A Novel Anomaly Detection Scheme Based on Principal Component Classifier

This paper proposes a novel scheme that uses robust principal component classifier in intrusion detection problems where the training data may be unsupervised. Assuming that anomalies can be treated as outliers, an intrusion predictive model is constructed from the major and minor principal components of the normal instances. A measure of the difference of an anomaly from the normal instance is the distance in the principal component space. The distance based on the major components that account for 50% of the total variation and the minor components whose eigenvalues less than 0.20 is shown to work well. The experiments with KDD Cup 1999 data demonstrate that the proposed method achieves 98.94% in recall and 97.89% in precision with the false alarm rate 0.92% and outperforms the nearest neighbor method, density-based local outliers (LOF) approach, and the outlier detection algorithm based on Canberra metric. Prepared in collaporation with School of Computer Science, Florida International University, Miami, FL. Presented at Foundations and New Directions in Data Mining Workshop, IEEE International Conference on Data Mining (3rd), ICDM'03, held in Melbourne, FL on 19-22 Dec 2003 and published in proceedings of the same. The original document contains color images.