Event Recognition Beyond Signature and Anomaly

Notions of signature and anomaly have formed the basis of useful methods in cyber defense, but even in combination provide only weak evidence for recognizing many events of interest. One can recognize many impor- tant events without requiring signatures of speciflc ways the events can take place and without treating every anoma- lous behavior as an event. We describe an approach to event recognition that subsumes and extends signature and anomaly methods by starting from a richer language for characterizing events. This paper explains how recogni- tion methods based on this richer event-characterization language ofier means for overcoming the limitations con- straining signature and anomaly methods.