A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Density-based outlier detection approach <s> Clustering algorithms are attractive for the task of class identification in spatial databases. However, the application to large spatial databases rises the following requirements for clustering algorithms: minimal requirements of domain knowledge to determine the input parameters, discovery of clusters with arbitrary shape and good efficiency on large databases. The well-known clustering algorithms offer no solution to the combination of these requirements. In this paper, we present the new clustering algorithm DBSCAN relying on a density-based notion of clusters which is designed to discover clusters of arbitrary shape. DBSCAN requires only one input parameter and supports the user in determining an appropriate value for it. We performed an experimental evaluation of the effectiveness and efficiency of DBSCAN using synthetic data and real data of the SEQUOIA 2000 benchmark. The results of our experiments demonstrate that (1) DBSCAN is significantly more effective in discovering clusters of arbitrary shape than the well-known algorithm CLAR-ANS, and that (2) DBSCAN outperforms CLARANS by a factor of more than 100 in terms of efficiency. <s> BIB001 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Density-based outlier detection approach <s> For many KDD applications, such as detecting criminal activities in E-commerce, finding the rare instances or the outliers, can be more interesting than finding the common patterns. Existing work in outlier detection regards being an outlier as a binary property. In this paper, we contend that for many scenarios, it is more meaningful to assign to each object a degree of being an outlier. This degree is called the local outlier factor (LOF) of an object. It is local in that the degree depends on how isolated the object is with respect to the surrounding neighborhood. We give a detailed formal analysis showing that LOF enjoys many desirable properties. Using real-world datasets, we demonstrate that LOF can be used to find outliers which appear to be meaningful, but can otherwise not be identified with existing approaches. Finally, a careful performance evaluation of our algorithm confirms we show that our approach of finding local outliers can be practical. <s> BIB002 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Density-based outlier detection approach <s> This paper proposed a new anomaly detection algorithm that can update normal profile of system usage pattern dynamically. The feature used to model systempsilas usage pattern was program behavior. When system usage pattern changed, new program behaviors will be inserted into old profiles by density-based incremental clustering. Compared to traditional re-clustering updating, it is much more efficiently. Experiments with 1998 DARPA BSM audit data, shows that normal profiles generated by our algorithm is less sensitive to noise data objects than profile generated by analogous incremental algorithm ADWICE. So our algorithm shows an incremental detection quality and a much lower false alarm rate. <s> BIB003
A density-based approach uses an outlier factor as a measurement of being an outlier. In the LOF BIB002 algorithm, a local outlier factor (LOF) is used as a measurement for finding a sample as outlier. This local outlier factor is computed from the sample's nearest neighbour objects rather than from the entire set of data as a whole. LOF is the mean value of the ratio of the density distribution estimate in the neighbourhood of the object analysed to the distribution densities of its neighbours. LOF is computed using Equation 2. Another density-based anomaly detection method is found in BIB003 . An important advantage of this method is its capability to update normal profile of system usage pattern dynamically. It models the system usage pattern based on features of program behavior. When system usage pattern changes, new program behaviours are inserted into old profiles by density-based incremental clustering. It uses DBSCAN BIB001 to generate the initial clusters for normal program behavior profiles. The profiles are updated by modifying DBSCAN's clusters using incremental clustering. This method has incremental detection quality and a much lower false alarm rate.