COLD START MECHANISM TO PREVENT COMPROMISE OF AUTOMATIC ANOMALY DETECTION SYSTEMS

摘要

In one embodiment, a device in a network analyzes data indicative of a behavior of a network using a supervised anomaly detection model. The device determines whether the supervised anomaly detection model detected an anomaly in the network from the analyzed data. The device trains an unsupervised anomaly detection model, based on a determination that no anomalies were detected by the supervised anomaly detection model.

主权项

1. A method, comprising:
analyzing, by a device in a network, data indicative of a behavior of the network using a supervised anomaly detection model; determining, by the device, whether the supervised anomaly detection model detected an anomaly in the network from the analyzed data; and training, by the device, an unsupervised anomaly detection model, based on a determination that no anomalies were detected by the supervised anomaly detection model.