On algorithms selection for unsupervised anomaly detection

T Zoppi, A Ceccarelli… - 2018 IEEE 23rd Pacific Rim …, 2018 - ieeexplore.ieee.org
2018 IEEE 23rd Pacific Rim International Symposium on Dependable …, 2018ieeexplore.ieee.org
Anomaly detection, which aims at identifying unexpected trends and data patterns, has
widely been used to build error detectors, failure predictors or intrusion detectors. Internal
faults or malicious attacks have a different impact on the behavior of the system. They
usually manifest as different observable deviations from the expected behavior, which may
be identified by anomaly detection algorithms. Our study aims at investigating the suitability
of unsupervised algorithms and their families in detecting either point, contextual or …
Anomaly detection, which aims at identifying unexpected trends and data patterns, has widely been used to build error detectors, failure predictors or intrusion detectors. Internal faults or malicious attacks have a different impact on the behavior of the system. They usually manifest as different observable deviations from the expected behavior, which may be identified by anomaly detection algorithms. Our study aims at investigating the suitability of unsupervised algorithms and their families in detecting either point, contextual or collective anomalies. To provide a complete picture, we consider both sliding and non-sliding window algorithms which operate in unsupervised mode. Along with qualitative analyses of each algorithm and family, we conduct an experimental campaign in which we run each algorithm on three state-of-the-art datasets in which we inject either point, contextual or collective anomalies. Results show that non-sliding algorithms are capable to detect point and collective anomalies, while they cannot effectively deal with contextual ones. Instead, sliding window algorithms require shorter periods of training and naturally build a local context, which allow them to effectively deal with contextual anomalies. Such observations are summarized to support the choice of the correct algorithm depending on the investigated class(es) of anomaly.
ieeexplore.ieee.org
以上显示的是最相近的搜索结果。 查看全部搜索结果