We will now discuss network anomalies (which are our prime concern) and their detection methods. By definition, an anomaly is something outside of the norm, an unexpected pattern in data. The term anomaly is used widely in data mining, and is sometimes called an outlier. Anomaly detection techniques are often used for fraud detection and to find malicious activities. In networking, anomalies can occur for many reasons, but what is important to us, in this case, is malicious activity detection. Generally, we see three types of anomalies:
- Point anomalies: Anomalous individual data instances, compared to the rest of the data.
- Contextual anomalies: Anomalous behaviors that occur only during specific contexts (periods of time, regions, and so on).
- Collective anomalies: A collection of anomalous activities, compared to the rest of the data...