A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Contribution of The Paper <s> Outlier detection has been used for centuries to detect and, where appropriate, remove anomalous observations from data. Outliers arise due to mechanical faults, changes in system behaviour, fraudulent behaviour, human error, instrument error or simply through natural deviations in populations. Their detection can identify system faults and fraud before they escalate with potentially catastrophic consequences. It can identify errors and remove their contaminating effect on the data set and as such to purify the data for processing. The original outlier detection methods were arbitrary but now, principled and systematic techniques are used, drawn from the full gamut of Computer Science and Statistics. In this paper, we introduce a survey of contemporary techniques for outlier detection. We identify their respective motivations and distinguish their advantages and disadvantages in a comparative review. <s> BIB001 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Contribution of The Paper <s> The paper discusses outlier detection algorithms used in data mining systems. Basic approaches currently used for solving this problem are considered, and their advantages and disadvantages are discussed. A new outlier detection algorithm is suggested. It is based on methods of fuzzy set theory and the use of kernel functions and possesses a number of advantages compared to the existing methods. The performance of the algorithm suggested is studied by the example of the applied problem of anomaly detection arising in computer protection systems, the so-called intrusion detection systems. <s> BIB002 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Contribution of The Paper <s> Outlier detection is concerned with discovering exceptional behaviors of objects. Its theoretical principle and practical implementation lay a foundation for some important applications such as credit card fraud detection, discovering criminal behaviors in e-commerce, discovering computer intrusion, etc. In this paper, we first present a unified model for several existing outlier detection schemes, and propose a compatibility theory, which establishes a framework for describing the capabilities for various outlier formulation schemes in terms of matching users'intuitions. Under this framework, we show that the density-based scheme is more powerful than the distance-based scheme when a dataset contains patterns with diverse characteristics. The density-based scheme, however, is less effective when the patterns are of comparable densities with the outliers. We then introduce a connectivity-based scheme that improves the effectiveness of the density-based scheme when a pattern itself is of similar density as an outlier. We compare density-based and connectivity-based schemes in terms of their strengths and weaknesses, and demonstrate applications with different features where each of them is more effective than the other. Finally, connectivity-based and density-based schemes are comparatively evaluated on both real-life and synthetic datasets in terms of recall, precision, rank power and implementation-free metrics. <s> BIB003 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Contribution of The Paper <s> This survey defines the problem of anomaly detection and provides an overview of existing methods. The methods are categorized into two general classes: generative and discriminative. A generative approach involves building a model that represents the joint distribution of the input features and the output labels of system behavior (e.g., normal or anomalous) then applies the model to formulate a decision rule for detecting anomalies. On the other hand, a discriminative approach aims directly to find the decision rule, with the smallest error rate, that distinguishes between normal and anomalous behavior. For each approach, we will give an overview of popular techniques and provide references to state-of-the-art applications. <s> BIB004 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Contribution of The Paper <s> Anomaly detection is a critical issue in Network Intrusion Detection Systems (NIDSs). Most anomaly based NIDSs employ supervised algorithms, whose performances highly depend on attack-free training data. However, this kind of training data is difficult to obtain in real world network environment. Moreover, with changing network environment or services, patterns of normal traffic will be changed. This leads to high false positive rate of supervised NIDSs. Unsupervised outlier detection can overcome the drawbacks of supervised anomaly detection. Therefore, we apply one of the efficient data mining algorithms called random forests algorithm in anomaly based NIDSs. Without attack-free training data, random forests algorithm can detect outliers in datasets of network traffic. In this paper, we discuss our framework of anomaly based network intrusion detection. In the framework, patterns of network services are built by random forests algorithm over traffic data. Intrusions are detected by determining outliers related to the built patterns. We present the modification on the outlier detection algorithm of random forests. We also report our experimental results over the KDD'99 dataset. The results show that the proposed approach is comparable to previously reported unsupervised anomaly detection approaches evaluated over the KDD' 99 dataset. <s> BIB005 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Contribution of The Paper <s> In the field of wireless sensor networks, those measurements that significantly deviate from the normal pattern of sensed data are considered as outliers. The potential sources of outliers include noise and errors, events, and malicious attacks on the network. Traditional outlier detection techniques are not directly applicable to wireless sensor networks due to the nature of sensor data and specific requirements and limitations of the wireless sensor networks. This survey provides a comprehensive overview of existing outlier detection techniques specifically developed for the wireless sensor networks. Additionally, it presents a technique-based taxonomy and a comparative table to be used as a guideline to select a technique suitable for the application at hand based on characteristics such as data type, outlier type, outlier identity, and outlier degree. <s> BIB006 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Contribution of The Paper <s> Network Anomaly Detection covers wide area of research. Current best practices for identifying and diagnosing traffic anomalies consist of visualizing traffic from different perspectives and identifying anomalies from prior experience. Different tools have been developed to automatically generate alerts to failures, but to automate the anomaly identification process remains a challenge. Recently, Signal Processing techniques have found applications in Network Intrusion Detection System because of their ability in detecting novel intrusions and attacks, which cannot be achieved by signature-based detection systems. Visualization techniques are ways of creating and handling graphical representations of data. This survey explains the main techniques known in the field of Statistical based and Wavelet based anomaly detection approaches and focuses on the role of data traffic visualization tools in network traffic anomaly detection. <s> BIB007 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> Contribution of The Paper <s> Outlier detection has gained considerable interest in several fields of research including various sciences, medical diagnosis, fraud detection, and network intrusion detection. Most existing techniques are either distance based or density based. In this paper, we present an effective reference point based outlier detection technique (RODD) which performs satisfactorily in high dimensional real-world datasets. The technique was evaluated in terms of detection rate and false positive rate over several synthetic and real-world datasets and the performance is excellent. <s> BIB008
Outlier detection methods have been used for numerous applications in various domains. A lot of these techniques have been developed to solve focused problems in a particular application domain, while others have been developed in a more generic fashion. Outlier detection approaches found in literature BIB001 BIB002 BIB003  have varying scopes and abilities. The selection of an approach for detection of outlier(s) depends on the domain of application, type of data (e.g., numeric, categorical or mixed) and availability of labeled data. So, an adequate knowledge is highly essential regarding existing approaches to outlier detection while selecting an appropriate method for a specific domain. In this paper, we aim to provide a comprehensive up-to-date survey on outlier detection methods and approaches to network anomaly identification by using outlier detection methods. In particular, this paper contributes to the literature in outlier detection in the following ways. • We have found general surveys on outlier detection such as BIB001 BIB002 BIB003  BIB006 BIB008 and surveys on network anomaly detection such as BIB004 BIB007 BIB005 . But survey papers on the specific topic of anomaly identification using outlier detection method are not available. This survey emphasizes anomaly identification by using outlier detection approach. • In network traffic, most traffic is normal. Traffic related to attacks is naturally rare and therfore outlier. Thus, it is befitting that the problem of network anomaly identification be studied as an outlier detection problem. So, it will be beneficial for researchers as well as practitioners to have a resource where papers that use outlier detection for network anomaly identification are surveyed. • We believe that our classification of outliers into six cases provides a unique and novel insight into understanding the concept of outlier. This insight is likely to have implications on the design and development of algorithms for outlier detection whether for network anomaly detection or other context. • Although other surveys classify outlier detection techniques into the categories of supervised and unsupervised, our survey is most up-to-date. • Our classification of anomaly scores into three categories is also novel. An appropriate selection of anomaly score is crucial when applying outlier detection methods in specific domains. This survey will help readers select an appropriate anomaly score for their purpose. • We identify various key research issues and challenges of outlier detection methods in network anomaly identification.