用规则表达式自动识别事件异常，解释性强且效率远超深度学习方法。
Hypergraph-Guided Regex Filter Synthesis for Event-Based Anomaly Detection
- 基于超图构建实体行为等价类，生成可解释的正则表达式模式。
- 平均精度提升1.2倍，召回率提升1.3倍，优于7种主流无监督方法。
- 适合需要高可解释性的安全监控场景，如日志分析、入侵检测。
我们提出HyGLAD，一种新算法，能自动构建可解释的模式来建模事件数据。这些模式可用于检测静态系统中的事件异常，任何偏离历史行为的情况都可能暗示恶意活动。该算法推断出具有相似行为的实体等价类，并构建捕获这些实体值的正则表达式。与深度学习方法不同，正则表达式具备直接可解释性，从而实现可解释的异常检测。我们在五个来自真实系统的数据集上，将HyGLAD与DeepOD中的全部7种无监督异常检测方法进行了对比。实验结果表明，平均而言，HyGLAD在性能上优于现有深度学习方法，且训练与推理效率高出一个数量级（单个CPU vs GPU）。相比表现最佳的基线，精度提升1.2倍，召回率提升1.3倍。
原文摘要 · Abstract (English)
We propose HyGLAD, a novel algorithm that automatically builds a set of interpretable patterns that model event data. These patterns can then be used to detect event-based anomalies in a stationary system, where any deviation from past behavior may indicate malicious activity. The algorithm infers equivalence classes of entities with similar behavior observed from the events, and then builds regular expressions that capture the values of those entities. As opposed to deep-learning approaches, the regular expressions are directly interpretable, which also translates to interpretable anomalies. We evaluate HyGLAD against all 7 unsupervised anomaly detection methods from DeepOD on five datasets from real-world systems. The experimental results show that on average HyGLAD outperforms existing deep-learning methods while being an order of magnitude more efficient in training and inference (single CPU vs GPU). Precision improved by 1.2x and recall by 1.3x compared to the second-best baseline.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。