相关论文
2012 - Procedia Engineering
Prediction of water quality time series data based on least squares support vector machine

Abstract Actual water quality monitoring sites due to inadequate and abnormal by the impact to water quality warning has brought new challenges. How do based on limited monitoring data to predict the water quality to address the shortage of river water quality monitoring sites and data coverage of false alarms caused by abnormal, early warning of water pollution are of great significance. According to river water monitoring data, the small sample properties, is proposed based on least squares support vector machine prediction of water quality parameters, this method has strong ability to predict the true value, and the global optimization and good generalization. This method is applied in the river water quality measurement data, after training the LS-SVM model for water quality parameters of water quality monitoring system to predict, in the same sample under the BP network and RBF network prediction. Experimental results show that the small sample case with noise, least squares support vector machine method is better than multi-layer BP and RBF neural network, to better meets the requirements of water quality prediction. Comparing data of the two experiments shows that new module makes the interest mining more effective.

2010 - IEEE Transactions on Signal Processing
Detection of Spatially Correlated Gaussian Time Series

This work addresses the problem of deciding whether a set of realizations of a vector-valued time series with unknown temporal correlation are spatially correlated or not. For wide sense stationary (WSS) Gaussian processes, this is a problem of deciding between two different power spectral density matrices, one of them diagonal. Specifically, we show that for arbitrary Gaussian processes (not necessarily WSS) the generalized likelihood ratio test (GLRT) is given by the quotient between the determinant of the sample space-time covariance matrix and the determinant of its block-diagonal version. Furthermore, for WSS processes, we present an asymptotic frequency-domain approximation of the GLRT which is given by a function of the Hadamard ratio (quotient between the determinant of a matrix and the product of the elements of the main diagonal) of the estimated power spectral density matrix. The Hadamard ratio is known to be the GLRT detector for vector-valued random variables and, therefore, what this paper shows is how frequency-dependent Hadamard ratios must be merged into a single test statistic when the vector-valued random variable is replaced by a vector-valued time series with temporal correlation. For bivariate time series, the derived frequency domain detector can be rewritten as a function of the well-known magnitude squared coherence (MSC) spectrum, which suggests a straightforward extension of the MSC spectrum to the general case of multivariate time series. Finally, the performance of the proposed method is illustrated by means of simulations.

2012 - 2012 IEEE 12th International Conference on Data Mining
Clustering Time Series Using Unsupervised-Shapelets

Time series clustering has become an increasingly important research topic over the past decade. Most existing methods for time series clustering rely on distances calculated from the entire raw data using the Euclidean distance or Dynamic Time Warping distance as the distance measure. However, the presence of significant noise, dropouts, or extraneous data can greatly limit the accuracy of clustering in this domain. Moreover, for most real world problems, we cannot expect objects from the same class to be equal in length. As a consequence, most work on time series clustering only considers the clustering of individual time series "behaviors," e.g., individual heart beats or individual gait cycles, and contrives the time series in some way to make them all equal in length. However, contriving the data in such a way is often a harder problem than the clustering itself. In this work, we show that by using only some local patterns and deliberately ignoring the rest of the data, we can mitigate the above problems and cluster time series of different lengths, i.e., cluster one heartbeat with multiple heartbeats. To achieve this we exploit and extend a recently introduced concept in time series data mining called shapelets. Unlike existing work, our work demonstrates for the first time the unintuitive fact that shapelets can be learned from unlabeled time series. We show, with extensive empirical evaluation in diverse domains, that our method is more accurate than existing methods. Moreover, in addition to accurate clustering results, we show that our work also has the potential to give insights into the domains to which it is applied.

2014
Encoding Time Series as Images for Visual Inspection and Classification Using Tiled Convolutional Neural Networks

Inspired by recent successes of deep learning in computer vision and speech recognition, we propose a novel framework to encode time series data as different types of images, namely, Gramian Angular Fields (GAF) and Markov Transition Fields (MTF). This enables the use of techniques from computer vision for classification. Using a polar coordinate system, GAF images are represented as a Gramian matrix where each element is the trigonometric sum (i.e., superposition of directions) between different time intervals. MTF images represent the first order Markov transition probability along one dimension and temporal dependency along the other. We used Tiled Convolutional Neural Networks (tiled CNNs) on 12 standard datasets to learn high-level features from individual GAF, MTF, and GAF-MTF images that resulted from combining GAF and MTF representations into a single image. The classification results of our approach are competitive with five stateof-the-art approaches. An analysis of the features and weights learned via tiled CNNs explains why the approach works.

2004 - International Journal of Forecasting
Combining time series models for forecasting

Abstract Statistical models (e.g., ARIMA models) have commonly been used in time series data analysis and forecasting. Typically, one model is selected based on a selection criterion (e.g., AIC), hypothesis testing, and/or graphical inspection. The selected model is then used to forecast future values. However, model selection is often unstable and may cause an unnecessarily high variability in the final estimation/prediction. In this work, we propose the use of an algorithm, AFTER, to convexly combine the models for a better performance of prediction. The weights are sequentially updated after each additional observation. Simulations and real data examples are used to compare the performance of our approach with model selection methods. The results show an advantage of combining by AFTER over selection in terms of forecasting accuracy at several settings.

2010 - 2010 IEEE Symposium on Visual Analytics Science and Technology
Visual market sector analysis for financial time series data

The massive amount of financial time series data that originates from the stock market generates large amounts of complex data of high interest. However, adequate solutions that can effectively handle the information in order to gain insight and to understand the market mechanisms are rare. In this paper, we present two techniques and applications that enable the user to interactively analyze large amounts of time series data in real-time in order to get insight into the development of assets, market sectors, countries, and the financial market as a whole. The first technique allows users to quickly analyze combinations of single assets, market sectors as well as countries, compare them to each other, and to visually discover the periods of time where market sectors and countries get into turbulence. The second application clusters a selection of large amounts of financial time series data according to their similarity, and analyzes the distribution of the assets among market sectors. This allows users to identify the characteristic graphs which are representative for the development of a particular market sector, and also to identify the assets which behave considerably differently compared to other assets in the same sector. Both applications allow the user to perform investigative exploration techniques and interactive visual analysis in real-time.

2013 - Eng. Appl. Artif. Intell.
An efficient time series forecasting model based on fuzzy time series

In this paper, we present a new model to handle four major issues of fuzzy time series forecasting, viz., determination of effective length of intervals, handling of fuzzy logical relationships (FLRs), determination of weight for each FLR, and defuzzification of fuzzified time series values. To resolve the problem associated with the determination of length of intervals, this study suggests a new time series data discretization technique. After generating the intervals, the historical time series data set is fuzzified based on fuzzy time series theory. Each fuzzified time series values are then used to create the FLRs. Most of the existing fuzzy time series models simply ignore the repeated FLRs without any proper justification. Since FLRs represent the patterns of historical events as well as reflect the possibility of appearances of these types of patterns in the future. If we simply discard the repeated FLRs, then there may be a chance of information lost. Therefore, in this model, it is recommended to consider the repeated FLRs during forecasting. It is also suggested to assign weights on the FLRs based on their severity rather than their patterns of occurrences. For this purpose, a new technique is incorporated in the model. This technique determines the weight for each FLR based on the index of the fuzzy set associated with the current state of the FLR. To handle these weighted FLRs and to obtain the forecasted results, this study proposes a new defuzzification technique. The proposed model is verified and validated with three different time series data sets. Empirical analyses signify that the proposed model have the robustness to handle one-factor time series data set very efficiently than the conventional fuzzy time series models. Experimental results show that the proposed model also outperforms over the conventional statistical models.

2011 - International Journal of Project Management
Evolutionary fuzzy decision model for cash flow prediction using time-dependent support vector machines

Abstract The ability of project managers to make reliable cash flow predictions enhances project cost flow control and management. Reliable cash flow prediction over the course of a construction project puts the project manager in a better position to identify potential problems and develop appropriate strategies to mitigate the negative effects of such on overall project success. Therefore, managers should monitor project progress using cash flow data, which has unique characteristics, as time series data. However, the complex, mutable nature of construction projects currently requires significant reliance on experience and expert opinions to predict cash flow on an ongoing basis. Recent studies have indicated good potential for using artificial intelligence to reduce reliance on human input in cash flow prediction processes. The Evolutionary Fuzzy Support Vector Machine Inference Model for Time Series Data (EFSIM T ), an artificial intelligence hybrid system focusing on the management of time series data characteristics which fuses fuzzy logic (FL), weighted support vector machines (weighted SVMs) and a fast messy genetic algorithm (fmGA), represents a promising alternative approach to predicting cash flow. Simulations performed on historical cash flow data demonstrate the EFSIM T is an effective tool for predicting cash flow.

2014 - 2014 11th International Conference on Fuzzy Systems and Knowledge Discovery (FSKD)
Evaluating host-based anomaly detection systems: Application of the one-class SVM algorithm to ADFA-LD

ADFA-LD is a recently released data set for evaluating host-based anomaly detection systems, aiming to substitute the existing benchmark data sets which have failed to reflect the characteristics of modern computer systems. In a previous work, we had attempted to evaluate ADFA-LD with a highly efficient frequency model but the performance is inferior. In this paper, we focus on the other typical technical category that detects anomalies with a short sequence model. In collaboration with the one-class SVM algorithm, a novel anomaly detection system is proposed for ADFA-LD. The numerical experiments demonstrate that it can not only achieve a satisfactory performance, but also reduce the computational cost largely.

2007 - Inf. Secur. Tech. Rep.
Adaptive real-time anomaly detection with incremental clustering

Anomaly detection in information (IP) networks, detection of deviations from what is considered normal, is an important complement to misuse detection based on known attack descriptions. Performing anomaly detection in real-time places hard requirements on the algorithms used. First, to deal with the massive data volumes one needs to have efficient data structures and indexing mechanisms. Secondly, the dynamic nature of today's information networks makes the characterisation of normal requests and services difficult. What is considered as normal during some time interval may be classified as abnormal in a new context, and vice versa. These factors make many proposed data mining techniques less suitable for real-time intrusion detection. In this paper we present ADWICE, Anomaly Detection With fast Incremental Clustering, and propose a new grid index that is shown to improve detection performance while preserving efficiency in search. Moreover, we propose two mechanisms for adaptive evolution of the normality model: incremental extension with new elements of normal behaviour, and a new feature that enables forgetting of outdated elements of normal behaviour. These address the needs of a dynamic network environment such as a telecom management network. We evaluate the technique for network-based intrusion detection, using the KDD data set as well as on data from a telecom IP test network. The experiments show good detection quality and act as proof of concept for adaptation of normality.

2018 - Clinical Psychological Science
Personalized Network Modeling in Psychopathology: The Importance of Contemporaneous and Temporal Connections

Recent literature has introduced (a) the network perspective to psychology and (b) collection of time series data to capture symptom fluctuations and other time varying factors in daily life. Combining these trends allows for the estimation of intraindividual network structures. We argue that these networks can be directly applied in clinical research and practice as hypothesis generating structures. Two networks can be computed: a temporal network, in which one investigates if symptoms (or other relevant variables) predict one another over time, and a contemporaneous network, in which one investigates if symptoms predict one another in the same window of measurement. The contemporaneous network is a partial correlation network, which is emerging in the analysis of cross-sectional data but is not yet utilized in the analysis of time series data. We explain the importance of partial correlation networks and exemplify the network structures on time series data of a psychiatric patient.

2006 - hep-th/0604094
Trace anomaly on a quantum spacetime manifold

In this paper we investigate the trace anomaly in a space-time where single events are delocalized as a consequence of short distance quantum coordinate fluctuations. We obtain a modified form of heat kernel asymptotic expansion which does not suffer from short distance divergences. Calculation of the trace anomaly is performed using an IR regulator in order to circumvent the absence of UV infinities. The explicit form of the trace anomaly is presented and the corresponding 2D Polyakov effective action and energy-momentum tensor are obtained. The vacuum expectation value of the energy-momentum tensor in the Boulware, Hartle-Hawking and Unruh vacua is explicitly calculated in a rt section of a recently found, noncommutative inspired, Schwarzschild-like solution of the Einstein equations. The standard short distance divergences in the vacuum expectation values are regularized in agreement with the absence of UV infinities removed by quantum coordinate fluctuations.

1987
Topological dimension and local coordinates from time series data

A method for the estimation of the topological dimension of a manifold from time series data is presented. It is based on the approximation of the manifold near a point chi by its tangent space at chi . The dimension of the tangent space is estimated by constructing a maximal set of linearly independent vectors from the data near chi using the method of singular value decomposition. The method is used to analyse experimental data obtained from a nonlinear electronic oscillator in a chaotic state.

1992
Estimating the Lyapunov Exponent of a Chaotic System with Nonparametric Regression

Abstract We discuss procedures based on nonparametric regression for estimating the dominant Lyapunov Exponent λ1 from time series data generated by a nonlinear autoregressive system with additive noise. For systems with bounded fluctuations, λ1 > 0 is the defining feature of chaos. Thus our procedures can be used to examine time series data for evidence of chaotic dynamics. We show that a consistent estimator of the partial derivatives of the autoregression function can be used to obtain a consistent estimator of λ1. The rate of convergence we establish is quite slow; a better rate of convergence is derived heuristically and supported by simulations. Simulation results from several implementations—one “local” (thin-plate splines) and three “global” (neural nets, radial basis functions, and projection pursuit)—are presented for two deterministic chaotic systems. Local splines and neural nets yield accurate estimates of the Lyapunov exponent; however, the spline method is sensitive to the choice of the emb...

2011 - IEEE Geoscience and Remote Sensing Letters
Anomaly Detection in Hyperspectral Images Based on an Adaptive Support Vector Method

Recently, anomaly detection (AD) has attracted considerable interest in a wide variety of hyperspectral remote sensing applications. The goal of this unsupervised technique of target detection is to identify the pixels with significantly different spectral signatures from the neighboring background. Kernel methods, such as kernel-based support vector data description (SVDD) (K-SVDD), have been presented as the successful approach to AD problems. The most commonly used kernel is the Gaussian kernel function. The main problem using the Gaussian kernel-based AD methods is the optimal setting of sigma. In an attempt to address this problem, this paper proposes a direct and adaptive measure for Gaussian K-SVDD (GK-SVDD). The proposed measure is based on a geometric interpretation of the GK-SVDD. Experimental results are presented on real and synthetically implanted targets of the target detection blind-test data sets. Compared to previous measures, the results demonstrate better performance, particularly for subpixel anomalies.

2015 - 2015 World Congress on Industrial Control Systems Security (WCICSS)
Frequency-based anomaly detection for the automotive CAN bus

The modern automobile is controlled by networked computers. The security of these networks was historically of little concern, but researchers have in recent years demonstrated their many vulnerabilities to attack. As part of a defence against these attacks, we evaluate an anomaly detector for the automotive controller area network (CAN) bus. The majority of attacks are based on inserting extra packets onto the network. But most normal packets arrive at a strict frequency. This motivates an anomaly detector that compares current and historical packet timing. We present an algorithm that measures inter-packet timing over a sliding window. The average times are compared to historical averages to yield an anomaly signal. We evaluate this approach over a range of insertion frequencies and demonstrate the limits of its effectiveness. We also show how a similar measure of the data contents of packets is not effective for identifying anomalies. Finally we show how a one-class support vector machine can use the same information to detect anomalies with high confidence.

2004 - Comput. Commun.
Anomaly detection methods in wired networks: a survey and taxonomy

Despite the advances reached along the last 20 years, anomaly detection in network behavior is still an immature technology, and the shortage of commercial tools thus corroborates it. Nevertheless, the benefits which could be obtained from a better understanding of the problem itself as well as the improvement of these mechanisms, especially in network security, justify the demand for more research efforts in this direction. This article presents a survey on current anomaly detection methods for network intrusion detection in classical wired environments. After introducing the problem and elucidating its interest, a taxonomy of current solutions is presented. The outlined scheme allows us to systematically classify current detection methods as well as to study the different facets of the problem. The more relevant paradigms are subsequently discussed and illustrated through several case studies of selected systems developed in the field. The problems addressed by each of them as well as their weakest points are thus explained. Finally, this work concludes with an analysis of the problems that still remain open. Based on this discussion, some research lines are identified.

2014 - ACM Trans. Knowl. Discov. Data
GLAD: group anomaly detection in social media analysis

Traditional anomaly detection on social media mostly focuses on individual point anomalies while anomalous phenomena usually occur in groups. Therefore, it is valuable to study the collective behavior of individuals and detect group anomalies. Existing group anomaly detection approaches rely on the assumption that the groups are known, which can hardly be true in real world social media applications. In this article, we take a generative approach by proposing a hierarchical Bayes model: Group Latent Anomaly Detection (GLAD) model. GLAD takes both pairwise and point-wise data as input, automatically infers the groups and detects group anomalies simultaneously. To account for the dynamic properties of the social media data, we further generalize GLAD to its dynamic extension d-GLAD. We conduct extensive experiments to evaluate our models on both synthetic and real world datasets. The empirical results demonstrate that our approach is effective and robust in discovering latent groups and detecting group anomalies.

2004 - KDD
Eigenspace-based anomaly detection in computer systems

We report on an automated runtime anomaly detection method at the application layer of multi-node computer systems. Although several network management systems are available in the market, none of them have sufficient capabilities to detect faults in multi-tier Web-based systems with redundancy. We model a Web-based system as a weighted graph, where each node represents a "service" and each edge represents a dependency between services. Since the edge weights vary greatly over time, the problem we address is that of anomaly detection from a time sequence of graphs.In our method, we first extract a feature vector from the adjacency matrix that represents the activities of all of the services. The heart of our method is to use the principal eigenvector of the eigenclusters of the graph. Then we derive a probability distribution for an anomaly measure defined for a time-series of directional data derived from the graph sequence. Given a critical probability, the threshold value is adaptively updated using a novel online algorithm.We demonstrate that a fault in a Web application can be automatically detected and the faulty services are identified without using detailed knowledge of the behavior of the system.

2002 - IEEE Trans. Geosci. Remote. Sens.
Anomaly detection and classification for hyperspectral imagery

Anomaly detection becomes increasingly important in hyperspectral image analysis, since hyperspectral imagers can now uncover many material substances which were previously unresolved by multispectral sensors. Two types of anomaly detection are of interest and considered in this paper. One was previously developed by Reed and Yu to detect targets whose signatures are distinct from their surroundings. Another was designed to detect targets with low probabilities in an unknown image scene. Interestingly, they both operate the same form as does a matched filter. Moreover, they can be implemented in real-time processing, provided that the sample covariance matrix is replaced by the sample correlation matrix. One disadvantage of an anomaly detector is the lack of ability to discriminate the detected targets from another. In order to resolve this problem, the concept of target discrimination measures is introduced to cluster different types of anomalies into separate target classes. By using these class means as target information, the detected anomalies can be further classified. With inclusion of target discrimination in anomaly detection, anomaly classification can be implemented in a three-stage process, first by anomaly detection to find potential targets, followed by target discrimination to cluster the detected anomalies into separate target classes, and concluded by a classifier to achieve target classification. Experiments show that anomaly classification performs very differently from anomaly detection.

Anomaly detection for symbolic sequences and time series data

Varun Chandola
|
Arindam Banerjee
|
Vipin Kumar
|
Vipin Kumar
|
A. Banerjee
|
V. Chandola

Abstract:This thesis deals with the problem of anomaly detection for sequence data. Anomaly detection has been a widely researched problem in several application domains such as system health management, intrusion detection, health-care, bio-informatics, fraud detection, and mechanical fault detection. Traditional anomaly detection techniques analyze each data instance (as a univariate or multivariate record) independently, and ignore the sequential aspect of the data. Often, anomalies in sequences can be detected only by analyzing data instances together as a sequence, and hence cannot detected by traditional anomaly detection techniques. The problem of anomaly detection for sequence data is a rich area of research because of two main reasons. First, sequences can be of different types, e.g., symbolic sequences, time series data, etc., and each type of sequence poses unique set of problems. Second, anomalies in sequences can be defined in multiple ways and hence there are different problem formulations. In this thesis we focus on solving one particular problem formulation called semi-supervised anomaly detection. We study the problem separately for symbolic sequences, univariate time series data, and multivariate time series data. The state of art on anomaly detection for sequences is limited and fragmented across application domains. For symbolic sequences, several techniques have been proposed within specific domains, but it is not well-understood as to how a technique developed for one domain would perform in a completely different domain. For univariate time series data, limited techniques exist, and are only evaluated for specific domains, while for multivariate time series data, anomaly detection research is relatively untouched. This thesis has two key goals. First goal is to develop novel anomaly detection techniques for different types of sequences which perform better than existing techniques across a variety of application domains. The second goal is to identify the best anomaly detection technique for a given application domain. By realizing the first goal, we develop a suite of anomaly detection techniques for a domain scientist to choose from, while the second goal will help the scientist to choose the technique best suited for the task. To achieve the first goal, we develop several novel anomaly detection techniques for univariate symbolic sequences, univariate time series data, and multivariate time series data. We provide extensive experimental evaluation of the proposed techniques on data sets collected across diverse domains and generated from data generators, also developed as part of this thesis. We show how the proposed techniques can be used to detect anomalies which translate to critical events in domains such as aircraft safety, intrusion detection, and patient health management. The techniques proposed in this thesis are shown to outperform existing techniques on many data sets. The technique proposed for multivariate time series data is one of the very first anomaly detection technique that can detect complex anomalies in such data. To achieve the second goal, we study the relationship between anomaly detection techniques and the nature of the data on which they are applied. A novel analysis framework, Reference Based Analysis (RBA), is proposed that can map a given data set (of any type) into a multivariate continuous space with respect to a reference data set. We apply the RBA framework to not only visualize and understand complex data types, such as multivariate categorical data and symbolic sequence data, but also to extract data driven features from symbolic sequences, which when used with traditional anomaly detection techniques are shown to consistently outperform the state of art anomaly detection techniques for these complex data types. Two novel techniques for symbolic sequences, WIN1D and WIN 2D are proposed using the RBA framework which perform better than the best technique for each different data set.

参考文献

[1]  Stephanie Forrest,et al.  A sense of self for Unix processes , 1996, Proceedings 1996 IEEE Symposium on Security and Privacy.

[2]  Takehisa Yairi,et al.  An Anomaly Detection Method for Spacecraft Using Relevance Vector Learning , 2005, PAKDD.

[3]  Sushil Jajodia,et al.  Detecting Novel Network Intrusions Using Bayes Estimators , 2001, SDM.

[4]  James Demmel,et al.  Applied Numerical Linear Algebra , 1997 .

[5]  Haym Hirsh,et al.  Learning to Predict Rare Events in Event Sequences , 1998, KDD.

[6]  Victoria J. Hodge,et al.  A Survey of Outlier Detection Methodologies , 2004, Artificial Intelligence Review.

[7]  Li Wei,et al.  Assumption-Free Anomaly Detection in Time Series , 2005, SSDBM.

[8]  Michael Schatz,et al.  Learning Program Behavior Profiles for Intrusion Detection , 1999, Workshop on Intrusion Detection and Network Monitoring.

[9]  David J. Marchette.  A Statistical Method for Profiling Network Traffic , 1999, Workshop on Intrusion Detection and Network Monitoring.

[10]  R.K. Cunningham,et al.  Evaluating intrusion detection systems: the 1998 DARPA off-line intrusion detection evaluation , 2000, Proceedings DARPA Information Survivability Conference and Exposition. DISCEX'00.

[11]  Sheng Ma,et al.  Fast ordering of large categorical datasets for better visualization , 2001, KDD '01.

[12]  Nong Ye,et al.  A Markov Chain Model of Temporal Behavior for Anomaly Detection , 2000 .

[13]  Philip K. Chan,et al.  Learning rules for anomaly detection of hostile network traffic , 2003, Third IEEE International Conference on Data Mining.

[14]  Vipin Kumar,et al.  Mining needle in a haystack: classifying rare classes via two-phase rule induction , 2001, SIGMOD '01.

[15]  Vipin Kumar,et al.  Similarity Measures for Categorical Data: A Comparative Evaluation , 2008, SDM.

[16]  A. N. Srivastava,et al.  Anomaly Detection in Large Sets of High-Dimensional Symbol Sequences , 2006 .

[17]  Johannes Gehrke,et al.  CACTUS—clustering categorical data using summaries , 1999, KDD '99.

[18]  Anup Ghosh,et al.  Simple, state-based approaches to program-based anomaly detection , 2002, TSEC.

[19]  Salvatore J. Stolfo,et al.  Data Mining Approaches for Intrusion Detection , 1998, USENIX Security Symposium.

[20]  James Theiler,et al.  Resampling approach for anomaly detection in multispectral images , 2003, SPIE Defense + Commercial Sensing.

[21]  Carla E. Brodley,et al.  Temporal sequence learning and data reduction for anomaly detection , 1998, CCS '98.

[22]  Vipin Kumar,et al.  Predicting rare classes: can boosting make any weak learner strong? , 2002, KDD.

[23]  Yi Li,et al.  COOLCAT: an entropy-based algorithm for categorical clustering , 2002, CIKM '02.

[24]  Philip K. Chan,et al.  Learning nonstationary models of normal network traffic for detecting novel attacks , 2002, KDD.

[25]  Li Wei,et al.  SAXually Explicit Images: Finding Unusual Shapes , 2006, Sixth International Conference on Data Mining (ICDM'06).

[26]  H. Hofmann.  Exploring categorical data: interactive mosaic plots , 2000 .

[27]  Raymond T. Ng,et al.  Distance-based outliers: algorithms and applications , 2000, The VLDB Journal.

[28]  Vipin Kumar,et al.  Comparative Evaluation of Anomaly Detection Techniques for Sequence Data , 2008, 2008 Eighth IEEE International Conference on Data Mining.

[29]  Sameer Singh,et al.  Novelty detection: a review - part 1: statistical approaches , 2003, Signal Process..

[30]  Don R. Hush,et al.  A Classification Framework for Anomaly Detection , 2005, J. Mach. Learn. Res..

[31]  Barak A. Pearlmutter,et al.  Detecting intrusions using system calls: alternative data models , 1999, Proceedings of the 1999 IEEE Symposium on Security and Privacy (Cat. No.99CB36344).

[32]  Peter J. Rousseeuw,et al.  Robust Regression and Outlier Detection , 2005, Wiley Series in Probability and Statistics.

[33]  Gunnar Rätsch,et al.  Predicting Time Series with Support Vector Machines , 1997, ICANN.

[34]  Jian Tang,et al.  Enhancing Effectiveness of Outlier Detections for Low Density Patterns , 2002, PAKDD.

[35]  Rayford B. Vaughn,et al.  Efficient Modeling of Discrete Events for Anomaly Detection Using Hidden Markov Models , 2005, ISC.

[36]  R. Tsay,et al.  Outlier Detection in Multivariate Time Series by Projection Pursuit , 2006 .

[37]  Ron Meir,et al.  Time Series Prediction using Mixtures of Experts , 1996, NIPS.

[38]  Bernd Freisleben,et al.  CARDWATCH: a neural network based database mining system for credit card fraud detection , 1997, Proceedings of the IEEE/IAFE 1997 Computational Intelligence for Financial Engineering (CIFEr).

[39]  Eamonn J. Keogh,et al.  Finding the most unusual time series subsequence: algorithms and applications , 2006, Knowledge and Information Systems.

[40]  Mikhail J. Atallah,et al.  Detection of significant sets of episodes in event sequences , 2004, Fourth IEEE International Conference on Data Mining (ICDM'04).

[41]  Hans-Peter Kriegel,et al.  LOF: identifying density-based local outliers , 2000, SIGMOD '00.

[42]  Shashi Shekhar,et al.  Detecting graph-based spatial outliers: algorithms and applications (a summary of results) , 2001, KDD '01.

[43]  Robert D. Finn,et al.  The Pfam protein families database , 2004, Nucleic Acids Res..

[44]  P. Protopapas,et al.  Finding outlier light curves in catalogues of periodic variable stars , 2005, astro-ph/0505495.

[45]  Tom Fawcett,et al.  An introduction to ROC analysis , 2006, Pattern Recognit. Lett..

[46]  Eamonn J. Keogh,et al.  Approximations to magic: finding unusual medical time series , 2005, 18th IEEE Symposium on Computer-Based Medical Systems (CBMS'05).

[47]  Sridhar Ramaswamy,et al.  Efficient algorithms for mining outliers from large data sets , 2000, SIGMOD '00.

[48]  Dipankar Dasgupta,et al.  Anomaly detection in multidimensional data using negative selection algorithm , 2002, Proceedings of the 2002 Congress on Evolutionary Computation. CEC'02 (Cat. No.02TH8600).

[49]  Russell Freeland.  Binary output , 1989 .

[50]  Yiguo Qiao,et al.  Anomaly intrusion detection method based on HMM , 2002 .

[51]  Stephanie Forrest,et al.  Intrusion Detection Using Sequences of System Calls , 1998, J. Comput. Secur..

[52]  Philip K. Chan,et al.  A Machine Learning Approach to Anomaly Detection , 2003 .

[53]  Hans-Peter Kriegel,et al.  OPTICS-OF: Identifying Local Outliers , 1999, PKDD.

[54]  Brandon Pincombea,et al.  Anomaly Detection in Time Series of Graphs using ARMA Processes , 2007 .

[55]  Hongxing He,et al.  Outlier Detection Using Replicator Neural Networks , 2002, DaWaK.

[56]  Jeffrey M. Hausdorff,et al.  Physionet: Components of a New Research Resource for Complex Physiologic Signals". Circu-lation Vol , 2000 .

[57]  William W. Cohen.  Fast Effective Rule Induction , 1995, ICML.

[58]  Helwig Hauser,et al.  Parallel Sets: Visual Analysis of Categorical Data , 2005, INFOVIS.

[59]  Jinyuan You,et al.  CLOPE: a fast and effective clustering algorithm for transactional data , 2002, KDD.

[60]  Martti Juhola,et al.  Informal identification of outliers in medical data , 2000 .

[61]  Nitesh V. Chawla,et al.  Editorial: special issue on learning from imbalanced data sets , 2004, SKDD.

[62]  Lucas C. Parra,et al.  Statistical Independence and Novelty Detection with Information Preserving Nonlinear Maps , 1996, Neural Computation.

[63]  H. Hotelling.  Relations Between Two Sets of Variates , 1936 .

[64]  Eamonn J. Keogh,et al.  Disk aware discord discovery: finding unusual time series in terabyte sized datasets , 2007, Seventh IEEE International Conference on Data Mining (ICDM 2007).

[65]  Xiao Hu,et al.  Multivariate change detection for time series data in aircraft engine fault diagnostics , 2007, 2007 IEEE International Conference on Systems, Man and Cybernetics.

[66]  Dong Xiang,et al.  Information-theoretic measures for anomaly detection , 2001, Proceedings 2001 IEEE Symposium on Security and Privacy. S&P 2001.

[67]  Douglas M. Hawkins.  Identification of Outliers , 1980, Monographs on Applied Probability and Statistics.

[68]  H. S. Teng,et al.  Adaptive real-time anomaly detection using inductively generated sequential patterns , 1990, Proceedings. 1990 IEEE Computer Society Symposium on Research in Security and Privacy.

[69]  Xiao-yun Chen,et al.  Multi-scale anomaly detection algorithm based on infrequent pattern of time series , 2008 .

[70]  George C.J. Fernandez,et al.  Data Mining Using SAS Applications , 2002 .

[71]  Jung-Min Park,et al.  An overview of anomaly detection techniques: Existing solutions and latest technological trends , 2007, Comput. Networks.

[72]  Eamonn J. Keogh,et al.  Finding surprising patterns in a time series database in linear time and space , 2002, KDD.

[73]  Fabio A. González,et al.  Anomaly Detection Using Real-Valued Negative Selection , 2003, Genetic Programming and Evolvable Machines.

[74]  Vipin Kumar,et al.  A Framework for Exploring Categorical Data , 2009, SDM.

[75]  Robert P. W. Duin,et al.  Data domain description using support vectors , 1999, ESANN.

[76]  Junshui Ma,et al.  Online novelty detection on temporal sequences , 2003, KDD '03.

[77]  Pingzhi Fan,et al.  A new anomaly detection method based on hierarchical HMM , 2003, Proceedings of the Fourth International Conference on Parallel and Distributed Computing, Applications and Technologies.

[78]  Anup K. Ghosh,et al.  Using Program Behavior Pro � les for Intrusion Detection , 1999 .

[79]  Leonid Portnoy,et al.  Intrusion detection with unlabeled data using clustering , 2000 .

[80]  David M. Pennock,et al.  A Maximum Entropy Approach to Collaborative Filtering in Dynamic, Sparse, High-Dimensional Domains , 2002, NIPS.

[81]  Stephen D. Bay,et al.  The UCI KDD archive of large data sets for data mining research and experimentation , 2000, SKDD.

[82]  N..  DISCOVERING SYSTEM HEALTH ANOMALIES USING DATA MINING TECHNIQUES , 2006 .

[83]  Bernhard Schölkopf,et al.  Estimating the Support of a High-Dimensional Distribution , 2001, Neural Computation.

[84]  Richard A. Kemmerer,et al.  State Transition Analysis: A Rule-Based Intrusion Detection Approach , 1995, IEEE Trans. Software Eng..

[85]  Pang-Ning Tan,et al.  Detection and Characterization of Anomalies in Multivariate Time Series , 2009, SDM.

[86]  S Karlin,et al.  Sequence anomalies in the Cag7 gene of the Helicobacter pylori pathogenicity island. , 1999, Proceedings of the National Academy of Sciences of the United States of America.

[87]  Bart De Moor,et al.  Subspace angles between ARMA models , 2002, Syst. Control. Lett..

[88]  Marcelo Espinoza,et al.  Clustering time series, subspace identification and cepstral distances , 2005, Commun. Inf. Syst..

[89]  Chang-Tien Lu,et al.  Spatial Weighted Outlier Detection , 2006, SDM.

[90]  Raymond T. Ng,et al.  Finding Intensional Knowledge of Distance-Based Outliers , 1999, VLDB.

[91]  Akira Maeda,et al.  Unsupervised Outlier Detection in Time Series Data , 2006, 22nd International Conference on Data Engineering Workshops (ICDEW'06).

[92]  Damminda Alahakoon,et al.  Minority report in fraud detection: classification of skewed data , 2004, SKDD.

[93]  Michael Greenacre,et al.  Visualization of Categorical Data , 1998 .

[94]  G. Golub,et al.  The canonical correlations of matrix pairs and their numerical computation , 1992 .

[95]  Sanjay Ranka,et al.  Conditional Anomaly Detection , 2007, IEEE Transactions on Knowledge and Data Engineering.

[96]  Philip K. Chan,et al.  Trajectory boundary modeling of time series for anomaly detection , 2005 .

[97]  Qingtao Wu,et al.  Network Anomaly Detection Using Time Series Analysis , 2005, Joint International Conference on Autonomic and Autonomous Systems and International Conference on Networking and Services - (icas-isns'05).

[98]  Karl Pearson,et al.  ON THE GENERAL THEORY OF MULTIPLE CONTINGENCY WITH SPECIAL REFERENCE TO PARTIAL CONTINGENCY , 1916 .

[99]  Bianca Zadrozny,et al.  Outlier detection by active learning , 2006, KDD '06.

[100]  Guojun Lu,et al.  Review of shape representation and description techniques , 2004, Pattern Recognit..

[101]  Arindam Banerjee,et al.  Anomaly Detection in Transportation Corridors using Manifold Embedding , 2007 .

[102]  Eamonn J. Keogh,et al.  Exact indexing of dynamic time warping , 2002, Knowledge and Information Systems.

[103]  Alan Agresti,et al.  Categorical Data Analysis , 1991, International Encyclopedia of Statistical Science.

[104]  Eleazar Eskin,et al.  The Spectrum Kernel: A String Kernel for SVM Protein Classification , 2001, Pacific Symposium on Biocomputing.

[105]  R. Tsay,et al.  Outliers in multivariate time series , 2000 .

[106]  Dan Gusfield,et al.  Algorithms on Strings, Trees, and Sequences - Computer Science and Computational Biology , 1997 .

[107]  K. Pearson.  On the Theory of Contingency and Its Relation to Association and Normal Correlation , 2013 .

[108]  M.A. Masnadi-Shirazi,et al.  Arima model for network traffic prediction and anomaly detection , 2008, 2008 International Symposium on Information Technology.

[109]  D. Snyder,et al.  On-Line Intrusion Detection Using Sequences of System Calls , 2001 .

[110]  Raman K. Mehra,et al.  Detection and classification of intrusions and faults using sequences of system calls , 2001, SGMD.

[111]  Philip Chan,et al.  Learning States and Rules for Time Series Anomaly Detection , 2004, FLAIRS.

[112]  Zengyou He,et al.  An Optimization Model for Outlier Detection in Categorical Data , 2005, ICIC.

[113]  Duncan Temple Lang,et al.  GGobi: evolving from XGobi into an extensible framework for interactive data visualization , 2003, Comput. Stat. Data Anal..

[114]  Sanjay Chawla,et al.  Mining for Outliers in Sequential Databases , 2006, SDM.

[115]  Sudipto Guha,et al.  ROCK: a robust clustering algorithm for categorical attributes , 1999, Proceedings 15th International Conference on Data Engineering (Cat. No.99CB36337).

[116]  P. Sajda,et al.  Detection, synthesis and compression in mammographic image analysis with a hierarchical image probability model , 2001, Proceedings IEEE Workshop on Mathematical Methods in Biomedical Image Analysis (MMBIA 2001).

[117]  Sameer Singh,et al.  Novelty detection: a review - part 2: : neural network based approaches , 2003, Signal Process..

[118]  T. J. Watson,et al.  Ordering Categorical Data to Improve VisualizationSheng , 1999 .

[119]  Georges G. Grinstein,et al.  A survey of visualizations for high-dimensional data mining , 2001 .

[120]  Ashok N. Srivastava,et al.  Nonlinear gated experts for time series: discovering regimes and avoiding overfitting , 1995, Int. J. Neural Syst..

[121]  Eamonn J. Keogh,et al.  Finding Time Series Discords Based on Haar Transform , 2006, ADMA.

[122]  VARUN CHANDOLA,et al.  Anomaly detection: A survey , 2009, CSUR.

[123]  Vic Barnett,et al.  Outliers in Statistical Data , 1980 .

[124]  Ling Huang,et al.  In-Network PCA and Anomaly Detection , 2006, NIPS.

[125]  D. Endler,et al.  Intrusion detection. Applying machine learning to Solaris audit data , 1998, Proceedings 14th Annual Computer Security Applications Conference (Cat. No.98EX217).

[126]  Takehisa Yairi,et al.  An approach to spacecraft anomaly detection problem using kernel feature space , 2005, KDD '05.

[127]  B. Abraham,et al.  Outlier detection and time series modeling , 1989 .

[128]  Diane J. Cook,et al.  Graph-based anomaly detection , 2003, KDD '03.

[129]  Jian Pei,et al.  WAT: Finding Top-K Discords in Time Series Database , 2007, SDM.

[130]  Christoph C. Michael,et al.  Two state-based approaches to program-based anomaly detection , 2000, Proceedings 16th Annual Computer Security Applications Conference (ACSAC'00).

[131]  Dipankar Dasgupta,et al.  A comparison of negative and positive selection algorithms in novel pattern detection , 2000, Smc 2000 conference proceedings. 2000 ieee international conference on systems, man and cybernetics. 'cybernetics evolving to systems, humans, organizations, and their complex interactions' (cat. no.0.

[132]  Zengyou He,et al.  A Fast Greedy Algorithm for Outlier Mining , 2005, PAKDD.

[133]  Ricardo Vilalta,et al.  Predicting rare events in temporal domains , 2002, 2002 IEEE International Conference on Data Mining, 2002. Proceedings..

[134]  Joshua Zhexue Huang,et al.  Extensions to the k-Means Algorithm for Clustering Large Data Sets with Categorical Values , 1998, Data Mining and Knowledge Discovery.

[135]  Pavlos Protopapas,et al.  Finding anomalous periodic time series , 2009, Machine Learning.

[136]  Philip K. Chan,et al.  Modeling multiple time series for anomaly detection , 2005, Fifth IEEE International Conference on Data Mining (ICDM'05).

[137]  Salvatore J. Stolfo,et al.  Modeling system calls for intrusion detection with dynamic window sizes , 2001, Proceedings DARPA Information Survivability Conference and Exposition II. DISCEX'01.

[138]  Eamonn J. Keogh,et al.  HOT SAX: efficiently finding the most unusual time series subsequence , 2005, Fifth IEEE International Conference on Data Mining (ICDM'05).

[139]  Jiong Yang,et al.  CLUSEQ: efficient and effective sequence clustering , 2003, Proceedings 19th International Conference on Data Engineering (Cat. No.03CH37405).

[140]  Chang-Tien Lu,et al.  Algorithms for spatial outlier detection , 2003, Third IEEE International Conference on Data Mining.

[141]  M.M. Deris,et al.  A Comparative Study for Outlier Detection Techniques in Data Mining , 2006, 2006 IEEE Conference on Cybernetics and Intelligent Systems.

[142]  Mohammed J. Zaki,et al.  CLICKS: Mining Subspace Clusters in Categorical Data via K-Partite Maximal Cliques , 2005, 21st International Conference on Data Engineering (ICDE'05).

[143]  Matthew O. Ward,et al.  Mapping Nominal Values to Numbers for Effective Visualization , 2003, IEEE Symposium on Information Visualization 2003 (IEEE Cat. No.03TH8714).

[144]  Ashok N. Srivastava,et al.  Anomaly Detection and Diagnosis Algorithms for Discrete Symbol Sequences with Applications to Airline Safety , 2009, IEEE Transactions on Systems, Man, and Cybernetics, Part C (Applications and Reviews).

[145]  Donald J. Berndt,et al.  Using Dynamic Time Warping to Find Patterns in Time Series , 1994, KDD Workshop.

[146]  Prabhakar Raghavan,et al.  A Linear Method for Deviation Detection in Large Databases , 1996, KDD.

[147]  Julie A. Dickerson,et al.  Orca: A Visualization Toolkit for High-Dimensional Data , 2000 .

[148]  M. Shyu,et al.  A Novel Anomaly Detection Scheme Based on Principal Component Classifier , 2003 .

[149]  D.J. Leith,et al.  Adaptive Kalman Filtering for anomaly detection in software appliances , 2008, IEEE INFOCOM Workshops 2008.

[150]  Philip K. Chan,et al.  Learning Patterns from Unix Process Execution Traces for Intrusion Detection , 1997 .

[151]  Heike Hofmann,et al.  Extending the GGobi pipeline from R , 2009, Comput. Stat..

[152]  Marc Dacier,et al.  Fixed- vs. Variable-Length Patterns for Detecting Suspicious Process Behavior , 1998, J. Comput. Secur..

[153]  R. Blender,et al.  Identification of cyclone‐track regimes in the North Atlantic , 1997 .

[154]  C. Jordan.  Essai sur la géométrie à $n$ dimensions , 1875 .

[155]  Bo Gao,et al.  HMMs (Hidden Markov models) based on anomaly intrusion detection method , 2002, Proceedings. International Conference on Machine Learning and Cybernetics.

[156]  Philip Chan,et al.  Learning States and Rules for Detecting Anomalies in Time Series , 2005, Applied Intelligence.

[157]  Nitin Kumar,et al.  Time-series Bitmaps: a Practical Visualization Tool for Working with Large Time Series Databases , 2005, SDM.

[158]  Manabu Kano,et al.  A new multivariate statistical process monitoring method using principal component analysis , 2001 .

[159]  Zengyou He,et al.  Discovering cluster-based local outliers , 2003, Pattern Recognit. Lett..

[160]  M. Otto,et al.  Outliers in Time Series , 1972 .

[161]  Li Wei,et al.  Experiencing SAX: a novel symbolic representation of time series , 2007, Data Mining and Knowledge Discovery.

[162]  Eamonn J. Keogh,et al.  Towards parameter-free data mining , 2004, KDD.

[163]  Srinivasan Parthasarathy,et al.  Fast Distributed Outlier Detection in Mixed-Attribute Data Sets , 2006, Data Mining and Knowledge Discovery.

[164]  Dana Ron,et al.  The power of amnesia: Learning probabilistic automata with variable memory length , 1996, Machine Learning.

[165]  Michèle Basseville,et al.  Subspace-based fault detection algorithms for vibration monitoring , 2000, Autom..

[166]  Jimeng Sun,et al.  Neighborhood formation and anomaly detection in bipartite graphs , 2005, Fifth IEEE International Conference on Data Mining (ICDM'05).

[167]  Jon M. Kleinberg,et al.  Clustering categorical data: an approach based on dynamical systems , 2000, The VLDB Journal.

[168]  Reda Alhajj,et al.  A comprehensive survey of numeric and symbolic outlier mining techniques , 2006, Intell. Data Anal..

[169]  Volker Roth,et al.  Outlier Detection with One-class Kernel Fisher Discriminants , 2004, NIPS.

[170]  Dmitry Pavlov,et al.  Sequence modeling with mixtures of conditional maximum entropy distributions , 2003, Third IEEE International Conference on Data Mining.

[171]  Dit-Yan Yeung,et al.  Parzen-window network intrusion detectors , 2002, Object recognition supported by user interaction for service robots.

[172]  Sunita Sarawagi,et al.  Mining Surprising Patterns Using Temporal Description Length , 1998, VLDB.

[173]  Eamonn J. Keogh,et al.  UCR Time Series Data Mining Archive , 1983 .

[174]  Salvatore J. Stolfo,et al.  A Geometric Framework for Unsupervised Anomaly Detection , 2002, Applications of Data Mining in Computer Security.

[175]  G. Stewart,et al.  Matrix Perturbation Theory , 1990 .

[176]  Heike Hofmann,et al.  The plumbing of interactive graphics , 2009, Comput. Stat..

[177]  Mikhail J. Atallah,et al.  Reliable detection of episodes in event sequences , 2004, Knowledge and Information Systems.

[178]  Francesco Battaglia,et al.  Outliers Detection in Multivariate Time Series by Independent Component Analysis , 2007, Neural Computation.

[179]  Vipin Kumar,et al.  Parallel and Distributed Computing for Cybersecurity , 2005, IEEE Distributed Syst. Online.

[180]  Robert P. W. Duin,et al.  Support Vector Data Description , 2004, Machine Learning.

[181]  Michael Friendly,et al.  Visualizing Categorical Data , 2009, Encyclopedia of Database Systems.

[182]  Usama M. Fayyad,et al.  Multi-Interval Discretization of Continuous-Valued Attributes for Classification Learning , 1993, IJCAI.

[183]  T. Lane,et al.  Sequence Matching and Learning in Anomaly Detection for Computer Security , 1997 .

引用
Behavior Analysis for Electronic Commerce Trading Systems: A Survey
IEEE Access
2019
A Formal Approach to Anomaly Detection
ICPRAM
2016
Online mining for association rules and collective anomalies in data streams
2017 IEEE International Conference on Big Data (Big Data)
2017
Time series anomaly detection based on shapelet learning
Comput. Stat.
2018
Computational approaches to the visual validation of 3D virtual environments
2011
Context-Aware Anomaly Detection in Embedded Systems
DepCoS-RELCOMEX
2017
Towards Intelligent Intrusion Detection Systems for Cloud Computing
2018
A survey of research on anomaly detection for time series
2016 13th International Computer Conference on Wavelet Active Media Technology and Information Processing (ICCWAMTIP)
2016
SHARD: A Framework for Sequential, Hierarchical Anomaly Ranking and Detection
PAKDD
2012
Detectors generation using genetic algorithm for a negative selection inspired anomaly network intrusion detection system
2012 Federated Conference on Computer Science and Information Systems (FedCSIS)
2012
Identification of Instantaneous Anomalies in General Aviation Operations Using Energy Metrics
2020
A STUDY OF TIME SERIES NOISE REDUCTION TECHNIQUES IN THE CONTEXT OF LAND COVER CHANGE DETECTION
CIDU 2011
2011
Autonomously Determining the Parameters for SVDD with RBF Kernel from a One-Class Training Set
2013
INTERACTIVE ANOMALY DETECTION IN TIME SERIES RESULTING FROM LOCAL TRAFFIC MEASUREMENTS
2011
Multi-class novelty detection in diagnostic trouble codes from repair shops
2017 IEEE 15th International Conference on Industrial Informatics (INDIN)
2017
One-Class Conditional Random Fields for Sequential Anomaly Detection
IJCAI
2013
MagLand: Magnetic Landmarks for Road Vehicle Localization
IEEE Transactions on Vehicular Technology
2020
A reference based analysis framework for analyzing system call traces
CSIIRW '10
2010
Anode: Empirical detection of performance problems in storage systems using time-series analysis of periodic measurements
2014 30th Symposium on Mass Storage Systems and Technologies (MSST)
2014
UbCadet: detection of compromised accounts in twitter based on user behavioural profiling
Multimedia Tools and Applications
2020