TitleA Novel Anomaly Detection Scheme Based on Principal Component Classifier
Publication TypeConference Proceedings
Year of Publication2003
AuthorsShyu, M-L., S-C. Chen, K. Sarinnapakorn, and LW. Chang
Conference NameICDM Foundation and New Direction of Data Mining workshop
Pagination172-179
Abstract

This paper proposes a novel scheme that uses robust principal component classifier in intrusion detection problems where the training data may be unsupervised. Assuming that anomalies can be treated as outliers, an intrusion predictive model is constructed from the major and minor principal components of the normal instances. A measure of the difference of an anomaly from the normal instance is the distance in the principal component space. The distance based on the major components that account for 50% of the total variation and the minor components whose eigenvalues less than 0.20 is shown to work well. The experiments with KDD Cup 1999 data demonstrate that the proposed method achieves 98.94% in recall and 97.89% in precision with the false alarm rate 0.92% and outperforms the nearest neighbor method, density-based local outliers (LOF) approach, and the outlier detection algorithm based on Canberra metric.

Full Text

Shyu etal2003.pdf

NRL Publication Release Number

03-1221.1-2312