|
|
|
|
3 | (18) |
|
|
4 | (3) |
|
|
7 | (2) |
|
|
7 | (1) |
|
|
8 | (1) |
|
|
8 | (1) |
|
|
9 | (2) |
|
|
9 | (1) |
|
|
10 | (1) |
|
1.3.3 Bankruptcy Prediction |
|
|
10 | (1) |
|
|
10 | (1) |
|
|
11 | (1) |
|
|
11 | (1) |
|
|
12 | (1) |
|
|
12 | (1) |
|
|
12 | (1) |
|
1.5 Defense and Internal Security |
|
|
12 | (2) |
|
1.5.1 Personnel Behaviors |
|
|
13 | (1) |
|
1.5.2 Battlefield Behaviors |
|
|
13 | (1) |
|
1.5.3 Unconventional Attacks |
|
|
13 | (1) |
|
|
14 | (2) |
|
1.6.1 Detecting Occurrence of Falls and Other Problems |
|
|
14 | (1) |
|
1.6.2 Home Perimeter Safety |
|
|
15 | (1) |
|
1.6.3 Indoor Pollution Monitoring |
|
|
15 | (1) |
|
1.7 Manufacturing and Industry |
|
|
16 | (2) |
|
|
16 | (1) |
|
|
16 | (1) |
|
1.7.3 Inventory Management |
|
|
17 | (1) |
|
|
17 | (1) |
|
|
17 | (1) |
|
|
18 | (1) |
|
|
19 | (2) |
|
|
21 | (12) |
|
|
21 | (5) |
|
2.1.1 Metrics for Measurement |
|
|
23 | (1) |
|
2.1.2 Old Problems vs. New Problems |
|
|
24 | (1) |
|
|
24 | (1) |
|
|
25 | (1) |
|
2.2 Outliers in One-Dimensional Data |
|
|
26 | (2) |
|
2.3 Outliers in Multidimensional Data |
|
|
28 | (1) |
|
2.4 Anomaly Detection Approaches |
|
|
29 | (1) |
|
|
30 | (2) |
|
|
32 | (1) |
|
3 Distance-Based Anomaly Detection Approaches |
|
|
33 | (8) |
|
|
33 | (1) |
|
|
34 | (2) |
|
3.3 Distance-Based Approaches |
|
|
36 | (3) |
|
3.3.1 Distance to All Points |
|
|
36 | (1) |
|
3.3.2 Distance to Nearest Neighbor |
|
|
37 | (1) |
|
3.3.3 Average Distance to k Nearest Neighbors |
|
|
37 | (1) |
|
3.3.4 Median Distance to k Nearest Neighbors |
|
|
38 | (1) |
|
|
39 | (2) |
|
4 Clustering-Based Anomaly Detection Approaches |
|
|
41 | (16) |
|
|
41 | (8) |
|
4.1.1 Nearest Neighbor Clustering |
|
|
42 | (1) |
|
|
43 | (2) |
|
|
45 | (1) |
|
4.1.4 Agglomerative Clustering |
|
|
46 | (1) |
|
4.1.5 Density-Based Agglomerative Clustering |
|
|
47 | (1) |
|
4.1.6 Divisive Clustering |
|
|
48 | (1) |
|
4.2 Anomaly Detection Using Clusters |
|
|
49 | (6) |
|
4.2.1 Cluster Membership or Size |
|
|
49 | (1) |
|
4.2.2 Proximity to Other Points |
|
|
50 | (1) |
|
4.2.3 Proximity to Nearest Neighbor |
|
|
51 | (1) |
|
|
51 | (2) |
|
4.2.5 When Cluster Sizes Differ |
|
|
53 | (1) |
|
4.2.6 Distances from Multiple Points |
|
|
54 | (1) |
|
|
55 | (2) |
|
5 Model-Based Anomaly Detection Approaches |
|
|
57 | (40) |
|
5.1 Models of Relationships Between Variables |
|
|
57 | (6) |
|
5.1.1 Model Parameter Space Approach |
|
|
58 | (1) |
|
5.1.2 Data Space Approach |
|
|
59 | (4) |
|
|
63 | (4) |
|
5.2.1 Parametric Distribution Estimation |
|
|
63 | (1) |
|
|
64 | (3) |
|
5.3 Models of Time-Varying Processes |
|
|
67 | (11) |
|
|
70 | (2) |
|
|
72 | (6) |
|
5.4 Anomaly Detection in Time Series |
|
|
78 | (13) |
|
5.4.1 Anomaly Within a Single Time Series |
|
|
79 | (5) |
|
5.4.2 Anomaly Detection Among Multiple Time Series |
|
|
84 | (7) |
|
5.5 Learning Algorithms Used to Derive Models from Data |
|
|
91 | (2) |
|
|
92 | (1) |
|
|
93 | (4) |
|
|
|
6 Distance and Density Based Approaches |
|
|
97 | (22) |
|
6.1 Distance from the Rest of the Data |
|
|
97 | (5) |
|
6.1.1 Distance Based-Outlier Approach |
|
|
100 | (2) |
|
6.2 Local Correlation Integral (LOCI) Algorithm |
|
|
102 | (3) |
|
6.2.1 Resolution-Based Outlier Detection |
|
|
104 | (1) |
|
6.3 Nearest Neighbor Approach |
|
|
105 | (2) |
|
6.4 Density Based Approaches |
|
|
107 | (9) |
|
6.4.1 Mixture Density Estimation |
|
|
109 | (1) |
|
6.4.2 Local Outlier Factor (LOF) Algorithm |
|
|
110 | (2) |
|
6.4.3 Connectivity-Based Outlier Factor (COF) Approach |
|
|
112 | (2) |
|
6.4.4 INFLuential Measure of Outlierness by Symmetric Relationship (INFLO) |
|
|
114 | (2) |
|
6.5 Performance Comparisons |
|
|
116 | (1) |
|
|
117 | (2) |
|
|
119 | (16) |
|
7.1 Rank-Based Detection Algorithm (RBDA) |
|
|
121 | (3) |
|
7.1.1 Why Does RBDA Work? |
|
|
122 | (2) |
|
7.2 Anomaly Detection Algorithms Based on Clustering and Weighted Ranks |
|
|
124 | (3) |
|
|
125 | (1) |
|
7.2.2 Density and Rank Based Detection Algorithms |
|
|
126 | (1) |
|
7.3 New Algorithms Based on Distance and Cluster Density |
|
|
127 | (3) |
|
|
130 | (4) |
|
7.4.1 RBDA Versus the Kernel Based Density Estimation Algorithm |
|
|
130 | (1) |
|
7.4.2 Comparison of RBDA and Its Extensions with LOF, COF, and INFLO |
|
|
131 | (2) |
|
7.4.3 Comparison for KDD99 and Packed Executables Datasets |
|
|
133 | (1) |
|
|
134 | (1) |
|
|
135 | (18) |
|
8.1 Independent Ensemble Methods |
|
|
135 | (4) |
|
8.2 Sequential Application of Algorithms |
|
|
139 | (1) |
|
8.3 Ensemble Anomaly Detection with Adaptive Sampling |
|
|
140 | (3) |
|
|
141 | (1) |
|
|
142 | (1) |
|
8.3.3 Minimum Margin Approach |
|
|
142 | (1) |
|
8.4 Weighted Adaptive Sampling |
|
|
143 | (9) |
|
8.4.1 Weighted Adaptive Sampling Algorithm |
|
|
147 | (1) |
|
8.4.2 Comparative Results |
|
|
147 | (1) |
|
8.4.3 Dataset Description |
|
|
148 | (1) |
|
8.4.4 Performance Comparisons |
|
|
148 | (3) |
|
8.4.5 Effect of Model Parameters |
|
|
151 | (1) |
|
|
152 | (1) |
|
9 Algorithms for Time Series Data |
|
|
153 | (38) |
|
|
154 | (3) |
|
9.2 Identification of an Anomalous Time Series |
|
|
157 | (10) |
|
9.2.1 Algorithm Categories |
|
|
158 | (1) |
|
9.2.2 Distances and Transformations |
|
|
159 | (8) |
|
9.3 Abnormal Subsequence Detection |
|
|
167 | (2) |
|
9.4 Outlier Detection Based on Multiple Measures |
|
|
169 | (3) |
|
|
169 | (3) |
|
9.4.2 Identification of Anomalous Series |
|
|
172 | (1) |
|
9.5 Online Anomaly Detection for Time Series |
|
|
172 | (10) |
|
9.5.1 Online Updating of Distance Measures |
|
|
173 | (3) |
|
9.5.2 Multiple Measure Based Abnormal Subsequence Detection Algorithm (MUASD) |
|
|
176 | (2) |
|
9.5.3 Finding Nearest Neighbor by Early Abandoning |
|
|
178 | (1) |
|
9.5.4 Finding Abnormal Subsequence Based on Ratio of Frequencies (SAXFR) |
|
|
179 | (2) |
|
|
181 | (1) |
|
|
182 | (6) |
|
9.6.1 Detection of Anomalous Series in a Dataset |
|
|
182 | (1) |
|
9.6.2 Online Anomaly Detection |
|
|
183 | (3) |
|
9.6.3 Anomalous Subsequence Detection |
|
|
186 | (2) |
|
9.6.4 Computational Effort |
|
|
188 | (1) |
|
|
188 | (3) |
|
Appendix A Datasets for Evaluation |
|
|
191 | (4) |
|
A.1 A Datasets for Evaluation |
|
|
191 | (1) |
|
|
191 | (3) |
|
|
194 | (1) |
|
Appendix B Datasets for Time Series Experiments |
|
|
195 | (14) |
|
|
195 | (14) |
|
|
195 | (1) |
|
B.1.2 Brief Description of Datasets |
|
|
195 | (7) |
|
B.1.3 Datasets for Online Anomalous Time Series Detection |
|
|
202 | (1) |
|
B.1.4 Data Sets for Abnormal Subsequence Detection in a Single Series |
|
|
203 | (1) |
|
B.1.5 Results for Abnormal Subsequence Detection in a Single Series for Various Datasets |
|
|
203 | (6) |
References |
|
209 | (6) |
Index |
|
215 | |