200-201 Question 34
Single answerYou are monitoring network traffic for anomalies using a sliding window anomaly detection algorithm. During a 10-minute observation window, the average packet rate for a specific server is 200 packets per second (pps). However, in the last 2 minutes of the window, the packet rate spikes to 600 pps. Which of the following best describes how sliding window anomaly detection would respond to this scenario?
- A
The algorithm immediately flags the activity as anomalous since the packet rate exceeds the threshold for the entire observation window.
- B
The algorithm flags the activity as anomalous since the packet rate in the last 2 minutes deviates significantly from the average of the entire observation window.
- C
The algorithm does not flag the activity as anomalous because the overall average packet rate across the 10-minute window remains below the threshold.
- D
The algorithm flags the activity as anomalous only if the packet rate spike is sustained for the entire observation window.
Show answer and explanation
Correct answer: B
Explanation
Sliding window anomaly detection methods compare data within smaller portions of the observation window, identifying anomalies based on deviations that occur within those subsets. In this case, the packet rate spike in the last 2 minutes significantly deviates from the overall average, prompting the algorithm to flag it as anomalous.
- A. Incorrect.
Sliding window anomaly detection does not rely on immediate flagging for the entire window but instead evaluates deviations within the moving window.
- B. Correct.
This is correct because the sliding window anomaly detection method identifies anomalies based on significant deviations in subsets of data, such as the last 2 minutes compared to the overall average.
- C. Incorrect.
This is incorrect because the anomaly detection mechanism evaluates deviations within portions of the window, not just the overall average.
- D. Incorrect.
This is incorrect because sliding window algorithms do not require an anomaly to persist for the entire window to flag it; even short-term spikes can be detected.