Intrusion Detection approaches for Anomaly Detection still rely on the Analyst not Software

Typical approaches for Anomaly Detection

1. Statistical anomaly detection using 90th and 99th percentile T-Digest Algorithm, Time Series Analysis, Heavy Hitters, TopK
2. Distance based methods like SimHash and LSH on features
3. Rule-based detection using Data Mining (geoLocation, login behaviors per day, workstation, time)
4. Signature-based detection using Snort and BRO
5. Model based AD built on tons of features for DNS traffic, Users, Servers
6. Change Detection
7. Machine Learning

Typical approaches for Analyst ad-hoc query detection

1. Visual Analysis
2. Alert investigation
3. Correlation Analysis
4. Search
5. SQL
6. Time Series Analysis
7. Graph Processing Queries