A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Statistical Methods <s> Abstract In this article we introduce a new influence measure and a graphical display for the detection of influential observations in linear regression. We demonstrate the need for such a new influence measure by giving examples where existing influence measures, numerous as they may be, may fail to detect influential observations. The existing influence measures are procedures each of which is designed to detect the influence of observations on a specific regression result. The proposed diagnostic is a measure of overall potential influence. Fitting a regression model in practice can have many purposes and the user may prefer to begin with an overall measure. This diagnostic possesses several desirable properties that many of the frequently used diagnostics do not generally possess: (a) invariance to location and scale in the response variable. (b) invariance to nonsingular transformations of the explanatory variables, (c) it is an additive function of measures of leverage and of residual error, and (d) it is monotonically increasing in the leverage values and in the squared residuals. The new influence measure is also supplemented by a graphical display which shows the source of influence. This graph is suitable for both single- and multiple-case influence. Analytical and empirical comparisons between the proposed measure and the existing ones indicate that our measure is superior to existing influence measures. <s> BIB001 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Statistical Methods <s> Because the network intrusion behaviors are characterized with uncertainty, complexity and diversity, a new method based on support vector regression (SVR) and particle swarm optimization algorithm (PSOA) is presented and used for pattern analysis of intrusion detection in this paper. The novel structure model has higher accuracy and faster convergence speed. We construct the network structure, and give the algorithm flow. We discussed and analyzed the impact factor of intrusion behaviors. With the ability of strong self-learning and faster convergence, this intrusion detection method can detect various intrusion behaviors rapidly and effectively by learning the typical intrusion characteristic information. We use rough set to reduce dimension. We apply this technique on KDD99 data set and get satisfactory results. The experimental result shows that this intrusion detection method is feasible and effective. <s> BIB002
The general approach to solve the outlier detection problem using statistical methods is based on the construction of probabilistic data models and the use of mathematical methods of applied statistics and probability theory. With a statistical approach to outlier detection, a system learns the behavior of users, applying metrics or measuring methods. As the system is running, the outlier or anomaly detector is constantly measuring the deviation of the present behavior profile from the original. The LNKnet software package was developed to simplify the application of most important statistical, neural network, and machine learning pattern classifier  on network connection data. Methods for detecting outliers based on the regression analysis are included among statistical methods. Regression analysis consists of finding a dependence of one random variable (or a group of variables) Y on another variable (or a group of variables) X. Specifically, the problem is formulated as that of examining the conditional probability distribution Y |X. Among regression methods for outlier analysis, two approaches are distinguished. In the framework of the first approach, the regression model is constructed with the use of all data; then, the objects with the greatest errors are successively, or simultaneously, excluded from the model. This approach is called a reverse search. The second approach consists of constructing a model based on a part of data and, then, adding new objects followed by the reconstruction of the model. Such a method is referred to as a direct search BIB001 . The model is extended by adding the most appropriate objects, which are the objects with least deviations from the model constructed. The objects added to the model in the last turn are considered outliers. A regression method based on support vector regression (SVR) and particle swarm optimization algorithm (PSOA) is given in BIB002 for pattern analysis of intrusion detection. Basic disadvantages of the regression methods are that they greatly depend on assumptions about the error distribution and need a prior partition of variables into independent and dependent ones.