SAQL: A stream-based query system for real-time abnormal system behavior detection

Keyphrases

• Abnormal Behavior 66%
• Anomaly Detection 33%
• Anomaly-based 33%
• Attack Behavior 33%
• Behavior-based 33%
• Big Data 33%
• Complex Event Processing 33%
• Critical Missions 33%
• Cyber-attacks 33%
• Detection Latency 33%
• Domain-specific Query Language 33%
• Expert Knowledge 66%
• Invariant-based 33%
• Low Detection 33%
• Memory Consumption 33%
• Micro-benchmarks 33%
• Misbehavior Detection 100%
• Monitoring Data 33%
• Monitoring System 33%
• Multiple Hosts 33%
• Processing System 33%
• Provenance Data 33%
• Query Engine 33%
• Query System 100%
• Real System 33%
• Rule-based 33%
• Sequence of Steps 33%
• Stream-based 100%
• System Behavior 100%
• System Monitoring 33%
• System Throughput 33%
• Time Series Anomaly 33%
• Triage 33%
• Vulnerability 33%

Computer Science

• Anomaly Detection 50%
• Big Data 50%
• Complex Event Processing 50%
• Cyber Attack 50%
• Data Provenance 50%
• Expert Knowledge 100%
• Memory Utilization 50%
• Monitoring Data 50%
• Processing System 50%
• Query Engine 50%
• Query Language 50%
• System Activity 50%
• System Behavior 100%