Abstract:In data mining, and statistics, anomaly detection is the process of finding data patterns (outcomes, values, or observations) that deviate from the rest of the other observations or outcomes. Anomaly detection is heavily used in solving real-world problems in many application domains, like medicine, finance , cybersecurity, banking, networking, transportation, and military surveillance for enemy activities, but not limited to only these fields. In this paper, we present an empirical study on unsupervised anomaly detection techniques such as Density-Based Spatial Clustering of Applications with Noise (DBSCAN), (DBSCAN++) (with uniform initialization, k-center initialization, uniform with approximate neighbor initialization, and $k$-center with approximate neighbor initialization), and $k$-means$--$ algorithms on six benchmark imbalanced data sets. Findings from our in-depth empirical study show that k-means-- is more robust than DBSCAN, and DBSCAN++, in terms of the different evaluation measures (F1-score, False alarm rate, Adjusted rand index, and Jaccard coefficient), and running time. We also observe that DBSCAN performs very well on data sets with fewer number of data points. Moreover, the results indicate that the choice of clustering algorithm can significantly impact the performance of anomaly detection and that the performance of different algorithms varies depending on the characteristics of the data. Overall, this study provides insights into the strengths and limitations of different clustering algorithms for anomaly detection and can help guide the selection of appropriate algorithms for specific applications.

An Adaptive Anomaly Detection Based on Hierarchical Clustering

Anomaly Detection Using Improved Hierarchy Clustering

An Efficient Parallel Anomaly Detection Algorithm Based on Hierarchical Clustering.

Anomaly Detection Algorithm Based on Improved Density Clustering

Using Density-Based Incremental Clustering for Anomaly Detection

ADIC: an anomaly detection algorithm using incremental clustering

An Improved Agglomerative Hierarchical Clustering Anomaly Detection Method for Scientific Data

A Time-Stamp Frequent Pattern-Based Clustering Method For Anomaly Detection

Unsupervised Anomaly Detection Based on Partition and Agglomerative Hierarchical Clustering

Intrusion Detection Based on Adaptive Polyclonal Clustering

A multiple-level hybrid intrusion detection system based on hierarchical clustering and decision trees

An Unsupervised Anomaly Detection Approach Using Subtractive Clustering And Hidden Markov Model

Network Anomaly Detection Based on Semi-supervised Clustering

A time stamped clustering method for intrusion detection

An Empirical Study on Anomaly Detection Using Density-based and Representative-based Clustering Algorithms

Dynamic Local Aggregation Network with Adaptive Clusterer for Anomaly Detection

An Adaptive Clustering Algorithm for Intrusion Detection

Cost-effective Hierarchical Clustering with Local Density Peak Detection

An Adaptive Profile-Based Approach for Detecting Anomalous Traffic in Backbone.

A Modified Hybrid Method Based on PSO, GA, and K-Means for Network Anomaly Detection

Hierarchical Context Representation and Self-adaptive Thresholding for Multivariate Anomaly Detection