Mei-Ling Ho

Rare-Event Memory Updating for Low-Frequency Threat Discovery in Streaming Security Logs

Security operation centers receive continuous log streams from firewalls, endpoint agents, authentication systems, cloud services, and intrusion prevention systems. Low-frequency anomalies are difficult to detect because they may appear as weak signals hidden among repeated benign events and gradually changing operatio...