Anomaly Detection

What Does Anomaly Detection Mean?

Anomaly detection is the identification of data points, items, observations or events that do not conform to the expected pattern of a given group. These anomalies occur very infrequently but may signify a large and significant threat such as cyber intrusions or fraud.

Anomaly detection is heavily used in behavioral analysis and other forms of analysis in order to aid in learning about the detection, identification and prediction of the occurrence of these anomalies.

Anomaly detection is also known as outlier detection.

Techopedia Explains Anomaly Detection

Anomaly detection is mainly a data-mining process and is used to determine the types of anomalies occurring in a given data set and to determine details about their occurrences. It is applicable in domains such as fraud detection, intrusion detection, fault detection, system health monitoring and event detection systems in sensor networks. In the context of fraud and intrusion detection, the anomalies or interesting items are not necessarily the rare items but those unexpected bursts of activities. These types of anomalies do not conform to the definition of anomalies or outliers as rare occurrences, so many anomaly detection methods do not work in these instances unless they have been appropriately aggregated or trained. So, in these cases, a cluster analysis algorithm may be more suitable for detecting the microcluster patterns created by these data points.

Techniques for anomaly detection include:

• One-class support vector machines
• Determination of records that deviate from learned association rules
• Distance-based techniques
• Replicator neural networks
• Cluster analysis-based anomaly detection

Specific techniques for anomaly detection in security applications include:

• Profiling methods
• Statistical methods
• Rule-based systems
• Model-based approaches
• Distance based methods