{"id":2955,"date":"2020-07-23T11:30:24","date_gmt":"2020-07-23T09:30:24","guid":{"rendered":"https:\/\/www.haruspexsecurity.com\/?p=2955"},"modified":"2020-07-23T12:27:48","modified_gmt":"2020-07-23T10:27:48","slug":"the-illusion-of-context-independent-anomaly-detection","status":"publish","type":"post","link":"https:\/\/www.haruspexsecurity.com\/it\/the-illusion-of-context-independent-anomaly-detection\/","title":{"rendered":"The Illusion of Context Independent Anomaly Detection"},"content":{"rendered":"<p class=\"has-drop-cap\">An interesting review report from Algorithm Watch points out the complete failure of 3 automated systems in use by the Swiss police and judiciary to predict anomalous behaviour. As an example, one of the systems tries to predicts burglaries from past data, based on the assumption that burglars often operate in small areas. Hence, if a cluster of burglaries is detected in a neighbourhood, the police should patrol it more often to put an end to it. It seems that this analysis is inspired by one of the first big data analysis that revealed a cluster of infected people around infected water fountains in London at the beginning of the last century. Another system in use in Switzerland aims to predict the likelihood that a person will assault his\/her intimate partner. The cost of each system is close to 100.000 euros.<br>\u00a0<br>\u00a0According to Algorithm Watch this failure is hardly a surprise because it has been anticipated by previous analyses. As an example, a 2019 report by the University of Hamburg has reported the lack of any evidence of the efficacy of predictive policing solutions. Furthermore, the false positive rate and the false negative one of these predictive systems both lie in the range 70\u201380%. Notice this holds even if fully accurate data on the problem of interest is used. Imagine what could happen if some database is poisoned with some carefully designed data.<br>\u00a0<br>\u00a0The failure of predictive AI points out a too optimistic attitude towards AI techniques and it should ring a bell for all those that believe that anomaly detection per se suffices to discover and signal attacks against an ICT system. Almost all of these systems are deployed under the assumption (hope??) that they can work without information on the target system, the applications and the security policies that have been adopted. The price to pay for the lack of this information are unacceptable rates of false positive and false negative. Experience confirms that these rates are dramatically reduced by taking into account constraints arising because of the system architecture, the interconnection topology and available applications.<br>\u00a0<br>\u00a0<br>\u00a0Link\u00a0<\/p>\n\n\n\n<p><a href=\"https:\/\/algorithmwatch.org\/en\/story\/swiss-predictive-policing\/\">https:\/\/algorithmwatch.org\/en\/story\/swiss-predictive-policing\/<\/a><\/p>\n\n\n\n<p class=\"has-drop-cap\"><\/p>","protected":false},"excerpt":{"rendered":"<p>An interesting review report from Algorithm Watch points out the complete failure of 3 automated systems in use by the Swiss police and judiciary to predict anomalous behaviour. As an example, one of the systems tries to predicts burglaries from past data, based on the assumption that burglars often operate in small areas. Hence, if [&hellip;]<\/p>","protected":false},"author":1,"featured_media":2957,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>The Illusion of Context Independent Anomaly Detection - Haruspex<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.haruspexsecurity.com\/it\/the-illusion-of-context-independent-anomaly-detection\/\" \/>\n<meta property=\"og:locale\" content=\"it_IT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Illusion of Context Independent Anomaly Detection - Haruspex\" \/>\n<meta property=\"og:description\" content=\"An interesting review report from Algorithm Watch points out the complete failure of 3 automated systems in use by the Swiss police and judiciary to predict anomalous behaviour. As an example, one of the systems tries to predicts burglaries from past data, based on the assumption that burglars often operate in small areas. Hence, if [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.haruspexsecurity.com\/it\/the-illusion-of-context-independent-anomaly-detection\/\" \/>\n<meta property=\"og:site_name\" content=\"Haruspex\" \/>\n<meta property=\"article:published_time\" content=\"2020-07-23T09:30:24+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-07-23T10:27:48+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/hief-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"2050\" \/>\n\t<meta property=\"og:image:height\" content=\"780\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Scritto da\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tempo di lettura stimato\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minuti\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/ba9bb2a47928bbcee8f611f1fccde3b1\"},\"headline\":\"The Illusion of Context Independent Anomaly Detection\",\"datePublished\":\"2020-07-23T09:30:24+00:00\",\"dateModified\":\"2020-07-23T10:27:48+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/\"},\"wordCount\":359,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/hief-1.png\",\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/\",\"url\":\"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/\",\"name\":\"The Illusion of Context Independent Anomaly Detection - Haruspex\",\"isPartOf\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/hief-1.png\",\"datePublished\":\"2020-07-23T09:30:24+00:00\",\"dateModified\":\"2020-07-23T10:27:48+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#breadcrumb\"},\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#primaryimage\",\"url\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/hief-1.png\",\"contentUrl\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/hief-1.png\",\"width\":2050,\"height\":780},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.haruspexsecurity.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Illusion of Context Independent Anomaly Detection\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#website\",\"url\":\"https:\/\/www.haruspexsecurity.com\/\",\"name\":\"Haruspex\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.haruspexsecurity.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"it-IT\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#organization\",\"name\":\"Haruspex\",\"url\":\"https:\/\/www.haruspexsecurity.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/01\/cropped-NewissimoLogoBigBlack-3.png\",\"contentUrl\":\"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/01\/cropped-NewissimoLogoBigBlack-3.png\",\"width\":6920,\"height\":1858,\"caption\":\"Haruspex\"},\"image\":{\"@id\":\"https:\/\/www.haruspexsecurity.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/ba9bb2a47928bbcee8f611f1fccde3b1\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/dcc17c0300d18055ae340c8615d9fbe8?s=96&d=retro&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/dcc17c0300d18055ae340c8615d9fbe8?s=96&d=retro&r=g\",\"caption\":\"admin\"},\"url\":\"https:\/\/www.haruspexsecurity.com\/it\/author\/admin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The Illusion of Context Independent Anomaly Detection - Haruspex","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.haruspexsecurity.com\/it\/the-illusion-of-context-independent-anomaly-detection\/","og_locale":"it_IT","og_type":"article","og_title":"The Illusion of Context Independent Anomaly Detection - Haruspex","og_description":"An interesting review report from Algorithm Watch points out the complete failure of 3 automated systems in use by the Swiss police and judiciary to predict anomalous behaviour. As an example, one of the systems tries to predicts burglaries from past data, based on the assumption that burglars often operate in small areas. Hence, if [&hellip;]","og_url":"https:\/\/www.haruspexsecurity.com\/it\/the-illusion-of-context-independent-anomaly-detection\/","og_site_name":"Haruspex","article_published_time":"2020-07-23T09:30:24+00:00","article_modified_time":"2020-07-23T10:27:48+00:00","og_image":[{"width":2050,"height":780,"url":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/hief-1.png","type":"image\/png"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Scritto da":"admin","Tempo di lettura stimato":"2 minuti"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#article","isPartOf":{"@id":"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/"},"author":{"name":"admin","@id":"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/ba9bb2a47928bbcee8f611f1fccde3b1"},"headline":"The Illusion of Context Independent Anomaly Detection","datePublished":"2020-07-23T09:30:24+00:00","dateModified":"2020-07-23T10:27:48+00:00","mainEntityOfPage":{"@id":"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/"},"wordCount":359,"commentCount":0,"publisher":{"@id":"https:\/\/www.haruspexsecurity.com\/#organization"},"image":{"@id":"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#primaryimage"},"thumbnailUrl":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/hief-1.png","inLanguage":"it-IT","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/","url":"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/","name":"The Illusion of Context Independent Anomaly Detection - Haruspex","isPartOf":{"@id":"https:\/\/www.haruspexsecurity.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#primaryimage"},"image":{"@id":"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#primaryimage"},"thumbnailUrl":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/hief-1.png","datePublished":"2020-07-23T09:30:24+00:00","dateModified":"2020-07-23T10:27:48+00:00","breadcrumb":{"@id":"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#breadcrumb"},"inLanguage":"it-IT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/"]}]},{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#primaryimage","url":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/hief-1.png","contentUrl":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/07\/hief-1.png","width":2050,"height":780},{"@type":"BreadcrumbList","@id":"https:\/\/www.haruspexsecurity.com\/the-illusion-of-context-independent-anomaly-detection\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.haruspexsecurity.com\/"},{"@type":"ListItem","position":2,"name":"The Illusion of Context Independent Anomaly Detection"}]},{"@type":"WebSite","@id":"https:\/\/www.haruspexsecurity.com\/#website","url":"https:\/\/www.haruspexsecurity.com\/","name":"Haruspex","description":"","publisher":{"@id":"https:\/\/www.haruspexsecurity.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.haruspexsecurity.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"it-IT"},{"@type":"Organization","@id":"https:\/\/www.haruspexsecurity.com\/#organization","name":"Haruspex","url":"https:\/\/www.haruspexsecurity.com\/","logo":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.haruspexsecurity.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/01\/cropped-NewissimoLogoBigBlack-3.png","contentUrl":"https:\/\/www.haruspexsecurity.com\/wp-content\/uploads\/2020\/01\/cropped-NewissimoLogoBigBlack-3.png","width":6920,"height":1858,"caption":"Haruspex"},"image":{"@id":"https:\/\/www.haruspexsecurity.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/ba9bb2a47928bbcee8f611f1fccde3b1","name":"admin","image":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/www.haruspexsecurity.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/dcc17c0300d18055ae340c8615d9fbe8?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/dcc17c0300d18055ae340c8615d9fbe8?s=96&d=retro&r=g","caption":"admin"},"url":"https:\/\/www.haruspexsecurity.com\/it\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/posts\/2955"}],"collection":[{"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/comments?post=2955"}],"version-history":[{"count":3,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/posts\/2955\/revisions"}],"predecessor-version":[{"id":2959,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/posts\/2955\/revisions\/2959"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/media\/2957"}],"wp:attachment":[{"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/media?parent=2955"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/categories?post=2955"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.haruspexsecurity.com\/it\/wp-json\/wp\/v2\/tags?post=2955"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}