustering","why":{"en":"Items that fit no group, or form a tiny odd group, are candidates for anomalies.","da":"Ting, der ikke passer i nogen gruppe eller danner en lille mærkelig gruppe, er kandidater til anomalier."},"confidence":"medium","strength":"normal"},{"type":"used-with","to":"ai/recall","why":{"en":"Recall measures how many real attacks the detection actually caught, which shows its blind spots.","da":"Genkaldelse måler, hvor mange reelle angreb detektionen faktisk fangede, og viser dermed dens blinde vinkler."},"confidence":"medium","strength":"normal"}],"depth":0,"sources":[{"title":"Denning, D. E. - An Intrusion-Detection Model (IEEE Transactions on Software Engineering, 1987)","url":"https://doi.org/10.1109/TSE.1987.232894","tier":"reference","publisher":"IEEE"},{"title":"NIST SP 800-94 - Guide to Intrusion Detection and Prevention Systems (IDPS)","url":"https://doi.org/10.6028/NIST.SP.800-94","tier":"standard","publisher":"NIST"}],"draft":true}