I think people here could guide me in solving a problem related to anomaly detection. The term anomaly here refers to some malware attack.I could get information about the malware infection from more than one source. For example extracting value from two different data strututres and if the value is different it is certain that virus infection is there.In order to remove the false positive cases, information is gathered from different data strutres or mechanisms. In that certain information are less trusted and certain information are more trusted.I am looking for a mathematical method, that could easily handle this type of situations?Update 1:Its applied in Linux Kernel for detecting some kind of anomalies. But the problem is that if the kernel is affected you cant trust anyone. But some behavior can tell you that anomaly is there. But some others not Update 2:Current models mainly depends on archived copy of the system before infection and then compare it with the new state. I am looking for some other method like(1) Certain variables cant be accessed by a normal module(2) Information given by command should match(3) Module code didn't have any jmp instructions oftenIn these (3) is allowed to some extent. But (1) is disallowed. The (2) should certainly match. Hope now things are clear.
Help needed on method to use for anomaly detection
cr.crypto security;formal modeling;data mining
First of all, I warn that things aren't that simple. Up until now, researchers haven't came up with a perfect algorithm to do that (and I'm almost sure they never will!)However, there are many competing approaches to do what you want. They compete in efficiency, false-positive rate, false-negative rate, and so on.The model is as follows: Assume you have a number of algorithms (fuzzy, genetic, neural net, etc.) which process (possibly different) streams of data, and generate alerts if they find anomaly. You then have a stream of alerts, which must be correlated by another algorithm. Unsurprisingly, such algorithm is called alert correlation.You can find hundreds of papers on this subject here. While this term is usually applied to IDS algorithms, there's nothing preventing you from applying it to antivirus algorithms.