Price: 0
Number of applications: 2
22.12.25 (inclusive)
monetary
MVP
ICT tasks
мобильные приложения
мобильное приложение
Mobile app
If we consider the problem in terms of machine learning, then we are talking about a classifier that receives an arbitrary sequence of events as input and should return the label {OK, INCIDENT}. The requirement of simultaneous absence of false positives and omissions for *all* possible data distributions contradicts the well-known results about the "absence of a free lunch" in training: there is no single algorithm that would be the best for all possible classification tasks. Any model contains a priori assumptions about the structure of the data; on data that contradicts these assumptions, it will be wrong.
The idea of a single ideal detector that accurately separates "norm" and "anomaly" for any future data is methodologically untenable. Any practically useful solution inevitably makes assumptions about what incidents and normal behavior look like; on data outside of these assumptions, it will be wrong. Therefore, the initial formulation of the problem — to obtain a model without false positives and negative positives in all scenarios — is fundamentally impossible. Real systems are built around compromises: thresholds, manual tuning, and constant reassessment of detection quality.
Sergeev I.A.
Purpose and description of task (project)
As the number of mobile app users increased, the customer faced an avalanche of logs and metrics. The security team would like to have a model that: • detects all real incidents (attacks, leaks, critical bugs) in log and telemetry streams; • never issues false alarms for benign events; • automatically adapts to any future changes in user behavior and infrastructure; • does not require manual configuration of the rules. What was needed was, in fact, an "ideal anomaly detector" that works like a black box and is guaranteed to distinguish dangerous behavior from safe behavior for any possible input data.
Whatsapp
