A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Kernel Function using Fuzzy Approach <s> Most existing intrusion detection systems use signature-based approach to detect intrusions in audit data streams. This approach has a serious drawback. It cannot protect against novel types of attacks. Thereby there is a growing interest to application of data mining and machine learning methods to intrusion detection. This paper presents a new method for mining outliers designed for application in network intrusion detection systems. This method involves kernel-based fuzzy clustering technique. Network audit records are considered as vectors with numeric and nominal attributes. These vectors are implicitly mapped by means of a special kernel function into a high dimensional feature space, where the possibilistic clustering algorithm is applied to calculate the measure of ”typicalness” and to discover outliers. The performance of the suggested method is evaluated experimentally over KDD CUP 1999 data set. <s> BIB001 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Kernel Function using Fuzzy Approach <s> The paper discusses outlier detection algorithms used in data mining systems. Basic approaches currently used for solving this problem are considered, and their advantages and disadvantages are discussed. A new outlier detection algorithm is suggested. It is based on methods of fuzzy set theory and the use of kernel functions and possesses a number of advantages compared to the existing methods. The performance of the algorithm suggested is studied by the example of the applied problem of anomaly detection arising in computer protection systems, the so-called intrusion detection systems. <s> BIB002
This is a fuzzy clustering method in the feature space for the multi-class classification problem. The approach BIB002 searches for one common cluster containing images of all objects from the original space. In this case, the membership degree of an object image with respect to the fuzzy cluster in the feature space may be viewed as a typicalness degree of the object, i.e., a measure opposed to outlierness. Objects with a low typicalness degree (less than a threshold determined by the user) are considered outliers. It should be noted that the modification of the threshold (i.e., the modification of the outlier factor criterion) does not require model reconstruction, which is the case when the distancebased algorithms are used. Petrovskiy introduces a fuzzy kernel-based method for real-time network intrusion detection BIB001 . It involves a kernel-based fuzzy clustering technique. Here, network audit records are vectors with numeric and nominal attributes. These vectors are implicitly mapped by means of a special kernel function into a high dimensional feature space, where the possibilistic clustering algorithm is applied to calculate the measure of typicalness and to discover outliers.