A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Proximity measures <s> Distance or similarity measures are essential to solve many pattern recognition problems such as classification, clustering, and retrieval problems. Various distance/similarity measures that are applicable to compare two probability density functions, pdf in short, are reviewed and categorized in both syntactic and semantic relationships. A correlation coefficient and a hierarchical clustering technique are adopted to reveal similarities among numerous distance/similarity measures. <s> BIB001 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Proximity measures <s> Measuring similarity or distance between two entities is a key step for several data mining and knowledge discovery tasks. The notion of similarity for continuous data is relatively well-understood, but for categorical data, the similarity computation is not straightforward. Several data-driven similarity measures have been proposed in the literature to compute the similarity between two categorical data instances but their relative performance has not been evaluated. In this paper we study the performance of a variety of similarity measures in the context of a specific data mining task: outlier detection. Results on a variety of data sets show that while no one measure dominates others for all types of problems, some measures are able to have consistently high performance. <s> BIB002
Distance or similarity measures are necessary to solve many pattern recognition problems such as classification, clustering, and retrieval problems. From scientific and mathematical points of view, distance is defined as a quantitative degree of how far apart two objects are. A synonym for distance is dissimilarity. Distance measures satisfying the metric properties are simply called metric while non-metric distance measures are occasionally called divergence. A synonym for similarity is proximity and similarity measures are often called similarity coefficients. The selection of a proximity measure is very difficult because it depends upon the (i) the types of attributes in the data (ii) the dimensionality of data and (iii) the problem of weighing data attributes. In the case of numeric data objects, their inherent geometric properties can be exploited naturally to define distance functions between two data points. Numeric objects may be discrete or continuous. A detailed discussion on the various proximity measures for numeric data can be found in BIB001 . Categorical attribute values cannot be naturally arranged as numerical values. Computing similarity between categorical data instances is not straightforward. Several data-driven similarity measures have been proposed BIB002 