A Survey of Outlier Detection Methods in Network Anomaly Identification <s> NETWORK ANOMALY DETECTION <s> Anomaly detection is an important problem that has been researched within diverse research areas and application domains. Many anomaly detection techniques have been specifically developed for certain application domains, while others are more generic. This survey tries to provide a structured and comprehensive overview of the research on anomaly detection. We have grouped existing techniques into different categories based on the underlying approach adopted by each technique. For each category we have identified key assumptions, which are used by the techniques to differentiate between normal and anomalous behavior. When applying a given technique to a particular domain, these assumptions can be used as guidelines to assess the effectiveness of the technique in that domain. For each category, we provide a basic anomaly detection technique, and then show how the different existing techniques in that category are variants of the basic technique. This template provides an easier and more succinct understanding of the techniques belonging to each category. Further, for each category, we identify the advantages and disadvantages of the techniques in that category. We also provide a discussion on the computational complexity of the techniques since it is an important issue in real application domains. We hope that this survey will provide a better understanding of the different directions in which research has been done on this topic, and how techniques developed in one area can be applied in domains for which they were not intended to begin with. <s> BIB001 </s> A Survey of Outlier Detection Methods in Network Anomaly Identification <s> NETWORK ANOMALY DETECTION <s> The Internet and computer networks are exposed to an increasing number of security threats. With new types of attacks appearing continually, developing flexible and adaptive security oriented approaches is a severe challenge. In this context, anomaly-based network intrusion detection techniques are a valuable technology to protect target systems and networks against malicious activities. However, despite the variety of such methods described in the literature in recent years, security tools incorporating anomaly detection functionalities are just starting to appear, and several important problems remain to be solved. This paper begins with a review of the most well-known anomaly-based intrusion detection techniques. Then, available platforms, systems under development and research projects in the area are presented. Finally, we outline the main challenges to be dealt with for the wide scale deployment of anomaly-based intrusion detectors, with special emphasis on assessment issues. <s> BIB002
Unusual activities are outliers that are inconsistent with the remainder of data set  . An outlier is an observation that lies at an abnormal distance from other values in the dataset. In order to apply outlier detection to anomaly detection in the context of network intrusion detection, it is assumed by most researchers BIB001 that (1) the majority of the network connections are normal traffic. Only a small fraction of the traffic is malicious. (2) The attack traffic is statistically different from normal traffic. An anomaly detection technique identifies attacks based on deviations from the established profiles of normal activities. Activities that exceed thresholds of the deviations are identified as attacks. Thus, supervised and unsupervised outlier detection methods can find anomaly in network intrusion detection. Network intrusion detection systems BIB002 deal with detecting intrusions in network data. The primary reason for these intrusions is attacks launched by outside hackers who want to gain unauthorized access to the network to steal information or to disrupt the network. A typical setting is a large network of computers which is connected to the rest of the world through the Internet. Generally, detection of an intrusion in a network system is carried out based on two basic approaches -signature based and anomaly based. A signature based approach attempts to find attacks based on the previously stored patterns However, an anomaly based approach can detect intrusions based on deviations from the previously stored profiles of normal activities, but also, capable of detecting unknown intrusions (or suspicious pattern). The NIDS does this by reading all incoming packets and trying to find suspicious patterns.