We propose a hybrid approach to temporal anomaly detection in access data of
users to databases --- or more generally, any kind of subject-object
co-occurrence data. We consider a high-dimensional setting that also requires
fast computation at test time. Our methodology identifies anomalies based on a
single stationary model, instead of requiring a full temporal one, which would
be prohibitive in this setting. We learn a low-rank stationary model from the
training data, and then fit a regression model for predicting the expected
likelihood score of normal access patterns in the future. The disparity between
the predicted likelihood score and the observed one is used to assess the
`surprise' at test time. This approach enables calibration of the anomaly
score, so that time-varying normal behavior patterns are not considered
anomalous. We provide a detailed description of the algorithm, including a
convergence analysis, and report encouraging empirical results. One of the data
sets that we tested, TDA, is new for the public domain. It consists of two
months' worth of database access records from a live system. Our code is
publicly available at this https URL The
TDA data set is available at
this https URL

本文提出了一种混合方法，用于检测用户对数据库的访问数据中的时间异常，该方法使用单个稳态模型进行异常检测，学习一个低秩稳态模型然后拟合回归模型来预测未来正常访问模式的期望可能性得分，然后使用观察到的得分和预测得分之间的差异来评估异常得分，使得时间变化的正常行为模式不被视为异常，实验结果表明了该方法的有效性。