Methods of unsupervised anomaly detection using a geometric framework

摘要

A method for unsupervised anomaly detection, which are algorithms that are designed to process unlabeled data. Data elements are mapped to a feature space which is typically a vector space d. Anomalies are detected by determining which points lies in sparse regions of the feature space. Two feature maps are used for mapping data elements to a feature apace. A first map is a data-dependent normalization feature map which we apply to network connections. A second feature map is a spectrum kernel which we apply to system call traces.

主权项

1. A method for unsupervised detection of an anomaly in the operation of a computer system comprising:
(b) mapping a set of unlabeled data instances, which do not indicate any anomaly occurrence, to a feature space; (c) calculating one or more sparse regions in the feature space; and (d) designating one or more data instances from the set of unlabeled data instances as an anomaly if said one or more data instances is located in said one or more sparse regions of the feature space.