Skip to main content
Security Informatics
Figure 1 | Security Informatics

Figure 1

From: Specializing network analysis to detect anomalous insider actions

Figure 1

The specialized network anomaly detection (SNAD) framework. This figure depicts the architecture of SNAD. It consists of two components: 1) Similarity Measurement (SNAD-SM) and 2) Anomaly Evaluation (SNAD-AE). The SNAD-SM component constructs local access networks and measures the similarity of the users in such networks. The SNAD-AE component assesses the extent to which suppression of a user from a local access network changes its similarity.

Back to article page