EADetection: An efficient and accurate sequential behavior anomaly detection approach over data streams

Abstract

Due to the increasing arriving rate and complex relationship of behavior data streams, how to detect sequential behavior anomaly in an efficient and accurate manner has become an emerging challenge. However, most of the existing literature simply calculates the anomaly score for segmented sequence, and there is limited work going deep to investigate data stream segment and structural relationship. Moreover, existing studies cannot meet efficiency requirements because of large number of projected subsequences. In this article, we propose EADetection, an efficient and accurate sequential behavior anomaly detection approach over data streams. EADetection adopts time interval and fuzzy logic-based correlation to segment event stream adaptively based on rolling window. Through dynamic projection space-based fast pruning, large number of repeated patterns are reduced to improve detection efficiency. Meanwhile, EADetection calculates the anomaly score by top-k pattern-based abnormal scoring based on directed loop graph-based storage strategy, which ensures the accuracy of detection. Specially, we design and implement a streaming anomaly detection system based on EADetection to perform real-time detection. Extensive experiments confirm that EADetection can achieve real time and improve accuracy, significantly reduces latency by 36.8% and reduces false positive rate by 6.4% compared with existing approach.

Detecting a Business Anomaly Based on QoS Benchmarks of Resource-service Chains for Collaborative Tasks in the IoT

“…Anomaly detection is an important problem that has been researched within diverse research areas and application domains. Anomaly detection involves identifying items, events, or observations that do not conform to an expected pattern or a model of normal behavior [29]. The application fields of anomaly detection include network intrusion detection [30], financial fraud detection, medical sensor detection, and fault detection in industrial systems [31].…”