Collaborative Research: Real-Time Data-Driven Anomaly Detection for Complex Networks

协作研究：复杂网络的实时数据驱动异常检测

基本信息

批准号：
2040500
负责人：
Xiaodong Wang
金额：
$ 22.5万
依托单位：
Columbia University
依托单位国家：
美国
项目类别：
Standard Grant
财政年份：
2021
资助国家：
美国
起止时间：
2021-08-15 至 2024-07-31
项目状态：
已结题

来源：
https://www.nsf.gov/awardsearch/showAward?AWD_ID=2040500&HistoricalAwards=false
关键词：
Collaborative Research Real Time Data

项目摘要

Anomaly detection is an important problem dealing with the detection of abnormal data patterns. Importance of anomaly detection lies in the fact that an anomaly in the observed data may be a sign of an unwanted and often actionable event such as failure, malicious activity, etc. in the underlying system. In many real-time systems, timely and accurate detection of abnormal data patterns is crucial, and will allow proper countermeasures to be taken in a timely manner, to counteract any possible harm. Although anomaly detection has long been studied, today's complex networks exhibit new challenges, such as: low latency requirements, data size, system dynamics, unknown distributions, distributed nature, and privacy. The objective of this proposal is to investigate effective and scalable approaches for real-time data-driven anomaly detection in complex systems with these challenges. The main themes of this proposal address multiple important problems in the early detection of anomalies and attacks in a general complex network setting. Considering the importance of cybersecurity in today's world, methodologies to understand and forewarn changes in the organizational dynamics of such complicated networks is of immense significance. This proposal directly addresses these issues by bringing a fresh and novel set of engineering tools and ideas.Following a systematic approach, this project first considers (1) how to timely detect anomalies in centralized high-dimensional systems with dynamicity and hidden anomaly challenges; (ii) how to deal with resource constraints in monitoring distributed systems; and (iii) how to enable privacy-preserving solutions for real-time anomaly detection in distributed systems. These challenges and the solution methods presented in this project are generally applicable to a variety of complex systems. To be specific, this project focuses on two challenging IoT networks: surveillance camera network and smart home network. The proposed approaches exploit an array of advanced techniques including sequential change detection, deep reinforcement learning, event-triggered processing, and differential privacy, and will bring significant innovations to the theory and applications of anomaly detection. In particular, the practical use of proposed algorithms will be demonstrated and their performance will be evaluated with respect to the state of the art using hardware implementations of two IoT networks - a surveillance camera network and a smart home network.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

异常检测是处理异常数据模式检测的一个重要问题。异常检测的重要性在于，观察到的数据中的异常可能是底层系统中不需要的且通常可操作的事件的迹象，例如故障、恶意活动等。在许多实时系统中，及时准确地检测异常数据模式至关重要，并且可以及时采取适当的对策，以消除任何可能的危害。尽管异常检测早已被研究，但当今的复杂网络呈现出新的挑战，例如：低延迟要求、数据大小、系统动态、未知分布、分布式性质和隐私。该提案的目标是研究有效且可扩展的方法，在面临这些挑战的复杂系统中进行实时数据驱动的异常检测。该提案的主题解决了一般复杂网络环境中早期检测异常和攻击的多个重要问题。考虑到网络安全在当今世界的重要性，理解和预警此类复杂网络的组织动态变化的方法具有巨大的意义。该提案通过带来一套新颖的工程工具和思想来直接解决这些问题。遵循系统方法，该项目首先考虑（1）如何及时检测具有动态性和隐藏异常挑战的集中式高维系统中的异常； (ii) 如何处理监控分布式系统的资源限制； (iii) 如何在分布式系统中启用实时异常检测的隐私保护解决方案。本项目提出的这些挑战和解决方法普遍适用于各种复杂系统。具体来说，该项目重点关注两个具有挑战性的物联网网络：监控摄像头网络和智能家居网络。所提出的方法利用了一系列先进技术，包括顺序变化检测、深度强化学习、事件触发处理和差异隐私，将为异常检测的理论和应用带来重大创新。特别是，将展示所提出算法的实际用途，并使用两个物联网网络（监控摄像头网络和智能家居网络）的硬件实现根据最新技术水平评估其性能。该奖项反映了 NSF 的法定使命通过使用基金会的智力优点和更广泛的影响审查标准进行评估，并被认为值得支持。