Skip to main content
SpringerLink
Log in

Anomaly Detection

  • Living reference work entry
  • First Online:
Encyclopedia of Machine Learning and Data Mining

Abstract

Anomalies correspond to the behavior of a system which does not conform to its expected or normal behavior. Identifying such anomalies from observed data, or the task of anomaly detection, is an important and often critical analysis task. This includes finding abnormalities in a medical image, fraudulent transactions in a credit card history, or structural defects in an aircraft’s engine. The importance of this problem has resulted in a large body of literature on this topic. However, given that the definition of an anomaly is strongly tied to the underlying application, the existing research is often embedded in the application domains, and it is unclear how methods developed for one domain would perform in another. The goal of this article is to provide a general introduction of the anomaly detection problem. We start with the basic formulation of the problem and then discuss the various extensions. In particular, we discuss the challenges associated with identifying anomalies in structured data and provide an overview of existing research in this area. We hope that this article will provide a better understanding of the different directions in which research has been done on this topic, and how techniques developed in one area can be applied in domains for which they were not intended to begin with.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Institutional subscriptions

Notes

  1. 1.

    Also referred to as normal and anomalous classes.

References

  • Abraham B, Chuang A (1989) Outlier detection and time series modeling. Technometrics 31(2):241

    Article  MathSciNet  MATH  Google Scholar 

  • Aggarwal CC (2013) Outlier analysis, Springer, New York

    Book  MATH  Google Scholar 

  • Agovic A, Banerjee A, Ganguly AR, Protopopescu V (2007) Anomaly detection in transportation corridors using manifold embedding. In: First international workshop on knowledge discovery from sensor data, ACM Press, New York

    Google Scholar 

  • Akoglu L, McGlohon M, Faloutsos C (2010) OddBall: spotting anomalies in weighted graphs. In: In Pacific-Asia conference on knowledge discovery and data mining (PAKDD), Hyderabad

    Google Scholar 

  • Akoglu L, Tong H, Koutra D (2015) Graph based anomaly detection and description: a survey. Data Min Knowl Discov 29(3):626

    Article  MathSciNet  Google Scholar 

  • Aleskerov E, Freisleben B, Rao B (1997) Cardwatch: a neural network based database mining system for credit card fraud detection. In: Proceedings of IEEE computational intelligence for financial engineering, New York, pp 220–226

    Google Scholar 

  • Arning A, Agrawal R, Raghavan P (1996) A linear method for deviation detection in large databases. In: Proceedings of 2nd international conference of knowledge discovery and data mining, pp 164–169. citeseer.ist.psu.edu/arning96linear.html

  • Baragona R, Battaglia F (2007) Outliers detection in multivariate time series by independent component analysis. Neural Comput 19(7):1962. doi:http://dx.doi.org/10.1162/neco.2007.19.7.1962

    Google Scholar 

  • Barbara D, Couto J, Jajodia S, Wu N (2001) Detecting novel network intrusions using bayes estimators. In: Proceedings of the first SIAM international conference on data mining, Chicago

    Book  Google Scholar 

  • Barnett V, Lewis T (1994) Outliers in statistical data, Wiley, Chichester

    MATH  Google Scholar 

  • Breunig MM, Kriegel HP, Ng RT, Sander J (1999) Optics-of: identifying local outliers. In: Proceedings of the third European conference on principles of data mining and knowledge discovery, Springer, Berlin/New York, pp 262–270

    Chapter  Google Scholar 

  • Breunig MM, Kriegel HP, Ng RT, Sander J (2000) LOF: identifying density-based local outliers. In: Proceedings of 2000 ACM SIGMOD international conference on management of data. ACM Press, pp 93–104. doi:http://doi.acm.org/10.1145/342009.335388

  • Bu Y, Leung TW, Fu A, Keogh E, Pei J, Meshkin S (2007) WAT: finding top-k discords in time series database. In: Proceedings of 7th siam international conference on data mining

    Google Scholar 

  • Budalakoti S, Srivastava A, Akella R, Turkov E (2006) Anomaly detection in large sets of high-dimensional symbol sequences. Technical report NASA TM-2006-214553, NASA Ames Research Center

    Google Scholar 

  • Budalakoti S, Srivastava A, Otey M (2007) Anomaly detection and diagnosis algorithms for discrete symbol sequences with applications to airline safety. In: Proceedings of the IEEE international conference on systems, man, and cybernetics, Montreal, vol. 37

    Google Scholar 

  • Cabrera JBD, Lewis L, Mehra RK (2001) Detection and classification of intrusions and faults using sequences of system calls. SIGMOD Records 30(4):25. doi:http://doi.acm.org/10.1145/604264.604269

    Google Scholar 

  • Chan PK, Mahoney MV (2005) Modeling multiple time series for anomaly detection. In: Proceedings of the fifth IEEE international conference on data mining. IEEE Computer Society, Washington, DC, pp 90–97

    Chapter  Google Scholar 

  • Chandola V, Banerjee A, Kumar V (2009) Anomaly detection a survey. ACM Comput Surv 41(3):15:1–15:58

    Google Scholar 

  • Chandola V, Banerjee A, Kumar V (2012) Anomaly detection for discrete sequences: a survey. IEEE Trans Knowl Data Eng 24:823. doi:http://doi.ieeecomputersociety.org/10.1109/TKDE.2010.235

    Google Scholar 

  • Chandola V, Cheboli D, Kumar V (2009) Detecting anomalies in a timeseries database. Technical report 09-004, Computer Science Department, University of Minnesota

    Google Scholar 

  • Chawla S, Gionis A (2013) k-means-: a unified approach to clustering and outlier detection. In: Proceedings of the 13th SIAM international conference on data mining, Austin, 2–4 May 2013, pp 189–197

    Google Scholar 

  • Cheng H, Tan PN, Potter C, Klooster S (2009) Detection and characterization of anomalies in multivariate time series. In: Proceedings of the ninth SIAM international conference on data mining (SDM)

    Google Scholar 

  • Chow C, Yeung DY (2002) Parzen-window network intrusion detectors. In: Proceedings of the 16th International conference on pattern recognition, vol 4. IEEE Computer Society, Washington, DC, p 40385

    Google Scholar 

  • Debar H, Dacier M, Nassehi M, Wespi A (1998) Fixed vs. variable-length patterns for detecting suspicious process behavior. In: Proceedings of the 5th European symposium on research in computer security, Springer, London, pp 1–15

    Google Scholar 

  • Ding Q, Katenka N, Barford P, Kolaczyk E, Crovella M (2012) Intrusion as (anti)social communication: characterization and detection. In: Proceedings of the 18th ACM SIGKDD international conference on knowledge discovery and data mining (KDD’12), pp 886–894

    Google Scholar 

  • Eberle W, Holder L (2007) Anomaly detection in data represented as graphs. Intell Data Anal 11(6):663. http://dl.acm.org/citation.cfm?id=1368018.1368024

    Google Scholar 

  • Edgeworth FY (1887) On discordant observations. Philos Mag 23(5):364

    Article  MATH  Google Scholar 

  • Endler D (1998) Intrusion detection: applying machine learning to solaris audit data. In: Proceedings of the 14th annual computer security applications conference. IEEE Computer Society, Los Alamitos, p 268

    Google Scholar 

  • Eskin E, Arnold A, Prerau M, Portnoy L, Stolfo S (2002) A geometric framework for unsupervised anomaly detection. In: Proceedings of applications of data mining in computer security. Kluwer Academics, Dordrecht, pp 78–100

    Google Scholar 

  • Eskin E, Lee W, Stolfo S (2001) Modeling system call for intrusion detection using dynamic window sizes. In: Proceedings of DISCEX. citeseer.ist.psu.edu/portnoy01intrusion.html

    Google Scholar 

  • Florez-Larrahondo G, Bridges SM, Vaughn R (2005) Efficient modeling of discrete events for anomaly detection using hidden Markov models. Inf Secur 3650:506

    Article  MATH  Google Scholar 

  • Forrest S, Hofmeyr SA, Somayaji A, Longstaff TA (1996) A sense of self for unix processes. In: Proceedings of the ISRSP’96, pp 120–128. citeseer.ist.psu.edu/forrest96sense.html

  • Forrest S, Warrender C, Pearlmutter B (1999) Detecting intrusions using system calls: alternate data models. In: Proceedings of the 1999 IEEE ISRSP. IEEE Computer Society, Washington, DC, pp 133–145

    Google Scholar 

  • Fox AJ (1972) Outliers in time series. J R Stat Soc Ser. B(Methodolog) 34(3):350

    Google Scholar 

  • Fu AWC, Leung OTW, Keogh EJ, Lin J (2006) Finding time series discords based on haar transform. In: Proceeding of the 2nd International conference on advanced data mining and applications. Springer, Berlin/New York, pp 31–41

    Chapter  Google Scholar 

  • Fujimaki R, Yairi T, Machida K (2005) An anomaly detection method for spacecraft using relevance vector learning. In: Proceeding of the eleventh ACM SIGKDD international conference on knowledge discovery in data mining. ACM Press, New York, pp 401–410. doi:http://doi.acm.org/10.1145/1081870.1081917

  • Fujimaki R, Yairi T, Machida K (2005) An approach to spacecraft anomaly detection problem using kernel feature space. Adv Knowl Discov Data Min 3518:785

    Article  Google Scholar 

  • Galeano P, Pena D, Tsay RS (2004) Outlier detection in multivariate time series via projection pursuit. Statistics and Econometrics Working Papers ws044211, Universidad Carlos III, Departamento de Estadïstica y Econometrïca

    Google Scholar 

  • Gao J, Tan PN (2006) Converting output scores from outlier detection algorithms into probability estimates. In: Proceedings of the sixth international conference on data mining (ICDM ’06), Hong Kong, pp 212–221

    Google Scholar 

  • Gao J, Liang F, Fan W, Wang C, Sun Y, Han J (2010) On community outliers and their efficient detection in information networks. In: Proceedings of the 16th ACM SIGKDD international conference on knowledge discovery and data mining (KDD ’10), Washington, DC, pp 813–822

    Chapter  Google Scholar 

  • Ghosh AK, Schwartzbard A, Schatz M (1999) Learning program behavior profiles for intrusion detection. In: Proceedings of SANS third conference and workshop on intrusion detection and response. citeseer.ist.psu.edu/ghosh99learning.html

    Google Scholar 

  • Ghosh AK, Schwartzbard A, Schatz M (1999) Using program behavior profiles for intrusion detection. In: Proceedings of 1st USENIX workshop on intrusion detection and network monitoring, Santa Clara, pp 51–62

    Google Scholar 

  • Hawkins S, He H, Williams GJ, Baxter RA (2002) Outlier detection using replicator neural networks. In: Proceedings of the 4th international conference on data warehousing and knowledge discovery. Springer, Berlin, pp 170–180

    Chapter  Google Scholar 

  • He Z, Deng S, Xu X, Huang JZ (2006) A fast greedy algorithm for outlier mining. In: Proceedings of 10th Pacific-Asia conference on knowledge and data discovery, pp 567–576

    Google Scholar 

  • He Z, Xu X, Deng S (2003) Discovering cluster-based local outliers. Pattern Recognit Lett 24(9–10):1641. doi:http://dx.doi.org/10.1016/S0167-8655(03)00003-5

    Google Scholar 

  • He Z, Xu X, Deng S (2005) An optimization model for outlier detection in categorical data. In: Proceedings of international conference on intelligent computing, vol 3644. Springer, Berlin/Heidelberg

    Google Scholar 

  • Hodge V, Austin J (2004) A survey of outlier detection methodologies. Artif Intell Rev 22(2):85. doi:http://dx.doi.org/10.1023/B:AIRE.0000045502.10941.a9

    Google Scholar 

  • Hofmeyr SA, Forrest S, Somayaji A (1998) Intrusion detection using sequences of system calls. J Comput Secur 6(3):151. citeseer.ist.psu.edu/hofmeyr98intrusion.html

    Article  Google Scholar 

  • Keogh E, Lin J, Fu A (2005) Hot sax: Efficiently finding the most unusual time series subsequence. In: Proceedings of the fifth IEEE international conference on data mining, IEEE Computer Society, Washington, DC, pp 226–233. doi:http://dx.doi.org/10.1109/ICDM.2005.79

  • Keogh E, Lin J, Lee SH, Herle HV (2006) Finding the most unusual time series subsequence: algorithms and applications. Knowl Inf Syst 11(1):1. doi:http://dx.doi.org/10.1007/s10115-006-0034-6

    Google Scholar 

  • Keogh E, Lonardi S, Ratanamahatana CA (2004) Towards parameter-free data mining. In: Proceedings of the 10th ACM SIGKDD international conference on Knowledge discovery and data mining, ACM Press, New York, pp 206–215. doi:http://doi.acm.org/10.1145/1014052.1014077

  • Khoa NLD, Chawla S (2010) Robust outlier detection using commute time and eigenspace embedding. In: Advances in knowledge discovery and data mining, 14th Pacific-Asia conference, PAKDD 2010. Proceedings, Part II. Hyderabad, 21–24 June 2010, pp 422–434

    Google Scholar 

  • Knorn F, Leith D (2008) Adaptive Kalman filtering for anomaly detection in software appliances. In: IEEE INFOCOM workshops 2008, Phoenix, AZ, pp 1–6

    Chapter  Google Scholar 

  • Knorr EM, Ng RT (1997) A unified approach for mining outliers. In: Proceedings of the 1997 conference of the centre for advanced studies on collaborative research. IBM Press, Toronto, p 11

    Google Scholar 

  • Knorr EM, Ng RT (1999) Finding intensional knowledge of distance-based outliers. In: The VLDB journal, pp 211–222. citeseer.ist.psu.edu/knorr99finding.html

    Google Scholar 

  • Knorr EM, Ng RT, Tucakov V (2000) Distance-based outliers: algorithms and applications. VLDB J 8(3–4):237. doi:http://dx.doi.org/10.1007/s007780050006

    Google Scholar 

  • Kou Y, Lu CT, Chen D (2006) Spatial weighted outlier detection. In: Proceedings of SIAM conference on data mining, Bethesda

    Book  Google Scholar 

  • Kriegel HP, Hubert MS, Zimek A (2008) Angle-based outlier detection in highdimensional data. In: Proceedings of the 14th ACM SIGKDD international conference on knowledge discovery and data mining (KDD ’08), Las Legas, pp 444–452

    Google Scholar 

  • Kriegel HP, Krger P, Schubert E, Zimek A (2011) Interpreting and unifying outlier scores. In: SDM. SIAM/Omnipress, Mesa, AZ, USA, pp 13–24

    Google Scholar 

  • Kumar V (2005) Parallel and distributed computing for cybersecurity. Distributed systems online. IEEE 6(10). doi:10.1109/MDSO.2005.53

    Google Scholar 

  • Lane T, Brodley CE (1997) Sequence matching and learning in anomaly detection for computer security. In: Fawcett T, Haimowitz I, Provost F, Stolfo S (eds) Proceedings of AI approaches to fraud detection and risk management. AAAI Press, Menlo Park, pp 43–49

    Google Scholar 

  • Lane T, Brodley CE (1999) Temporal sequence learning and data reduction for anomaly detection. ACM Trans Inf Syst Secur 2(3):295. doi:http://doi.acm.org/10.1145/322510.322526

    Google Scholar 

  • Laurikkala J, Juhola1 M, Kentala E (2000) Informal identification of outliers in medical data. In: Fifth international workshop on intelligent data analysis in medicine and pharmacology, Berlin, pp 20–24

    Google Scholar 

  • Lee W, Xiang D (2001) Information-theoretic measures for anomaly detection. In: Proceedings of the IEEE symposium on security and privacy. IEEE Computer Society, Washington, DC, p 130

    Google Scholar 

  • Lee W, Stolfo S, Chan P (1997) Learning patterns from unix process execution traces for intrusion detection. In: Proceedings of the AAAI 97 workshop on AI methods in fraud and risk management

    Google Scholar 

  • Li N, Sun H, Chipman KC, George J, Yan X (2014) A probabilistic approach to uncovering attributed graph anomalies. In: Proceedings of the 2014 SIAM international conference on data mining, Philadelphia, pp 82–90, 24–26 Apr 2014. doi:10.1137/1.9781611973440.10, http://dx.doi.org/10.1137/1.9781611973440.10

  • Lin J, Keogh E, Fu A, Herle HV (2005) Approximations to magic: finding unusual medical time series. In: Proceedings of the 18th IEEE symposium on computer-based medical systems. IEEE Computer Society, Washington, DC, pp 329–334. doi:http://dx.doi.org/10.1109/CBMS.2005.34

  • Ma J, Perkins S (2003) Online novelty detection on temporal sequences. In: Proceedings of the 9th ACM SIGKDD international conference on Knowledge discovery and data mining. ACM Press, New York, pp 613–618. doi:http://doi.acm.org/10.1145/956750.956828

  • Mahoney MV, Chan PK (2002) Learning nonstationary models of normal network tra c for detecting novel attacks. In: Proceedings of the 8th ACM SIGKDD international conference on Knowledge discovery and data mining. ACM Press, pp 376–385. doi:http://doi.acm.org/10.1145/775047.775102

  • Mahoney MV, Chan PK (2003) Learning rules for anomaly detection of hostile network traffic. In: Proceedings of the 3rd IEEE international conference on data mining. IEEE Computer Society, Los Alamitos, p 601

    Google Scholar 

  • Mahoney MV, Chan PK (2005) Trajectory boundary modeling of time series for anomaly detection. In: Proceedings of the KDD workshop on data mining methods for anomaly detection, Las Vegas, NV, USA

    Google Scholar 

  • Mahoney MV, Chan PK, Arshad MH (2003) A machine learning approach to anomaly detection. Technical report CS–2003–06, Department of Computer Science, Florida Institute of Technology Melbourne, FL, 32901

    Google Scholar 

  • Marchette D (1999) A statistical method for profiling network traffic. In: Proceedings of 1st USENIX workshop on intrusion detection and network monitoring, Santa Clara, pp 119–128

    Google Scholar 

  • Michael CC, Ghosh A (2000) Two state-based approaches to program-based anomaly detection. In: Proceedings of the 16th annual computer security applications conference, IEEE Computer Society, Los Alamitos, p 21

    Google Scholar 

  • Müller E, Sanchez PI, Mülle Y, Böhm K (2013) Ranking outlier nodes in subspaces of attributed graphs. In: Workshops proceedings of the 29th IEEE international conference on data engineering. ICDE, pp 216–222

    Google Scholar 

  • Noble CC, Cook DJ (2003) Graph-based anomaly detection. In: Proceedings of the 9th ACM SIGKDD international conference on Knowledge discovery and data mining. ACM Press, pp 631–636. doi:http://doi.acm.org/10.1145/956750.956831

  • Otey ME, Ghoting A, Parthasarathy S (2006) Fast distributed outlier detection in mixed-attribute data sets. Data Min Knowl Discov 12(2–3):203. doi:http://dx.doi.org/10.1007/s10618-005-0014-6

    Google Scholar 

  • Ott L, Pang LX, Ramos FT, Chawla S (2014) On integrated clustering and outlier detection. In: Advances in neural information processing systems, pp 1359–1367

    Google Scholar 

  • Parra L, Deco G, Miesbach S (1996) Statistical independence and novelty detection with information preserving nonlinear maps. Neural Comput 8(2):260

    Article  Google Scholar 

  • Pincombe B (2005) Anomaly detection in time series of graphs using ARMA processes. ASOR Bull 24(4):2

    Google Scholar 

  • Pokrajac D, Lazarevic A, Latecki LJ (2007) Incremental local outlier detection for data streams. In: Proceedings of IEEE symposium on computational intelligence and data mining

    Book  Google Scholar 

  • Portnoy L, Eskin E, Stolfo S (2001) Intrusion detection with unlabeled data using clustering. In: Proceedings of ACM workshop on data mining applied to security. citeseer.ist.psu.edu/portnoy01intrusion.html

    Google Scholar 

  • Protopapas P, Giammarco JM, Faccioli L, Struble MF, Dave R, Alcock C (2006) Finding outlier light curves in catalogues of periodic variable stars. Mon Notices R Astron Soc 369(2):677

    Article  Google Scholar 

  • Qiao Y, Xin XW, Bin Y, Ge S (2002) Anomaly intrusion detection method based on HMM. Electron Lett 38(13):663

    Article  Google Scholar 

  • Ramaswamy S, Rastogi R, Shim K (2000) Efficient algorithms for mining outliers from large data sets. In: Proceedings of the 2000 ACM SIGMOD international conference on Management of data. ACM Press, New York, pp 427–438. doi:http://doi.acm.org/10.1145/342009.335437

  • Roth V (2004) In: NIPS

    Google Scholar 

  • Rousseeuw PJ, Leroy AM (1987) Robust regression and outlier detection. Wiley, New York

    Book  MATH  Google Scholar 

  • Salvador S, Chan P (2003) Learning states and rules for time-series anomaly detection. Technical report CS–2003–05, Department of Computer Science, Florida Institute of Technology Melbourne FL 32901

    Google Scholar 

  • Salvador S, Chan P (2005) Learning states and rules for detecting anomalies in time series. Appl Intell 23(3):241. doi:http://dx.doi.org/10.1007/s10489-005-4610-3

    Google Scholar 

  • Sánchez PI, Müller E, Irmler O, Böhm K (2014) Local context selection for outlier ranking in graphs with multiple numeric node attributes. In: Proceedings of the 26th International conference on scientific and statistical database management (SSDBM ’14). ACM, New York, pp 16:1–16:12. doi:10.1145/2618243.2618266. http://doi.acm.org/10.1145/2618243.2618266

  • Schölkopf B, Platt JC, Shawe-Taylor JC, Smola AJ, Williamson RC (2001) Estimating the support of a high-dimensional distribution. Neural Comput 13(7):1443

    Article  MATH  Google Scholar 

  • Schubert E, Wojdanowski R, Zimek A, Kriegel HP (2012) In: SDM. SIAM/Omnipress, Anaheim, CA, USA, pp 1047–1058

    Google Scholar 

  • Shekhar S, Lu CT, Zhang P (2001) A novel anomaly detection scheme based on principal component classifier. In: Proceedings of the 7th ACM SIGKDD international conference on knowledge discovery and data mining. ACM Press, New York, pp 371–376. doi:http://doi.acm.org/10.1145/502512.502567

  • Shyu ML, Chen SC, Sarinnapakorn K, Chang L (2003) A novel anomaly detection scheme based on principal component classifier. In: Proceedings of 3rd IEEE international conference on data mining, Melbourne, pp 353–365

    Google Scholar 

  • Song X, Wu M, Jermaine C, Ranka S (2007) Conditional anomaly detection. IEEE Trans Knowl Data Eng 19(5):631 doi:http://doi.ieeecomputersociety.org/10.1109/TKDE.2007.1009

    Google Scholar 

  • Spence C, Parra L, Sajda P (2001) Detection, synthesis and compression in mammographic image analysis with a hierarchical image probability model. In: Proceedings of the IEEE workshop on mathematical methods in biomedical image analysis. IEEE Computer Society, Washington, DC, p 3

    Google Scholar 

  • Sun J, Qu H, Chakrabarti D, Faloutsos C (2005) Relevance search and anomaly detection in bipartite graphs. SIGKDD Explor Newslett 7(2):48

    Article  Google Scholar 

  • Sun P, Chawla S, Arunasalam B (2006) Mining for outliers in sequential databases. In: SIAM international conference on data mining, Philadelphia

    Book  Google Scholar 

  • Tan PN, Steinbach M, Kumar V (2005) Introduction to data mining. Addison-Wesley, Boston

    Google Scholar 

  • Tang J, Chen Z, chee Fu AW, Cheung DW (2002) Enhancing effectiveness of outlier detections for low density patterns. In: Proceedings of the Pacific-Asia conference on knowledge discovery and data mining, Taipei, pp 535–548

    Google Scholar 

  • Tax DMJ (2001) One-class classification; concept-learning in the absence of counter-examples. PhD thesis, Delft University of Technology

    Google Scholar 

  • Tax D, Duin R (1999) Data domain description using support vectors. In: Verleysen M (ed) Proceedings of the European symposium on artificial neural networks, Brussels, pp 251–256

    Google Scholar 

  • Tax D, Duin R (1999) Support vector data description. Pattern Recognit Lett 20(11–13):1191

    Article  MATH  Google Scholar 

  • Tong H, Lin C-Y (2011) Non-negative residual matrix factorization with application to graph anomaly detection. In: Proceedings of the 2011 SIAM international conference on data mining, Philadelphia, pp 143–153

    Google Scholar 

  • Tsay RS, Peja D, Pankratz AE (2000) Outliers in multivariate time series. Biometrika 87(4):789

    Article  MathSciNet  MATH  Google Scholar 

  • Vaidya J, Clifton C (2004) Privacy-preserving outlier detection. In: Proceedings of the 4th IEEE international conference on data mining, Brighton, pp 233–240

    Google Scholar 

  • Wei L, Keogh E, Xi X (2006) Saxually explicit images: Finding unusual shapes. In: Proceedings of the sixth international conference on data mining, IEEE Computer Society, Washington, DC, pp 711–720. doi:http://dx.doi.org/10.1109/ICDM.2006.138

  • Wei L, Kumar N, Lolla V, Keogh EJ, Lonardi S, Ratanamahatana C (2005) Assumption-free anomaly detection in time series. In: Proceedings of the 17th international conference on Scientific and statistical database management, Lawrence Berkeley Laboratory, Berkeley, pp 237–240

    Google Scholar 

  • Weigend AS, Mangeas M, Srivastava AN (1995) Nonlinear gated experts for timeseries – discovering regimes and avoiding overfitting. Int J Neural Syst 6(4):373

    Article  Google Scholar 

  • Wu Q, Shao Z (2005) Network anomaly detection using time series analysis. In: Proceedings of the joint international conference on autonomic and autonomous systems and international conference on networking and services. IEEE Computer Society, Washington, DC, p 42

    Google Scholar 

  • Yang J, Wang W (2003) CLUSEQ: Efficient and effective sequence clustering. In: Proceedings of international conference on data engineering, Bangalore, pp 101–112

    Google Scholar 

  • Yankov D, Keogh EJ, Rebbapragada U (2007) Disk aware discord discovery: Finding unusual time series in terabyte sized datasets. In: Proceedings of international conference on data mining, pp 381–390

    Google Scholar 

  • Ye N (2004) A Markov Chain model of temporal behavior for anomaly detection. In: Proceedings of the 5th annual IEEE information assurance workshop. IEEE, Piscataway

    Google Scholar 

  • Zare Moayedi H, Masnadi-Shirazi M (2008) ARIMA model for network traffic prediction and anomaly detection. Int Symp Inf Technol 4:1. doi:10.1109/ITSIM.2008.4631947

    Google Scholar 

  • Zhang J, Wang H (2006) Detecting outlying subspaces for high-dimensional data: the new task, algorithms, and performance. Knowl Inf Syst 10(3):333. doi:http://dx.doi.org/10.1007/s10115-006-0020-z

    Google Scholar 

  • Zhang X, Fan P, Zhu Z (2003) A new anomaly detection method based on hierarchical HMM. In: Proceedings of the 4th international conference on parallel and distributed computing, applications and technologies, Chengdu, pp 249–252

    Google Scholar 

  • Zimmermann J, Mohay G (2006) Distributed intrusion detection in clusters based on non-interference. In: ACSW Frontiers ’06: Proceedings of the 2006 Australasian workshops on grid computing and e-research. Australian Computer Society, Darlinghurst, pp 89–95

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. State University of New York at Buffalo, Buffalo, New York, USA

    Varun Chandola

  2. University of Minnesota, Minneapolis, MN, USA

    Arindam Banerjee

  3. University of Minnesota, Minneapolis, MN, USA

    Vipin Kumar

Authors
  1. Varun Chandola
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Arindam Banerjee
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Vipin Kumar
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Varun Chandola .

Editor information

Editors and Affiliations

  1. Engineering (CSE), University of New South Wales School of Computer Science &, Sydney, New South Wales, Australia

    Claude Sammut

  2. Software Engineering, Monash University School of Computer Science &, Melbourne, Victoria, Australia

    Geoffrey I. Webb

Rights and permissions

Reprints and permissions

Copyright information

© 2016 Springer Science+Business Media New York

About this entry

Cite this entry

Chandola, V., Banerjee, A., Kumar, V. (2016). Anomaly Detection. In: Sammut, C., Webb, G. (eds) Encyclopedia of Machine Learning and Data Mining. Springer, Boston, MA. https://doi.org/10.1007/978-1-4899-7502-7_912-1

Download citation

  • DOI: https://doi.org/10.1007/978-1-4899-7502-7_912-1

  • Received:

  • Accepted:

  • Published:

  • Publisher Name: Springer, Boston, MA

  • Online ISBN: 978-1-4899-7502-7

  • eBook Packages: Springer Reference Computer SciencesReference Module Computer Science and Engineering

Publish with us

Policies and ethics

Search

Navigation