A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Definition 1: <s> A computer receives one or more sets of historical data points, wherein each set of historical data points corresponds to a component. The computer normalizes the one or more sets of historical data points. The computer receives and normalizes a first set of additional data points corresponding to a first set of the one or more sets and a second set of additional data points corresponding to the second set of the one or more sets. The computer creates a first visual representation corresponding to the first set of the one or more sets and the first set of additional points and a second visual representation corresponding to the second set of the one or more sets and the second set of additional data points. <s> BIB001 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Definition 1: <s> This paper deals with finding outliers (exceptions) in large, multidimensional datasets. The identification of outliers can lead to the discovery of truly unexpected knowledge in areas such as electronic commerce, credit card fraud, and even the analysis of performance statistics of professional athletes. Existing methods that we have seen for finding outliers in large datasets can only deal efficiently with two dimensions/attributes of a dataset. Here, we study the notion of DB- (DistanceBased) outliers. While we provide formal and empirical evidence showing the usefulness of DB-outliers, we focus on the development of algorithms for computing such outliers. First, we present two simple algorithms, both having a complexity of O(k N’), k being the dimensionality and N being the number of objects in the dataset. These algorithms readily support datasets with many more than two attributes. Second, we present an optimized cell-based algorithm that has a complexity that is linear wrt N, but exponential wrt k. Third, for datasets that are mainly disk-resident, we present another version of the cell-based algorithm that guarantees at most 3 passes over a dataset. We provide <s> BIB002
Hawkins Outlier -Outliers are observations which deviate significantly from other observations as to arouse suspicion that these are generated by a different mechanism BIB001 . This notion is formalized by Knorr and Ng BIB002 as follows: Let o, p, q denote objects in a dataset and let d(p, q) denote the distance between objects p and q. C is a set of objects and d(p, C) denotes the minimum distance between p and object q in C: Definition 2: DB(pct, dmin) Outlier -An object p in a dataset D is a DB(pct, dmin) outlier if at least pct percentage of the objects in D lies at distance greater than dmin from p, i.e., the cardinality of the set {q ∈ D|d(p, q) ≤ dmin} is less than or equal to (100 − pct)% of the size of D BIB002 . To illustrate, consider a 2-D data set depicted in F ig. 1. This is a simple 2-dimensional dataset containing 602 objects. There are 500 objects in the first cluster C 1 , 100 objects in the cluster C 2 , and two additional objects O 1 and O 2 . In this example, C 2 forms a denser cluster than C 1 . According to Hawkins' definition, both O 1 and O 2 are outliers, whereas objects in C 1 and C 2 are not. In contrast, within the framework of distance-based outliers, only O 1 is a reasonable DB(pct, dmin)-outlier in the following sense. Based on these definitions, we observe that distancebased outliers are data points that are situated away from the majority of points using some geometric distance measure following a fixed or changeable threshold related to the domain of interest. The advantage of distance-based methods is the high degree of accuracy of distance measures. High dimensional data is always sparse related to some dimension or attribute. Because of the sparsity of data, distancebased approaches usually do not perform well in situations where the actual values of the distances are similar for many pairs of points. So, researchers  working with distance-based outlier detection methods take a non-parametric approach. Although distance-based approaches for outlier detection are nonparametric, the drawback is the amount of computation time required. In distance-based outlier detection methods, effective use of the adaptive or conditional threshold value can result in better performance.