Mastering Machine Learning for Penetration Testing

Static rules technique

If we have training data, then we need to check that the data is balanced. If we don't have training data, the decision will be made based on the anomaly type; to detect point anomalies, it is recommended that you use percentiles and histograms. To detect collective anomalies, the decision will be based on the variance of the anomalies; to detect univariate anomalies, you can use Markov chains, or you can build a model and look at the residue. In a multivariate situation, we can use clustering and Markov models (if the anomalies are ordered) or k-Nearest-Neighbors (if the anomalies are unordered).

The different techniques are represented in the following diagram: