Which of the following is the first step to take when creating an anomaly detection process?

The foundational step in an anomaly detection technique or process is establishing a

model of normal behavior, which is known as a baseline. This baseline typically

represents the expected or legitimate state and activity of a system or network. It

serves as the reference point against which new observations and events are

compared to identify significant deviations, i.e., anomalies. Without a defined baseline,

it's impossible to distinguish anomalous activities from normal ones because there's no

established "normal" to compare against. Academic literature on anomaly detection

techniques consistently identifies building this normal profile as the initial phase of the

detection methodology itself.

· A. Selecting events: This is a crucial preliminary step related to data acquisition or

feature engineering. It involves deciding which data points or types of activities are

relevant for monitoring and will be used to build the baseline, but it precedes the

actual baseline construction within the anomaly detection technique.

· C. Selecting logging options: This pertains to the configuration of data collection

mechanisms. While necessary to gather the data required for building a baseline, it's

an operational prerequisite and not the first step of the analytical anomaly detection

process itself.

· D. Creating an event log: An event log is the repository of recorded data. While this

data is essential input for building a baseline, the act of creating the log is part of data

collection, which feeds into the anomaly detection process rather than being its first

analytical step.

1. Chandola, V., Banerjee, A., & Kumar, V. (2009). Anomaly detection: A survey.

ACM Computing Surveys (CSUR), 41(3), Article 15, 1–58.

o DOI: https://doi.org/10.1145/1541880.1541882

o Page/Section: Page 15:6 (PDF page 6), Section II.A, "General Steps for Anomaly

Detection." The text states: "Most anomaly detection techniques typically consist of two

steps: 1. Building a profile of the “normal” behavior of the system. This profile is also

known as a “model” or a “baseline.” This step is usually carried out in a training phase

using data that represents normal behavior." This directly supports that building the

normal profile (baseline) is the first step of the anomaly detection technique.

2. NIST Special Publication 800-94. (2007). Guide to Intrusion Detection

and Prevention Systems (IDPS).

o URL: https://csrc.nist.gov/publications/detail/sp/800-94/final

o Page/Section: Page 3-4 (PDF page 26), Section 3.3.2 "Anomaly Detection." The text

describes: "Anomaly detection is the process of comparing definitions of what is

considered normal activity against observed events to identify significant deviations. An

IDPS using anomaly detection has detector(s) that create a baseline or learned profile

of normal system, network, or program behavior." This highlights the creation of a

baseline as integral to how anomaly detection functions. While it doesn't explicitly state

"first step in creating the process," it emphasizes the baseline as the definition of

normal, which must be established before comparison can occur.

3. Microsoft Azure Documentation. (Accessed 2024). Anomaly Detector -

Overview - Concepts - Multivariate anomaly detection.

o URL: (Note: Specific URLs within Azure docs can change, search for "Azure

Anomaly Detector multivariate concepts" in the official Azure documentation. A typical

path might involve: https://learn.microsoft.com/en-us/azure/cognitiveservices/anomaly-detector/concepts/overview-multivariate) Example historical URL

structure: https://learn.microsoft.com/en-us/azure/ai-services/anomalydetector/concepts/multivariate-anomaly-detection-overview (This link might need

updating to the current version)

o Page/Section: The workflow described for multivariate anomaly detection typically

involves data ingestion followed by model training. For instance, "Your model is trained

with the Anomaly Detector multivariate APIs..." The training of the model is

synonymous with building a baseline of normal behavior from the ingested data.

While data ingestion precedes model training in the overall service usage workflow, the

"training" (baseline building) is the first step in creating the actual detection model. This

supports that building the baseline is the primary analytical step after data acquisition.