Anomaly Detection

Anomaly detection is mainly a data-mining process and is used to determine the types of anomalies occurring in a given data set and to determine details about their occurrences. It is applicable in domains such as fraud detection, intrusion detection, fault detection, system health monitoring and event detection systems in sensor networks. In the context of fraud and intrusion detection, the anomalies or interesting items are not necessarily the rare items but those unexpected bursts of activities. These types of anomalies do not conform to the definition of anomalies or outliers as rare occurrences, so many anomaly detection methods do not work in these instances unless they have been appropriately aggregated or trained. So, in these cases, a cluster analysis algorithm may be more suitable for detecting the microcluster patterns created by these data points.

Techniques for anomaly detection include:

• One-class support vector machines
• Determination of records that deviate from learned association rules
• Distance-based techniques
• Replicator neural networks
• Cluster analysis-based anomaly detection

Specific techniques for anomaly detection in security applications include:

• Profiling methods
• Statistical methods
• Rule-based systems
• Model-based approaches
• Distance based methods