  The problem of anomaly localization in a resource-constrained cyber system is
considered. Each anomalous component of the system incurs a cost per unit time
until its anomaly is identified and fixed. Different anomalous components may
incur different costs depending on their criticality to the system. Due to
resource constraints, only one component can be probed at each given time. The
observations from a probed component are realizations drawn from two different
distributions depending on whether the component is normal or anomalous. The
objective is a probing strategy that minimizes the total expected cost,
incurred by all the components during the detection process, under reliability
constraints. We consider both independent and exclusive models. In the former,
each component can be abnormal with a certain probability independent of other
components. In the latter, one and only one component is abnormal. We develop
optimal simple index policies under both models. The proposed index policies
apply to a more general case where a subset (more than one) of the components
can be probed simultaneously and have strong performance as demonstrated by
simulation examples. The problem under study also finds applications in
spectrum scanning in cognitive radio networks and event detection in sensor
networks.
