rvice. Generally, the responsibility of network services is to transport traffic from origin to one or more destinations. As a network service provider, confidentiality of data travers- ing the network is important. However, assuring service availability is also important. It is a fact that customers of any large network service will have security issues that are beyond the control or even influence of the network service provider-compromised machines, botnets, DDoS attacks to name a few. The objective of security analytics in this environment is not to police the network. The objective is to provide a mean to detect attack vectors, trends, and indicators that might ultimately impact the service that is being provided to customers. This is often more of a quantitative assessment of activity rather than a matter of detecting discrete events. For example, we do not want a security issue that one customer has to impact the service to any other customer. 9.5.1.1 Components of Security Analysis Any analysis function to result in some sort of response action. Often, analysis algorithms focus on the concept of "anomaly detection." However, there are a number of other functions that are neces- sary to result in appropriate responses. 1. Data prefiltering and selection-there are endless sources and types of available data. It is important to select robust and concise data as well as data formats that will provide good indicators of events of interest on the network and infrastructure. Anomaly detection is a means to flag situations that are of interest. This includes both sig- nature-based detection as well as detecting abnormal behavior (e.g., volumetric events). Details collection and characterization-this step may include correlation, but correla- tion is a subset of details collection. The objective is to find and collect any related data that might be relevant to interpreting and quantifying the event. For example, if there is a volumetric anomaly during a certain time period on a particular TCP port, identify what a