Chapter

Foundations and Novel Approaches in Data Mining

Volume 9 of the series Studies in Computational Intelligence pp 311-329

Date:

Principal Component-based Anomaly Detection Scheme

  • Mei-Ling ShyuAffiliated withDepartment of Electrical and Computer Engineering, University of Miami
  • , Shu-Ching ChenAffiliated withSchool of Computer Science, Florida International University
  • , Kanoksri SarinnapakornAffiliated withDepartment of Electrical and Computer Engineering, University of Miami
  • , LiWu ChangAffiliated withCenter for High Assurance Computer Systems, Naval Research Laboratory

* Final gross prices may vary according to local VAT.

Get Access

Abstract

In this chapter, a novel anomaly detection scheme that uses a robust principal component classifier (PCC) to handle computer network security problems is proposed. An intrusion predictive model is constructed from the major and minor principal components of the normal instances, where the difference of an anomaly from the normal instance is the distance in the principal component space. The screening of outliers prior to the principal component analysis adds the resistance property to the classifier which makes the method applicable to both the supervised and unsupervised training data. Several experiments using the KDD Cup 1999 data were conducted and the experimental results demonstrated that our proposed PCC method is superior to the k-nearest neighbor (KNN) method, density-based local outliers (LOF) approach, and the outlier detection algorithm based on the Canberra metric.