A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Characterizing ANIDS <s> This survey defines the problem of anomaly detection and provides an overview of existing methods. The methods are categorized into two general classes: generative and discriminative. A generative approach involves building a model that represents the joint distribution of the input features and the output labels of system behavior (e.g., normal or anomalous) then applies the model to formulate a decision rule for detecting anomalies. On the other hand, a discriminative approach aims directly to find the decision rule, with the smallest error rate, that distinguishes between normal and anomalous behavior. For each approach, we will give an overview of popular techniques and provide references to state-of-the-art applications. <s> BIB001 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Characterizing ANIDS <s> Since the first introduction of anomaly-based intrusion detection to the research community in 1987, the field has grown tremendously. A variety of methods and techniques introducing new capabilities in detecting novel attacks were developed. Most of these techniques report a high detection rate of 98% at the low false alarm rate of 1%. In spite of the anomaly-based approach's appeal, the industry generally favors signature-based detection for mainstream implementation of intrusion-detection systems. While a variety of anomaly-detection techniques have been proposed, adequate comparison of these methods' strengths and limitations that can lead to potential commercial application is difficult. Since the validity of experimental research in academic computer science, in general, is questionable, it is plausible to assume that research in anomaly detection shares the above problem. The concerns about the validity of these methods may partially explain why anomaly-based intrusion-detection methods are not adopted by industry. To investigate this issue, we review the current state of the experimental practice in the area of anomaly-based intrusion detection and survey 276 studies in this area published during the period of 2000-2008. We summarize our observations and identify the common pitfalls among surveyed works. <s> BIB002
An ANIDS is an anomaly based network intrusion detection system. A variety of ANIDSs have been proposed since the mid 1980s. It is necessary to have a clear definition of anomaly in the context of network intrusion detection. The majority of current research on ANIDS does not explicitly state what constitute anomaly in their study BIB002 . In a recent survey BIB001 , anomaly detection methods were classified into two classes: generative and discriminative. Generally, an ANIDS is characterized based on the following attributes: (i) nature and type of the input data, (ii) appropriateness of similarity/dissimilarity measures, (iii) labelling of data and (iv) reporting of anomalies. Next, we discuss each of these issues.