Superimposed Rule-Based Classification Algorithm (SRBCA) for One-Class Multivariate Conditional Anomaly Detection

Abstract

Traditional anomaly detection causes a problem of detecting too numerous false positives in many problem domains. In this work, a Superimpose Rule-Based Classification algorithm (SRBCA) is proposed for conditional anomaly detection. The algorithm is an enhancement of the traditional OneR algorithm. The traditional OneR can generate a set of rules from its attributes with multiple classes, compute the error rate and apply the rule to the attribute with the smallest error. However, OneR has a disadvantage for one-class datasets which contains values belonging to the normal class. The enhanced algorithm, SRBCA, does not embody very complex rules similar to its predecessor. Furthermore, SRBCA includes the generation and application of rules from the one-class dataset in an n-dimensional space using classification. Holdout method was used to evaluate the performance of the classifiers' accuracy which involved training multiple subsets' behavioral and indicator attributes, superimposing rules and testing by using balanced and unbalanced class data to detect and label conditional anomaly data points. This paper shows the comparison between SRBCA, One-Class Support Vector Machine (OCSVM) and other anomaly detection classification algorithms for conditional anomaly detection. It proves that the new method can handle one-class multivariate for conditional anomaly detection with better accuracy.