A Geometric Framework for Unsupervised Anomaly Detection

By Eleazar Eskin, Andrew O. Arnold, Michael J. Prerau, Leonid Portnoy, Salvatore J. Stolfo. Applications of Data Mining in Computer Security, 2002

669 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/4d39ee7cca8fedf792570724255a4357aa41dbf8

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

Behavior of Machine Learning Algorithms in Adversarial Environments (2010, background): “Because this approach often fails to detect novel intrusions, a variety of researchers have proposed incorporating machine learning techniques into intrusion detection systems [e.g., Mahoney and Chan, 2002, Lazarevic et al., 2003, Mukkamala et al., 2002, Eskin et al., 2002].”
Autoencoder-based network anomaly detection (2018, methodology): “Neighbor-based methods [7], [12] assume that normal data has relatively more neighbors than the anomalous data.”
A survey of network anomaly detection techniques (2016, background): “The basic principle of the Support Vector Machine (SVM) is to derive a hyperplane that maximizes the separating margin between the positive and negative classes (Eskin et al., 2002).”
Sub-Image Anomaly Detection with Deep Pyramid Correspondences (2020, methodology): “Popular choices of basis functions include: K-means [15], K nearest neighbors (kNN) [9], principal component analysis (PCA) [20].”
Identifying Unknown Unknowns in the Open World: Representations and Policies for Guided Exploration (2016, methodology): “Non-parametric approaches (Es-kin 2000; Eskin et al. 2002; Fawcett and Provost 1997) which made fewer assumptions about the distribution of the data such as histogram based methods, distance and density based methods were also proposed to address this problem.”
Anomaly Detection for Discrete Sequences: A Survey (2012, methodology): “The advantage of similarity-based techniques is that one can use any existing or new similarity measure for sequences [15], [18], [34] and any proximity-based point anomaly detection technique [25], [35], and hence can devise a unique anomaly detection which is best suited for a given problem.”
Classification-Based Anomaly Detection for General Data (2020, methodology): “Some of the earliest methods use: nearest neighbors (Eskin et al., 2002), low-rank PCA (Jolliffe, 2011; Cand`es et al., 2011) or K-means (Hartigan & Wong, 1979) as the reconstruction basis.”
Learning Discriminative Reconstructions for Unsupervised Outlier Removal (2015, methodology): “The dense areas can be estimated by statistical methods [6, 27, 11], neighbor-based methods [17, 3, 7], and reconstruction-based methods [23, 26].”
PANDA: Adapting Pretrained Features for Anomaly Detection and Segmentation (2020, background): “[4, 17], K nearest neighbors [7] and K-means [12]), ii) probabilistic: modeling the probability density function and labeling unlikely sampled as anomalous (e.”
Anomaly detection: A survey (2009, positive): “Several variations of the third category of techniques have been proposed [Pires and Santos-Pereira 2005; Otey et al. 2003; Eskin et al. 2002; Mahoney et al. 2003; Jiang et al. 2001; He et al. 2003].”
Similarity Measures for Categorical Data: A Comparative Evaluation (2008, background): “[9] proposed a normalization kernel for record-based network intrusion detection data.”
Outlier Analysis (2013, background): “A number of outlier detection methods have also been proposed for cases where the anomalies may lie in small clusters [155, 371, 372, 351, 208, 239].”
A Comparative Evaluation of Unsupervised Anomaly Detection Algorithms for Multivariate Data (2016, methodology): “[34] evaluates clustering, k-NN as well as a one-class SVM on the same dataset.”
Robust Random Cut Forest Based Anomaly Detection on Streams (2016, methodology): “A variation of the previous approach is to consider a fixed k number of nearest neighbors and base the anomaly score on this (Eskin et al., 2002; Zhang & Wang, 2006).”