Metraipolis › archive › dc_aaa15ef5ef51

Combining Exploratory Analysis and Automated Analysis for Anomaly Detection in Real-Time Data Streams — arXiv:2609.21222

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.21222
License (as archived): CC0-1.0
Archived: 2026-10-10T01:43:44.619Z
SHA-256 of the archived text: 18d6bcf5c1aaef48767cb6a247570eef4d4c1bc09cea8f86751f0673535a7a9e
Stable URL of this page: https://metraipolis.com/documento/dc_aaa15ef5ef51

How to cite

Combining Exploratory Analysis and Automated Analysis for Anomaly Detection in Real-Time Data Streams — arXiv:2609.21222 — arXiv (en), https://arxiv.org/abs/2609.21222 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_aaa15ef5ef51 (Metraipolis archive dc_aaa15ef5ef51, sha256 18d6bcf5c1aaef48767cb6a247570eef4d4c1bc09cea8f86751f0673535a7a9e)

BibTeX

@misc{dcaaa15ef5ef51,
  title = {Combining Exploratory Analysis and Automated Analysis for Anomaly Detection in Real-Time Data Streams — arXiv:2609.21222},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.21222},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_aaa15ef5ef51; sha256 18d6bcf5c1aaef48767cb6a247570eef4d4c1bc09cea8f86751f0673535a7a9e},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.21222. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Security analysts can become overwhelmed with monitoring real-time security information that is important to help them defend their network. They also tend to focus on a limited portion of the alerts, and therefore risk missing important events and links between them. At the heart of the problem is the system that analysts use to detect, explore, and respond to cyber-attacks. Developers of security analysis systems face the challenge of developing a system that can present different sources of information at multiple levels of abstraction, while also creating a system that is intuitive to use. In this article, we examine the complementary nature of exploratory analysis and automated analysis by testing the development of a system that monitors real-time Border Gateway Protocol (BGP) traffic for anomalies that might indicate security threats. BGP is an essential component for supporting the infrastructure of the Internet; however, it is also highly vulnerable and can be hijacked by attackers to propagate spam or launch denial-of-service attacks. Some of the attack scenarios on the BGP infrastructure can be quite elaborate, and it is difficult, if not impossible, to fully automate the detection of such attacks. This article makes two contributions: i) it describes a prototype platform for computing indicators and threat alerts in real time and for visualizing the context of an alert, and ii) it discusses the interaction of exploratory analysis (visualization) and automated analysis. This article is relevant to students, security researchers, and developers who are interested in the development or use of real-time security monitoring systems. They will gain insights into the complementary aspects of automated analysis and exploratory analysis through the development of a real-time streaming system.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-21 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2609.21222 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-10T01:13:42.014Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-21?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).