Anomaly Detection via Online Oversampling Principal Component Analysis

Abstract

Anomaly detection has been an important research topic in data mining and machine learning. Many real-world applications such as intrusion or credit card fraud detection require an effective and efficient framework to identify deviated data instances. However, most anomaly detection methods are typically implemented in batch mode, and thus cannot be easily extended to large-scale problems without sacrificing computation and memory requirements. In this paper, we propose an online oversampling principal component analysis (osPCA) algorithm to address this problem, and we aim at detecting the presence of outliers from a large amount of data via an online updating technique. Unlike prior principal component analysis (PCA)-based approaches, we do not store the entire data matrix or covariance matrix, and thus our approach is especially of interest in online or large-scale problems. By oversampling the target instance and extracting the principal direction of the data, the proposed osPCA allows us to determine the anomaly of the target instance according to the variation of the resulting dominant eigenvector. Since our osPCA need not perform eigen analysis explicitly, the proposed framework is favored for online applications which have computation or memory limitations. Compared with the well-known power method for PCA and other popular anomaly detection algorithms, our experimental results verify the feasibility of our proposed method in terms of both accuracy and efficiency.

A Novel RNN-GBRBM Based Feature Decoder for Anomaly Detection Technology in Industrial Control Network

“…Typically, these existing approaches can be divided into three categories: distribution (statistical), distance and density-based methods [24]. It is worth noting that the above Fig.…”

“…While some online or incremental-based anomaly detection methods have been recently proposed, it turns out that their computational cost or memory requirements might not always satisfy online detection scenarios [25], [26]. Reference [24] proposed an online anomaly detection technique, named oversampling Principal Component Analysis (osPCA) in order to solve the above problems. Most importantly, it is a good algorithm to process binary vectors like decoded feature vectors since there is no other efficient algorithm for classifying or clustering bit arrays data.…”

“…As shown in Fig. 4, the proposed osPCA scheme will duplicate the target instance multiple times, and the idea is to amplify the effect of outlier rather than that of normal data so as to detect the outlier [24].…”

A Mixture Model of Hubness and PCA for Detection of Projected Outliers

“…PCA has already been rediscovered by so many researchers in so many fields and is basically known as a method of empirical orthogonal functions, and singular value decomposition and determines the principal directions of the data distributions. To obtain these Principal directions, one needs to construct the data covariance matrix and calculate its dominant eigenvectors [23]. Among the vectors in the original data space, these eigenvectors are the most informative so are considered as the principal directions.…”

Comparative Evaluation of Algorithm based Approach for Intrusion Detection using a Hybrid Model

“…As the already existing signature based tools like SNORT [2], [3] are mature enough and have scope to be integrated easily with an ADS, this review focuses on analyzing a couple of algorithms relating to the anomalous episode detection based on two fundamentally different principles. Online Oversampling Principal Component Analysis (osPCA) [4] uses Principal Component Analysis (PCA) which is well known dimension reduction method, whereas the other relies on Changepoint Detection using Shiryaev-Roberts technique [5]. After detection of anomalous episodes, signatures need to be generated, which can be stored in the attack signature database for further use.…”