A Geometric Framework for Unsupervised Anomaly Detection

摘要: Most current intrusion detection systems employ signature-based methods or data mining-based which rely on labeled training data. This is typically expensive to produce. We present a new geometric framework for unsupervised anomaly detection, are algorithms that designed process unlabeled In our framework, elements mapped feature space vector ℛd. Anomalies detected by determining points lies in sparse regions of the space. two maps mapping Our first map data-dependent normalization we apply network connections. second spectrum kernel system call traces. three detecting lie evaluate performing experiments over records from KDD CUP 1999 set and traces Lincoln Labs DARPA evaluation.