Abstract: A system and method for detecting one or more anomalies in a plurality of observations is provided. In one illustrative embodiment, the observations are real-time network observations collected from a stream of network traffic. The method includes performing a discrete decomposition of the observations, and introducing derived variables to increase storage and query efficiencies. A mathematical model, such as a conditional independence model, is then generated from the formatted data. The formatted data is also used to construct frequency tables which maintain an accurate count of specific variable occurrence as indicated by the model generation process. The formatted data is then applied to the mathematical model to generate scored data. The scored data is then analyzed to detect anomalies.

Abstract: A system and method for detecting one or more anomalies in a plurality of observations is provided. In one illustrative embodiment, the observations are real-time network observations collected from a stream of network traffic. The method includes performing a discrete decomposition of the observations, and introducing derived variables to increase storage and query efficiencies. A mathematical model, such as a conditional independence model, is then generated from the formatted data. The formatted data is also used to construct frequency tables which maintain an accurate count of specific variable occurrence as indicated by the model generation process. The formatted data is then applied to the mathematical model to generate scored data. The scored data is then analyzed to detect anomalies.

Abstract: A system and method for detecting one or more anomalies in a plurality of observations. In one illustrative embodiment, the observations are real-time network observations collected from a plurality of network traffic. The method includes selecting a perspective for analysis of the observations. The perspective is configured to distinguish between a local data set and a remote data set. The method applies the perspective to select a plurality of extracted data from the observations. A first mathematical model is generated with the extracted data. The extracted data and the first mathematical model is then used to generate scored data. The scored data is then analyzed to detect anomalies.