Anomaly detection

A frame-based system burns compute analyzing unchanging pixels, while an event sensor stays quiet until something actually moves.

Two, anomaly detection with sensor-level background subtraction.

For a fixed surveillance camera, a static event sensor only generates events for moving objects, and background subtraction happens in the sensor rather than in software.

Researchers have used exactly this property for video anomaly detection, circumventing the optical flow or 3D convolution steps that frame-based anomaly networks normally need.

Source: EVAN, Neuromorphic Event-based Anomaly Detection, arXiv nineteen eleven oh nine seven two two.

Less motion modeling in software means a lighter, cheaper edge pipeline.

Three, brutal lighting.

https://arxiv.org/pdf/2504.08588.

My concern is that once the techniques, TTPs and IOCs, if you will, are published and they're public...

Most attackers are going to pivot their techniques to get around that, which is why I think one of the initiatives on everyone's brain is how do we do anomaly detection? So we're looking for less specific things that happen and more generic behaviors that happen.

Because these devices, one thing that works to our advantage, though, on these devices, and I was talking to our mutual coworker, one of our coworkers about this, one of the things that works to our advantage is the underlying operating system, Linux or usually Linux, sometimes BSD, is not something that is actively being used, managed, and maintained by the user, by the admins, right? Right.

The admins are using a router, a VPN, a firewall, or a switch at the higher level to configure the functionality.

Much harder to actually hunt because more changes are expected on those systems.

But network appliances, there's a lot less change that's expected.

And I think as an industry, we can do better with this anomaly detection system.

On these devices, I also think, you know, enterprise teams that are doing instant response and threat hunting can do a much better job because there's just stuff that shouldn't change and be modified in the normal course of an appliance edge appliance life.