ACM Home Page
Please provide us with feedback. Feedback
Anomaly detection: A survey
Full text PdfPdf (726 KB)
Source
ACM Computing Surveys (CSUR) archive
Volume 41 ,  Issue 3  (July 2009) table of contents
Article No. 15  
Year of Publication: 2009
ISSN:0360-0300
Authors
Varun Chandola  University of Minnesota, Minneapolis, MN
Arindam Banerjee  University of Minnesota, Minneapolis, MN
Vipin Kumar  University of Minnesota, Minneapolis, MN
Publisher
ACM  New York, NY, USA
Bibliometrics
Downloads (6 Weeks): 591,   Downloads (12 Months): 1729,   Citation Count: 2
Additional Information:

abstract   references   cited by   index terms   collaborative colleagues  

Tools and Actions: Request Permissions Request Permissions    Review this Article  
DOI Bookmark: Use this link to bookmark this Article: http://doi.acm.org/10.1145/1541880.1541882
What is a DOI?

ABSTRACT

Anomaly detection is an important problem that has been researched within diverse research areas and application domains. Many anomaly detection techniques have been specifically developed for certain application domains, while others are more generic. This survey tries to provide a structured and comprehensive overview of the research on anomaly detection. We have grouped existing techniques into different categories based on the underlying approach adopted by each technique. For each category we have identified key assumptions, which are used by the techniques to differentiate between normal and anomalous behavior. When applying a given technique to a particular domain, these assumptions can be used as guidelines to assess the effectiveness of the technique in that domain. For each category, we provide a basic anomaly detection technique, and then show how the different existing techniques in that category are variants of the basic technique. This template provides an easier and more succinct understanding of the techniques belonging to each category. Further, for each category, we identify the advantages and disadvantages of the techniques in that category. We also provide a discussion on the computational complexity of the techniques since it is an important issue in real application domains. We hope that this survey will provide a better understanding of the different directions in which research has been done on this topic, and how techniques developed in one area can be applied in domains for which they were not intended to begin with.


REFERENCES

Note: OCR errors may be found in this Reference List extracted from the full text article. ACM has opted to expose the complete List rather than only correct and linked references.

1
 
2
Abraham, B. and Box, G. E. P. 1979. Bayesian analysis of some outlier problems in time series. Biometrika 66, 2, 229--236.
 
3
 
4
Addison, J., Wermter, S., and MacIntyre, J. 1999. Effectiveness of feature extraction in neural network architectures for novelty detection. In Proceedings of the 9th International Conference on Artificial Neural Networks. vol. 2. 976--981.
 
5
Aeyels, D. 1991. On the dynamic behaviour of the novelty detector and the novelty filter. In Analysis of Controlled Dynamical Systems: Progress in Systems and Control Theory, B. Bonnard, B. Bride, J. Gauthier, and I. Kupka, Eds. vol. 8. Springer, Berlin, 1--10.
 
6
 
7
 
8
Aggarwal, C. 2005. On abnormality detection in spuriously populated data streams. In Proceedings of the 5th SIAM Data Min. Conference. 80--91.
9
 
10
Aggarwal, C. C. and Yu, P. S. 2008. Outlier detection with uncertain data. In Proceedings of the International Conference on Data Mining (SDM). 483--493.
 
11
Agovic, A., Banerjee, A., Ganguly, A. R., and Protopopescu, V. 2007. Anomaly detection in transportation corridors using manifold embedding. In Proceedings of the 1st International Workshop on Knowledge Discovery from Sensor Data. ACM Press.
 
12
 
13
Agyemang, M., Barker, K., and Alhajj, R. 2006. A comprehensive survey of numeric and symbolic outlier mining techniques. Intel. Data Anal. 10, 6, 521--538.
 
14
 
15
Aleskerov, E., Freisleben, B., and Rao, B. 1997. Cardwatch: A neural network based database mining system for credit card fraud detection. In Proceedings of the IEEE Conference on Computational Intelligence for Financial Engineering. 220--226.
 
16
Allan, J., Carbonell, J., Doddington, G., Yamron, J., and Yang, Y. 1998. Topic detection and tracking pilot study. In Proceedings of the DARPA Broadcast News Transcription and Understanding Workshop. 194--218.
 
17
Anderson, D. Lunt, T. F., Javitz, H., Tamaru, A., and Valdes, A. 1995. Detecting unusual program behavior using the statistical components of NIDES. Tech. rep. SRI--CSL--95--06, Computer Science Laboratory, SRI International.
 
18
Anderson, D., Frivold, T., Tamaru, A., and Valdes, A. 1994. Next-generation intrusion detection expert system (NIDES), software users manual, beta-update release. Tech. rep. SRI--CSL--95--07, Computer Science Laboratory, SRI International.
 
19
 
20
 
21
Anscombe, F. J. and Guttman, I. 1960. Rejection of outliers. Technometrics 2, 2, 123--147.
 
22
Arning, A., Agrawal, R., and Raghavan, P. 1996. A linear method for deviation detection in large databases. In Proceedings of the 2nd International Conference of Knowledge Discovery and Data Mining. 164--169.
 
23
Augusteijn, M. and Folkert, B. 2002. Neural network classification and novelty detection. Int. J. Rem. Sens. 23, 14, 2891--2902.
 
24
Bakar, Z., Mohemad, R., Ahmad, A., and Deris, M. 2006. A comparative study for outlier detection techniques in data mining. Proceedings of the IEEE Conference on Cybernetics and Intelligent Systems. 1--6.
 
25
Baker, D., Hofmann, T., McCallum, A., and Yang, Y. 1999. A hierarchical probabilistic model for novelty detection in text. In Proceedings of the International Conference on Machine Learning.
26
 
27
Barbara, D., Couto, J., Jajodia, S., and Wu, N. 2001b. Detecting novel network intrusions using Bayes estimators. In Proceedings of the 1st SIAM International Conference on Data Mining.
28
 
29
Barnett, V. 1976. The ordering of multivariate data (with discussion). J. Royal Statis. Soc. Series A 139, 318--354.
 
30
Barnett, V. and Lewis, T. 1994. Outliers in Statistical Data. John Wiley.
 
31
Barson, P., Davey, N., Field, S. D. H., Frank, R. J., and McAskie, G. 1996. The detection of fraud in mobile phone networks. Neural Netw. World 6, 4.
32
 
33
34
 
35
Beckman, R. J. and Cook, R. D. 1983. Outlier...s. Technometrics 25, 2, 119--149.
 
36
Bejerano, G. and Yona, G. 2001. Variations on probabilistic suffix trees: statistical modeling and prediction of protein families. Bioinformatics 17, 1, 23--43.
37
 
38
Bianco, A. M., Ben, M. G., Martinez, E. J., and Yohai, V. J. 2001. Outlier detection in regression models with arima errors using robust estimates. J. Forecast. 20, 8, 565--579.
 
39
Bishop, C. 1994. Novelty detection and neural network validation. In Proceedings of the IEEE Conference on Vision, Image and Signal Processing. vol. 141. 217--222.
 
40
Blender, R., Fraedrich, K., and Lunkeit, F. 1997. Identification of cyclone-track regimes in the north atlantic. Quart. J. Royal Meteor. Soc. 123, 539, 727--741.
 
41
Bolton, R. and Hand, D. 1999. Unsupervised profiling methods for fraud detection. In Proceedings of the Conference on Credit Scoring and Credit Control VII.
 
42
Boriah, S., Chandola, V., and Kumar, V. 2008. Similarity measures for categorical data: A comparative evaluation. In Proceedings of the 8th SIAM International Conference on Data Mining. 243--254.
 
43
Borisyuk, R., Denham, M., Hoppensteadt, F., Kazanovich, Y., and Vinogradova, O. 2000. An oscillatory neural network model of sparse distributed memory and novelty detection. Biosystems 58, 265--272.
 
44
Box, G. E. P. and Tiao, G. C. 1968. Bayesian analysis of some outlier problems. Biometrika 55, 1, 119--129.
 
45
 
46
 
47
48
 
49
Brito, M. R., Chavez, E. L., Quiroz, A. J., and Yukich, J. E. 1997. Connectivity of the mutual k-nearest-neighbor graph in clustering and outlier detection. Statis. Prob. Lett. 35, 1, 33--42.
 
50
Brockett, P. L., Xia, X., and Derrig, R. A. 1998. Using Kohonen's self-organizing feature map to uncover automobile bodily injury claims fraud. J. Risk Insur. 65, 2, 245--274.
 
51
Bronstein, A., Das, J., Duro, M., Friedrich, R., Kleyner, G., Mueller, M., Singhal, S., and Cohen, I. 2001. Bayesian networks for detecting anomalies in Internet-based services. In Proceedings of the International Symposium on Integrated Network Management.
 
52
Brotherton, T. and Johnson, T. 2001. Anomaly detection for advanced military aircraft using neural networks. In Proceedings of the IEEE Aerospace Conference.
 
53
Brotherton, T., Johnson, T., and Chadderdon, G. 1998. Classification and novelty detection using linear models and a class dependent-elliptical basis function neural network. In Proceedings of the IJCNN Conference.
 
54
Budalakoti, S., Srivastava, A., Akella, R., and Turkov, E. 2006. Anomaly detection in large sets of high-dimensional symbol sequences. Tech. rep. NASA TM-2006-214553, NASA Ames Research Center.
 
55
Byers, S. D. and Raftery, A. E. 1998. Nearest neighbor clutter removal for estimating features in spatial point processes. J. Amer. Statis. Assoc. 93, 577--584.
 
56
Byungho, H. and Sungzoon, C. 1999. Characteristics of autoassociative MLP as a novelty detector. In Proceedings of the IEEE International Joint Conference on Neural Networks. Vol. 5. 3086--3091.
57
 
58
Campbell, C. and Bennett, K. 2001. A linear programming approach to novelty detection. In Proceedings of the Conference on Advances in Neural Information Processing. vol. 14. Cambridge Press.
 
59
Caudell, T. and Newman, D. 1993. An adaptive resonance architecture to define normality and detect novelties in time series and databases. In Proceedings of the IEEE World Congress on Neural Networks. IEEE, 166--176.
 
60
 
61
Chandola, V., Banerjee, A., and Kumar, V. 2007. Anomaly detection: A survey. Tech. rep. 07-017, Computer Science Department, University of Minnesota.
 
62
Chandola, V., Boriah, S., and Kumar, V. 2008. Understanding categorical similarity measures for outlier detection. Tech. rep. 08-008, University of Minnesota.
 
63
Chandola, V., Eilertson, E., Ertoz, L., Simon, G., and Kumar, V. 2006. Data mining for cyber security. In Data Warehousing and Data Mining Techniques for Computer Security, A. Singhal, Ed. Springer.
 
64
 
65
Chaudhary, A., Szalay, A. S., and Moore, A. W. 2002. Very fast outlier detection in large multidimensional data sets. In Proceedings of the ACM SIGMOD Workshop in Research Issues in Data Mining and Knowledge Discovery (DMKD). ACM Press.
66
 
67
Chen, D., Shao, X., Hu, B., and Su, Q. 2005. Simultaneous wavelength selection and outlier detection in multivariate regression of near-infrared spectra. Anal. Sci. 21, 2, 161--167.
 
68
Chiu, A. and Chee Fu, A. W. 2003. Enhancements on local outlier detection. In Proceedings of the 7th International Database Engineering and Applications Symposium. 298--307.
 
69
 
70
 
71
Crook, P. and Hayes, G. 2001. A robot implementation of a biologically inspired method for novelty detection. In Proceedings of the Towards Intelligent Mobile Robots Conference.
 
72
Crook, P. A., Marsland, S., Hayes, G., and Nehmzow, U. 2002. A tale of two filters: Online novelty detection. In Proceedings of the International Conference on Robotics and Automation. 3894--3899.
 
73
74
 
75
 
76
Dasgupta, D. and Nino, F. 2000. A comparison of negative and positive selection algorithms in novel pattern detection. In Proceedings of the IEEE International Conference on Systems, Man, and Cybernetics. vol. 1. 125--130.
 
77
Davy, M. and Godsill, S. 2002. Detection of abrupt spectral changes using support vector machines, an application to audio signal segmentation. In Proceedings of the IEEE International Conference on Acoustics, Speech, and Signal Processing.
 
78
 
79
 
80
Desforges, M., Jacob, P., and Cooper, J. 1998. Applications of probability density estimation to the detection of abnormal conditions in engineering. In Proceedings of the Institute of the Mechanical Engineers. vol. 212. 687--703.
 
81
Diaz, I. and Hollmen, J. 2002. Residual generation and visualization for understanding novel process conditions. In Proceedings of the IEEE International Joint Conference on Neural Networks. IEEE, 2070--2075.
 
82
Diehl, C. and Hampshire, J. 2002. Real-time object classification and novelty detection for collaborative video surveillance. In Proceedings of the IEEE International Joint Conference on Neural Networks. IEEE.
83
 
84
Dorronsoro, J. R., Ginel, F., Sanchez, C., and Cruz, C. S. 1997. Neural fraud detection in credit card operations. IEEE Trans. Neural Netw. 8, 4, 827--834.
 
85
 
86
 
87
Dutta, H., Giannella, C., Borne, K., and Kargupta, H. 2007. Distributed top-k outlier detection in astronomy catalogs using the DEMAC system. In Proceedings of the 7th SIAM International Conference on Data Mining.
 
88
Edgeworth, F. Y. 1887. On discordant observations. Philosoph. Mag. 23, 5, 364--375.
 
89
 
90
 
91
Ertoz, L., Eilertson, E., Lazarevic, A., Tan, P.-N., Kumar, V., Srivastava, J., and Dokas, P. 2004. MINDS—Minnesota Intrusion Detection System. In Data Mining—Next Generation Challenges and Future Directions. MIT Press.
 
92
Ertöz, L., Steinbach, M., and Kumar, V. 2003. Finding topics in collections of documents: A shared nearest neighbor approach. In Clustering and Information Retrieval. 83--104.
 
93
Escalante, H. J. 2005. A comparison of outlier detection algorithms for machine learning. In Proceedings of the International Conference on Communications in Computing.
 
94
 
95
Eskin, E., Arnold, A., Prerau, M., Portnoy, L., and Stolfo, S. 2002. A geometric framework for unsupervised anomaly detection. In Proceedings of the Conference on Applications of Data Mining in Computer Security. Kluwer Academics, 78--100.
 
96
Eskin, E., Lee, W., and Stolfo, S. 2001. Modeling system call for intrusion detection using dynamic window sizes. In Proceedings of DARPA Information Survivability Conference and Exposition (DISCEX).
 
97
Ester, M., Kriegel, H.-P., Sander, J., and Xu, X. 1996. A density-based algorithm for discovering clusters in large spatial databases with noise. In Proceedings of the 2nd International Conference on Knowledge Discovery and Data Mining, E. Simoudis, J. Han, and U. Fayyad, Eds. AAAI Press, 226--231.
 
98
99
 
100
 
101
Forrest, S., Esponda, F., and Helman, P. 2004. A formal framework for positive and negative detection schemes. In IEEE Trans. Syst. Man Cybernetics, Part B. IEEE, 357--373.
 
102
 
103
 
104
Forrest, S., Warrender, C., and Pearlmutter, B. 1999. Detecting intrusions using system calls: Alternate data models. In Proceedings of the IEEE ISRSP. IEEE Computer Society, 133--145.
 
105
Fox, A. J. 1972. Outliers in time series. J. Royal Statis. Soc. Series B 34, 3, 350--363.
106
 
107
Galeano, P., Pea, D., and Tsay, R. S. 2004. Outlier detection in multivariate time series via projection pursuit. Statistics and econometrics working articles ws044211, Departamento de Estadïstica y Econometrïca, Universidad Carlos III.
 
108
 
109
 
110
 
111
Ghosh, S. and Reilly, D. L. 1994. Credit card fraud detection with a neural-network. In Proceedings of the 27th Annual Hawaii International Conference on System Science. vol. 3.
 
112
Ghoting, A., Parthasarathy, S., and Otey, M. 2006. Fast mining of distance-based outliers in high dimensional datasets. In Proceedings of the SIAM International Conference on Data Mining.
 
113
Gibbons, R. D. 1994. Statistical Methods for Groundwater Monitoring. John Wiley & Sons, Inc.
 
114
Goldberger, A. L., Amaral, L. A. N., Glass, L., Hausdorff, J. M., Ivanov, P. C., Mark, R. G., Mietus, J. E., Moody, G. B., Peng, C.-K., and Stanley, H. E. 2000. PhysioBank, PhysioToolkit, and PhysioNet: Components of a new research resource for complex physiologic signals. Circulation 101, 23, e215--e220. Circulation Electronic Pages: http://circ.ahajournals.org/cgi/content/full/101/23/e215.
 
115
 
116
Grubbs, F. 1969. Procedures for detecting outlying observations in samples. Technometrics 11, 1, 1--21.
 
117
 
118
 
119
Guttormsson, S. E, Marks R. J. II, El-Sharkawi, M. A., and Kerszenbaum, I. 1999. Elliptical novelty grouping for online short-turn detection of excited running rotors. IEEE Trans. Energy Conv. 14, 1.
 
120
 
121
Gwadera, R., Atallah, M. J., and Szpankowski, W. 2005a. Markov models for identification of significant episodes. In Proceedings of the 5th SIAM International Conference on Data Mining.
 
122
 
123
Harris, T. 1993. Neural network in machine health monitoring. Professional Engin.
 
124
Hartigan, J. A. and Wong, M. A. 1979. A k-means clustering algorithm. Appl. Stat. 28, 100--108.
 
125
 
126
Hawkins, D. 1980. Identification of Outliers. Chapman and Hall, London and New York.
 
127
Hawkins, D. M. 1974. The detection of errors in multivariate data using principal components. J. Amer. Statis. Assoc. 69, 346, 340--344.
 
128
 
129
Hazel, G. G. 2000. Multivariate Gaussian MRF for multi-spectral scene segmentation and anomaly detection. GeoRS 38, 3, 1199--1211.
 
130
He, H., Wang, J., Graco, W., and Hawkins, S. 1997. Application of neural networks to detection of medical fraud. Expert Syst. Appl. 13, 4, 329--336.
 
131
 
132
He, Z., Deng, S., Xu, X., and Huang, J. Z. 2006. A fast greedy algorithm for outlier mining. In Proceedings of the 10th Pacific-Asia Conference on Knowledge and Data Discovery. 567--576.
 
133
 
134
He, Z., Xu, X., and Deng, S. 2005. An optimization model for outlier detection in categorical data. In Proceedings of the International Conference on Intelligent Computing. Lecture Notes in Computer Science, vol. 3644. Springer.
 
135
He, Z., Xu, X., Huang, J. Z., and Deng, S. 2004a. A Frequent Pattern Discovery Method for Outlier Detection. Springer, 726--732.
 
136
He, Z., Xu, X., Huang, J. Z., and Deng, S. 2004b. Mining Class Outliers: Concepts, Algorithms and Applications. Springer, 588--589.
 
137
Heller, K. A., Svore, K. M., Keromytis, A. D., and Stolfo, S. J. 2003. One class support vector machines for detecting anomalous windows registry accesses. In Proceedings of the Workshop on Data Mining for Computer Security.
 
138
Helman, P. and Bhangoo, J. 1997. A statistically-based system for prioritizing information exploration under uncertainty. In Proceedings of the IEEE International Conference on Systems, Man, and Cybernetics. vol. 27. IEEE, 449--466.
 
139
Helmer, G., Wong, J., Honavar, V., and Miller, L. 1998. Intelligent agents for intrusion detection. In Proceedings of the IEEE Information Technology Conference. 121--124.
 
140
Hickinbotham, S. J. and Austin, J. 2000a. Novelty detection in airframe strain data. In Proceedings of the 15th International Conference on Pattern Recognition. Vol. 2. 536--539.
 
141
Hickinbotham, S. J. and Austin, J. 2000b. Novelty detection in airframe strain data. In Proceedings of the IEEE-INNS-ENNS International Joint Conference on Neural Networks. vol. 6. 24--27.
 
142
 
143
 
144
Ho, T. V. and Rouat, J. 1998. Novelty detection based on relaxation time of a network of integrate-and-fire neurons. In Proceedings of the 2nd IEEE World Congress on Computational Intelligence. 1524--1529.
 
145
 
146
 
147
Hollier, G. and Austin, J. 2002. Novelty detection for strain-gauge degradation using maximally correlated components. In Proceedings of the European Symposium on Artificial Neural Networks. 257--262--539.
 
148
 
149
Horn, P. S., Feng, L., Li, Y., and Pesce, A. J. 2001. Effect of outliers and nonhealthy individuals on reference interval estimation. Clinical Chem. 47, 12, 2137--2145.
 
150
Hu, W., Liao, Y., and Vemuri, V. R. 2003. Robust anomaly detection using support vector machines. In Proceedings of the International Conference on Machine Learning. Morgan Kaufmann Publishers Inc., 282--289.
 
151
Huber, P. 1974. Robust Statistics. Wiley, New York.
 
152
Huber, P. J. 1985. Projection pursuit (with discussions). Ann. Stat. 13, 2, 435--475.
153
 
154
155
 
156
 
157
 
158
Jagota, A. 1991. Novelty detection on a very large number of memories stored in a hopfield-style network. In Proceedings of the International Joint Conference on Neural Networks. vol. 2. 905.
 
159
 
160
Jakubek, S. and Strasser, T. 2002. Fault-diagnosis using neural networks with ellipsoidal basis functions. In Proceedings of the American Control Conference. vol. 5. 3846--3851.
 
161
Janakiram, D., Reddy, V., and Kumar, A. 2006. Outlier detection in wireless sensor networks using Bayesian belief networks. In Proceedings of the 1st International Conference on Communication System Software and Middleware. 1--6.
 
162
Japkowicz, N., Myers, C., and Gluck, M. A. 1995. A novelty detection approach to classification. In Proceedings of the International Joint Conference on Artificial Intelligence. 518--523.
 
163
Javitz, H. S. and Valdes, A. 1991. The SRI IDES statistical anomaly detector. In Proceedings of the IEEE Symposium on Research in Security and Privacy. IEEE Computer Society.
 
164
165
166
 
167
Jolliffe, I. T. 2002. Principal Component Analysis, 2nd Ed. Springer.
168
169
 
170
Kadota, K., Tominaga, D., Akiyama, Y., and Takahashi, K. 2003. Detecting outlying samples in micro-array data: A critical assessment of the effect of outliers on sample classification. Chem-Bio Informatics 3, 1, 30--45.
 
171
 
172
 
173
174
175
 
176
Keogh, E. and Smyth, P. 1997. A probabilistic approach to fast pattern matching in time series databases. In Proceedings of the 3rd International Conference on Knowledge Discovery and Data Mining, D. Heckerman, H. Mannila, D. Pregibon, and R. Uthurusamy, Eds. AAAI Press, 24--30.
 
177
King, S., King, D., P. Anuzis, K. A., Tarassenko, L., Hayton, P., and Utete, S. 2002. The use of novelty detection techniques for monitoring high-integrity plant. In Proceedings of the International Conference on Control Applications. vol. 1., 221--226.
 
178
Kitagawa, G. 1979. On the use of AIC for the detection of outliers. Technometrics 21, 2, 193--199.
 
179
 
180
 
181
 
182
 
183
Ko, H. and Jacyna, G. 2000. Dynamical behavior of autoassociative memory performing novelty filtering. In IEEE Trans. Neural Netw. Vol. 11. 1152--1161.
 
184
 
185
Kojima, K. and Ito, K. 1999. Autonomous learning of novel patterns by utilizing chaotic dynamics. In Proceedings of the IEEE International Conference on Systems, Man, and Cybernetics. Vol. 1. IEEE, 284--289.
 
186
 
187
Kou, Y., Lu, C.-T., and Chen, D. 2006. Spatial weighted outlier detection. In Proceedings of the SIAM Conference on Data Mining.
 
188
189
190
 
191
 
192
Labib, K. and Vemuri, R. 2002. NSOM: A real-time network-based intrusion detection using self-organizing maps. Netw. Security.
193
 
194
Lane, T. and Brodley, C. E. 1997a. An application of machine learning to anomaly detection. In Proceedings of the Conference on 20th NIST-NCSC National Information Systems Security Conference. 366--380.
 
195
Lane, T. and Brodley, C. E. 1997b. Sequence matching and learning in anomaly detection for computer security. In Proceedings of the Conference on AI Approaches to Fraud Detection and Risk Management, Fawcett, Haimowitz, Provost, and Stolfo, Eds. AAAI Press, 43--49.
196
 
197
 
198
Laurikkala, J., Juhola, M., and Kentala., E. 2000. Informal identification of outliers in medical data. In Proceedings of the 5th International Workshop on Intelligent Data Analysis in Medicine and Pharmacology. 20--24.
 
199
Lazarevic, A., Ertoz, L., Kumar, V., Ozgur, A., and Srivastava, J. 2003. A comparative study of anomaly detection schemes in network intrusion detection. In Proceedings of the SIAM International Conference on Data Mining. (SIAM).
 
200
 
201
Lee, W., Stolfo, S., and Chan, P. 1997. Learning patterns from UNIX process execution traces for intrusion detection. In Proceedings of the AAAI Workshop on AI Methods in Fraud and Risk Management.
 
202
 
203
 
204
 
205
 
206
 
207
Lin, S. and Brown, D. E. 2003. An outlier-based data association method for linking criminal incidents. In Proceedings of the 3rd SIAM Data Mining Conference.
 
208
Liu, J. P. and Weng, C. S. 1991. Detection of outlying data in bioavailability/bioequivalence studies. Stat. Med. 10, 9, 1375--89.
 
209
210
 
211
Ma, J. and Perkins, S. 2003b. Time-series novelty detection using one-class support vector machines. In Proceedings of the International Joint Conference on Neural Networks. Vol. 3. 1741--1745.
 
212
213
 
214
 
215
Mahoney, M. V., Chan, P. K., and Arshad, M. H. 2003. A machine learning approach to anomaly detection. Tech. rep. CS--2003--06, Department of Computer Science, Florida Institute of Technology Melbourne.
 
216
Manevitz, L. M. and Yousef, M. 2000. Learning from positive data for document classification using neural networks. In Proceedings of the 2nd Bar-Ilan Workshop on Knowledge Discovery and Learning.
 
217
 
218
Manikopoulos, C. and Papavassiliou, S. 2002. Network intrusion and fault detection: A statistical anomaly approach. IEEE Comm. Mag. 40.
 
219
Manson, G. 2002. Identifying damage sensitive, environment insensitive features for damage detection. In Proceedings of IES Conference.
 
220
Manson, G., Pierce, G., and Worden, K. 2001. On the long-term stability of normal conditions for damage detection in a composite panel. In Proceedings of the 4th International Conference on Damage Assessment of Structures. Cardiff, UK.
 
221
Manson, G., Pierce, S. G., Worden, K., Monnier, T., Guy, P., and Atherton, K. 2000. Long-term stability of normal condition data for novelty detection. In Proceedings of the Conference on Smart Structures and Integrated Systems. 323--334.
222
 
223
 
224
 
225
 
226
Marsland, S., Nehmzow, U., and Shapiro, J. 1999. A model of habituation applied to mobile robots. In Proceedings of Towards Intelligent Mobile Robots Conference. Department of Computer Science, Manchester University, Technical rep. UMCS-99-3-1.
 
227
Marsland, S., Nehmzow, U., and Shapiro, J. 2000a. Novelty detection for robot neotaxis. In Proceedings of the 2nd International Symposium on Neural Compuatation. 554--559.
 
228
Marsland, S., Nehmzow, U., and Shapiro, J. 2000b. A real-time novelty detector for a mobile robot. In Proceedings of the EUREL Conference on Advanced Robotics Systems.
 
229
Martinelli, G. and Perfetti, R. 1994. Generalized cellular neural network for novelty detection. IEEE Trans. Circ. Syst. I: Fundamental Theory Application 41, 2, 187--190.
 
230
Martinez, D. 1998. Neural tree density estimation for novelty detection. IEEE Trans. Neural Netw. 9, 2, 330--338.
231
 
232
McNeil, A. 1999. Extreme value theory for risk managers. In Internal Modelling and CAD II, 93--113.
 
233
Mingming, N. Y. 2000. Probabilistic networks with undirected links for anomaly detection. In Proceedings of the IEEE Systems, Man, and Cybernetics Information Assurance and Security Workshop. 175--179.
 
234
Motulsky, H. 1995. Intuitive Biostatistics: Choosing a Statistical Test. Oxford University Press, Chapter 37.
 
235
Moya, M., Koch, M., and Hostetler, L. 1993. One-class classifier networks for target recognition applications. In Proceedings of the World Congress on Neural Networks, International Neural Network Society. 797--801.
 
236
 
237
Nairac, A., Corbett-Clark, T., Ripley, R., Townsend, N., and Tarassenko, L. 1997. Choosing an appropriate model for novelty detection. In Proceedings of the 5th IEEE International Conference on Artificial Neural Networks. 227--232.
 
238
 
239
240
 
241
Odin, T. and Addison, D. 2000. Novelty detection using neural network technology. In Proceedings of the COMADEN Conference.
242
 
243
 
244
Palshikar, G. K. 2005. Distance-based outliers in sequences. Lecture Notes in Computer Science, vol. 3816, 547--552.
 
245
Papadimitriou, S., Kitagawa, H., Gibbons, P. B., and Faloutsos, C. 2002. Loci: Fast outlier detection using the local correlation integral. Tech. rep. IRP-TR-02-09, Intel Research Laboratory.
 
246
 
247
Parzen, E. 1962. On the estimation of a probability density function and mode. Annals Math. Stat. 33, 1065--1076.
 
248
 
249
Petsche, T., Marcantonio, A., Darken, C., Hanson, S., Kuhn, G., and Santoso, I. 1996. A neural network autoassociator for induction motor failure prediction. In Proceedings of the Conference on Advances in Neural Information Processing. vol. 8. 924--930.
 
250
251
 
252
Phuong, T. V., Hung, L. X., Cho, S. J., Lee, Y., and Lee, S. 2006. An anomaly detection algorithm for detecting attacks in wireless sensor networks. Intel. Secur. Inform. 3975, 735--736.
 
253
Pickands, J. 1975. Statistical inference using extreme order statistics. Annals Stat. 3, 1, 119--131.
 
254
Pires, A. and Santos-Pereira, C. 2005. Using clustering and robust estimators to detect outliers in multivariate data. In Proceedings of the International Conference on Robust Statistics.
 
255
Platt, J. 2000. Probabilistic Outputs for Support Vector Machines and Comparison to Regularized Likelihood Methods. In Advances in Large Margin Classifiers, A. Smola, P. Bartlett, B. Schoelkopf, and D. Schuurmans, Eds. MIT Press, 61--74.
 
256
Pokrajac, D., Lazarevic, A., and Latecki, L. J. 2007. Incremental local outlier detection for data streams. In Proceedings of the IEEE Symposium on Computational Intelligence and Data Mining.
 
257
Porras, P. A. and Neumann, P. G. 1997. EMERALD: Event monitoring enabling responses to anomalous live disturbances. In Proceedings of the 20th NIST-NCSC National Information Systems Security Conference. 353--365.
 
258
Portnoy, L., Eskin, E., and Stolfo, S. 2001. Intrusion detection with unlabeled data using clustering. In Proceedings of the ACM Workshop on Data Mining Applied to Security.
 
259
Protopapas, P., Giammarco, J. M., Faccioli, L., Struble, M. F., Dave, R., and Alcock, C. 2006. Finding outlier light curves in catalogues of periodic variable stars. Monthly Notices Royal Astronomical Soc. 369, 2, 677--696.
 
260
 
261
Ramadas, M., Ostermann, S., and Tjaden, B. C. 2003. Detecting anomalous network traffic with self-organizing maps. In Proceedings of the Conference on Recent Advances in Intrusion Detection. 36--54.
262
 
263
 
264
Roberts, S. 1999. Novelty detection using extreme value statistics. In Proceedings of the IEEE Vision, Image and Signal Processing Conference Vol. 146. 124--129.
 
265
Roberts, S. 2002. Extreme value statistics for novelty detection in biomedical signal processing. In Proceedings of the 1st International Conference on Advances in Medical Signal and Information Processing. 166--172.
 
266
 
267
Rosner, B. 1983. Percentage points for a generalized ESD many-outlier procedure. Technometrics 25, 2, 165--172.
 
268
Roth, V. 2004. Outlier detection with one-class kernel Fisher discriminants. In Proceedings of the Conference on Advances in Neural Information Processing Systems (NIPS).
 
269
 
270
271
 
272
Ruotolo, R. and Surace, C. 1997. A statistical approach to damage detection through vibration monitoring. In Proceedings of the 5th Pan-American Congress of Applied Mechanics.
 
273
Salvador, S. and Chan, P. 2003. Learning states and rules for time-series anomaly detection. Tech. rep. CS--2003--05, Department of Computer Science, Florida Institute of Technology Melbourne.
 
274
 
275
 
276
Saunders, R. and Gero, J. 2000. The importance of being emergent. In Proceedings of the Conference on Artificial Intelligence in Design.
 
277
Scarth, G., McIntyre, M., Wowk, B., and Somorjai, R. 1995. Detection of novelty in functional images using fuzzy clustering. In Proceedings of the 3rd Meeting of the International Society for Magnetic Resonance in Medicine. 238.
 
278
 
279
Scott, S. L. 2001. Detecting network intrusion using a Markov modulated nonhomogeneous Poisson Process. Journal of the American Statistical Association.
 
280
Sebyala, A. A., Olukemi, T., and Sacks, L. 2002. Active platform security through intrusion detection using naive Bayesian network for anomaly detection. In Proceedings of the London Communications Symposium.
281
 
282
283
 
284
Shewhart, W. A. 1931. Economic Control of Quality of Manufactured Product. D. Van Nostrand Company.
 
285
Shyu, M.-L., Chen, S.-C., Sarinnapakorn, K., and Chang, L. 2003. A novel anomaly detection scheme-based on principal component classifier. In Proceedings of the 3rd IEEE International Conference on Data Mining. 353--365.
286
 
287
 
288
Smith, R., Bivens, A., Embrechts, M., Palagiri, C., and Szymanski, B. 2002. Clustering approaches for anomaly-based intrusion detection. In Proceedings of the Intelligent Engineering Systems through Artificial Neural Networks. ASME Press, 579--584.
 
289
Smyth, P. 1994. Markov monitoring with unknown states. IEEE J. Select. Areas Comm. (Special Issue on Intelligent Signal Processing for Communications) 12, 9, 1600--1612.
 
290
Snyder, D. 2001. Online intrusion detection using sequences of system calls. M.S. thesis, Department of Computer Science, Florida State University.
 
291
Sohn, H., Worden, K., and Farrar, C. 2001. Novelty detection under changing environmental conditions. In Proceedings of the 8th Annual SPIE International Symposium on Smart Structures and Materials.
 
292
Solberg, H. E. and Lahti, A. 2005. Detection of outliers in reference distributions: Performance of Horn's algorithm. Clinical Chem. 51, 12, 2326--2332.
 
293
Song, Q., Hu, W., and Xie, W. 2002. Robust support vector machine with bullet hole image classification. IEEE Trans. Syst. Man Cyber.—Part C: Applications and Reviews 32, 4.
 
294
Song, S., Shin, D., and Yoon, E. 2001. Analysis of novelty detection properties of auto-associators. In Proceedings of the Conference on Condition Monitoring and Diagnostic Engineering Management. 577--584.
 
295
 
296
 
297
 
298
Srivastava, A. 2006. Enabling the discovery of recurring anomalies in aerospace problem reports using high-dimensional clustering techniques. In Proceedings of the IEEE Aerospace Conference, 17--34.
 
299
Srivastava, A. and Zane-Ulman, B. 2005. Discovering recurring anomalies in text reports regarding complex space systems. In Proceedings of the IEEE Aerospace Conference, 3853--3862.
 
300
Stefano, C., Sansone, C., and Vento, M. 2000. To reject or not to reject: that is the question: An answer in the case of neural classifiers. IEEE Trans. Syst. Manag. Cyber. 30, 1, 84--94.
 
301
Stefansky, W. 1972. Rejecting outliers in factorial designs. Technometrics 14, 2, 469--479.
 
302
 
303
Streifel, R., Maks, R., and El-Sharkawi, M. 1996. Detection of shorted-turns in the field of turbine-generator rotors using novelty detectors--development and field tests. IEEE Trans. Energy Conv. 11, 2, 312--317.
 
304
 
305
Sun, H., Bao, Y., Zhao, F., Yu, G., and Wang, D. 2004. CD-trees: An efficient index structure for outlier detection. In Proceedings of the 5th International Conference on Web-Age Information Management (WAIM). 600--609.
 
306
 
307
Sun, J., Xie, Y., Zhang, H., and Faloutsos, C. 2007. Less is more: Compact matrix representation of large sparse graphs. In Proceedings of the 7th SIAM International Conference on Data Mining.
 
308
 
309
 
310
Sun, P., Chawla, S., and Arunasalam, B. 2006. Mining for outliers in sequential databases. In Proceedings of the SIAM International Conference on Data Mining.
 
311
Surace, C. and Worden, K. 1998. A novelty detection method to diagnose damage in structures: An application to an offshore platform. In Proceedings of the 8th International Conference of Off-Shore and Polar Engineering. vol. 4. Colorado, 64--70.
 
312
Surace, C., Worden, K., and Tomlinson, G. 1997. A novelty detection approach to diagnose damage in a cracked beam. In Proceedings of the SPIE. vol. 3089. 947--953.
 
313
 
314
Sykacek, P. 1997. Equivalent error bars for neural network classifiers trained by Bayesian inference. In Proceedings of the European Symposium on Artificial Neural Networks. 121--126.
 
315
316
 
317
 
318
Taniguchi, M., Haft, M., Hollmn, J., and Tresp, V. 1998. Fraud detection in communications networks using neural and probabilistic methods. In Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing. vol. 2. IEEE Computer Society, 1241--1244.
319
 
320
Tarassenko, L. 1995. Novelty detection for the identification of masses in mammograms. In Proceedings of the 4th IEEE International Conference on Artificial Neural Networks. vol. 4. 442--447.
 
321
Tax, D. and Duin, R. 1999a. Data domain description using support vectors. In Proceedings of the European Symposium on Artificial Neural Networks, M. Verleysen, Ed., 251--256.
 
322
 
323
Tax, D. M. J. 2001. One-class classification; concept-learning in the absence of counter-examples. Ph.D. thesis, Delft University of Technology.
 
324
Teng, H., Chen, K., and Lu, S. 1990. Adaptive real-time anomaly detection using inductively generated sequential patterns. In Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy. IEEE Computer Society Press, 278--284.
 
325
Theiler, J. and Cai, D. M. 2003. Resampling approach for anomaly detection in multispectral images. In Proceedings of the SPIE. vol. 5093, 230--240.
 
326
Thompson, B., II, R. M., Choi, J., El-Sharkawi, M., Huang, M., and Bunje, C. 2002. Implicit learning in auto-encoder novelty assessment. In Proceedings of the International Joint Conference on Neural Networks. 2878--2883.
 
327
Thottan, M. and Ji, C. 2003. Anomaly detection in IP networks. IEEE Trans. Sig. Proc. 51, 8, 2191--2204.
 
328
Tibshirani, R. and Hastie, T. 2007. Outlier sums for differential gene expression analysis. Biostatistics 8, 1, 2--8.
 
329
Tomlins, S. A., Rhodes, D. R., Perner, S., Dhanasekaran, S. M., Mehra, R., Sun, X. W., Varambally, S., Cao, X., Tchinda, J., Kuefer, R., Lee, C., Montie, J. E., Shah, R., Pienta, K. J., Rubin, M., and Chinnaiyan, A. M. 2005. Recurrent fusion of tmprss2 and ets transcription factor genes in prostate cancer. Science 310, 5748, 603--611.
 
330
Torr, P. and Murray, D. 1993. Outlier detection and motion segmentation. In Proceedings of the SPIE. Sensor Fusion VI, S. Schenker, Ed. vol. 2059. 432--443.
 
331
Tsay, R. S., Pea, D., and Pankratz, A. E. 2000. Outliers in multi-variate time series. Biometrika 87, 4, 789--804.
 
332
 
333
 
334
 
335
Vasconcelos, G., Fairhurst, M., and Bisset, D. 1994. Recognizing novelty in classification tasks. In Proceedings of the Neural Information Processing Systems Workshop on Novelty Detection and Adaptive Systems Monitoring.
 
336
 
337
 
338
Vinueza, A. and Grudic, G. 2004. Unsupervised outlier detection and semi-supervised learning. Tech. rep. CU-CS-976-04, University of Colorado at Boulder.
 
339
Wei, L., Qian, W., Zhou, A., and Jin, W. 2003. Hot: Hypergraph-based outlier test for categorical data. In Proceedings of the 7th Pacific-Asia Conference on Knowledge and Data Discovery. 399--410.
 
340
Weigend, A. S., Mangeas, M., and Srivastava, A. N. 1995. Nonlinear gated experts for time-series: Discovering regimes and avoiding overfitting. Int. J. Neural Syst. 6, 4, 373--399.
 
341
Weiss, G. M. and Hirsh, H. 1998. Learning to predict rare events in event sequences. In Proceedings of the 4th International Conference on Knowledge Discovery and Data Mining, R. Agrawal, P. Stolorz, and G. Piatetsky-Shapiro, Eds. AAAI Press, 359--363.
 
342
Whitehead, B. and Hoyt, W. 1993. A function approximation approach to anomaly detection in propulsion system test data. In Proceedings of the 29th AIAA/SAE/ASME/ASEE Joint Propulsion Conference. IEEE Computer Society.
 
343
 
344
 
345
Wong, W.-K., Moore, A., Cooper, G., and Wagner, M. 2003. Bayesian network anomaly pattern detection for disease outbreaks. In Proceedings of the 20th International Conference on Machine Learning. AAAI Press, 808--815.
 
346
Worden, K. 1997. Structural fault detection using a novelty measure. J. Sound Vibr. 201, 1, 85--101.
347
 
348
Wu, N. and Zhang, J. 2003. Factor analysis based anomaly detection. In Proceedings of the IEEE Workshop on Information Assurance. United States Military Academy.
 
349
Yairi, T., Kato, Y., and Hori, K. 2001. Fault detection by mining association rules from housekeeping data. In Proceedings of the International Symposium on Artificial Intelligence, Robotics and Automation in Space.
350
 
351
 
352
Ye, N. and Chen, Q. 2001. An anomaly detection technique based on a chi-square statistic for detecting intrusions into information systems. Quality Reliability Engin. Int. 17, 105--112.
 
353
 
354
Ypma, A. and Duin, R. 1998. Novelty detection using self-organizing maps. In Progress in Connectionist Based Information Systems. vol. 2. Springer, 1322--1325.
 
355
 
356
 
357
Zeevi, A. J., Meir, R., and Adler, R. 1997. Time series prediction using mixtures of experts. In Advances in Neural Information Processing. vol. 9. MIT Press.
 
358
 
359
 
360
Zhang, Z., Li, J., Manikopoulos, C., Jorgenson, J., and Ucles, J. 2001. Hide: A hierarchical network intrusion detection system using statistical preprocessing and neural network classification. In Proceedings of the IEEE Workshop on Information Assurance and Security. West Point, 85--90.
 
361


Collaborative Colleagues:
Varun Chandola: colleagues
Arindam Banerjee: colleagues
Vipin Kumar: colleagues