A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Distance-based Outlier Detection <s> A computer receives one or more sets of historical data points, wherein each set of historical data points corresponds to a component. The computer normalizes the one or more sets of historical data points. The computer receives and normalizes a first set of additional data points corresponding to a first set of the one or more sets and a second set of additional data points corresponding to the second set of the one or more sets. The computer creates a first visual representation corresponding to the first set of the one or more sets and the first set of additional points and a second visual representation corresponding to the second set of the one or more sets and the second set of additional data points. <s> BIB001 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Distance-based Outlier Detection <s> This paper deals with finding outliers (exceptions) in large, multidimensional datasets. The identification of outliers can lead to the discovery of truly unexpected knowledge in areas such as electronic commerce, credit card fraud, and even the analysis of performance statistics of professional athletes. Existing methods that we have seen for finding outliers in large datasets can only deal efficiently with two dimensions/attributes of a dataset. Here, we study the notion of DB- (DistanceBased) outliers. While we provide formal and empirical evidence showing the usefulness of DB-outliers, we focus on the development of algorithms for computing such outliers. First, we present two simple algorithms, both having a complexity of O(k N’), k being the dimensionality and N being the number of objects in the dataset. These algorithms readily support datasets with many more than two attributes. Second, we present an optimized cell-based algorithm that has a complexity that is linear wrt N, but exponential wrt k. Third, for datasets that are mainly disk-resident, we present another version of the cell-based algorithm that guarantees at most 3 passes over a dataset. We provide <s> BIB002 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Distance-based Outlier Detection <s> In this paper, we propose a novel formulation for distance-based outliers that is based on the distance of a point from its kth nearest neighbor. We rank each point on the basis of its distance to its kth nearest neighbor and declare the top n points in this ranking to be outliers. In addition to developing relatively straightforward solutions to finding such outliers based on the classical nested-loop join and index join algorithms, we develop a highly efficient partition-based algorithm for mining outliers. This algorithm first partitions the input data set into disjoint subsets, and then prunes entire partitions as soon as it is determined that they cannot contain outliers. This results in substantial savings in computation. We present the results of an extensive experimental study on real-life and synthetic data sets. The results from a real-life NBA database highlight and reveal several expected and unexpected aspects of the database. The results from a study on synthetic data sets demonstrate that the partition-based algorithm scales well with respect to both data set size and data set dimensionality. <s> BIB003 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Distance-based Outlier Detection <s> The paper discusses outlier detection algorithms used in data mining systems. Basic approaches currently used for solving this problem are considered, and their advantages and disadvantages are discussed. A new outlier detection algorithm is suggested. It is based on methods of fuzzy set theory and the use of kernel functions and possesses a number of advantages compared to the existing methods. The performance of the algorithm suggested is studied by the example of the applied problem of anomaly detection arising in computer protection systems, the so-called intrusion detection systems. <s> BIB004
Distance-based methods for outlier detection are based on the calculation of distances among objects in the data with clear geometric interpretation. We can calculate a so-called outlier factor as a function F : x → R to quantitatively characterize an outlier BIB004 . The function F depends on the distance between the given object x and other objects R in the dataset being analysed. We introduce some commonly available definitions of distance-based outlier detection from BIB001 BIB002 BIB003 below.