Anomaly Detection
What is Anomaly Detection?
The identification of patterns in data that deviate from expected behavior, used in security to detect intrusions, fraud, and other threats.
Terms that appear alongside anomaly detection
Each of these is named in at least one of the same controls as anomaly detection. The number is how many controls name both.
- audit 10 shared controls
- authentication 7 shared controls
- nist 7 shared controls
- integrity 7 shared controls
- owasp 6 shared controls
- access control 4 shared controls
- incident response 4 shared controls
- threat intelligence 4 shared controls
Frameworks that govern anomaly detection
What the standards actually require on anomaly detection
Requirements naming anomaly detection across 6 standards, quoted from the control text.
Implement OT audit + monitoring + anomaly detection per NIST SP 800-82 Rev 3 Chapter 6 (Security Architecture) + Chapter 7. OT audit and logging must (a) capture host audit events from OT workstations + engineering workstations + HMI + historian + AD + identit...
NISTSP82-6 · OT Audit, Monitoring, Anomaly Detection, and OT-Specific SOC →Operate log analysis per NIST SP 800-92 Chapter 5 (Operational Processes) + Section 5.12 (Performing Log Analysis). Correlation and detection rules per Section 5.12.1: implement correlation rules combining signals across sources (authentication + endpoint + ne...
NISTSP92-5 · Log Analysis: Correlation, Baselining, Anomaly Detection, Alerting, Manual Review →Detect anomalous telemetry, attitude changes and command sequences that could indicate cyber compromise of a spacecraft.
SISAC-09 · On-Orbit Anomaly Detection →Operate LLM monitoring + testing + red teaming + user education. Requirements include (a) maintain comprehensive logging for LLM systems including inputs + outputs + tool calls + retrieved content + with appropriate retention + privacy controls + (b) implement...
OWASPLLM-8 · LLM Monitoring, Testing, Red Teaming, and User Education →Security monitoring practices are implemented at the network or infrastructure, application and transaction layers so the DSP can scan its environment for threats and act on anomalies; monitoring is a joint responsibility of the ATO and the DSP.
ato-digital-service-provider-dsp-operational-security-framework::SEC.MONITOR · Security monitoring at network, application and transaction layers →The entity must document and implement an ICT-related incident policy that documents the incident management process of DORA Article 17;
dora-rts-on-ict-risk-management-framework-commission-delegated-regulation-eu-2024-1774::22 · Article 22: ICT-related incident management policy →Questions people ask about anomaly detection
What is Anomaly Detection?
Why is Anomaly Detection important for compliance?
Which compliance frameworks address Anomaly Detection?
Where can I learn more about Anomaly Detection?
See how Anomaly Detection applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.