Abstract:In data mining, and statistics, anomaly detection is the process of finding data patterns (outcomes, values, or observations) that deviate from the rest of the other observations or outcomes. Anomaly detection is heavily used in solving real-world problems in many application domains, like medicine, finance , cybersecurity, banking, networking, transportation, and military surveillance for enemy activities, but not limited to only these fields. In this paper, we present an empirical study on unsupervised anomaly detection techniques such as Density-Based Spatial Clustering of Applications with Noise (DBSCAN), (DBSCAN++) (with uniform initialization, k-center initialization, uniform with approximate neighbor initialization, and $k$-center with approximate neighbor initialization), and $k$-means$--$ algorithms on six benchmark imbalanced data sets. Findings from our in-depth empirical study show that k-means-- is more robust than DBSCAN, and DBSCAN++, in terms of the different evaluation measures (F1-score, False alarm rate, Adjusted rand index, and Jaccard coefficient), and running time. We also observe that DBSCAN performs very well on data sets with fewer number of data points. Moreover, the results indicate that the choice of clustering algorithm can significantly impact the performance of anomaly detection and that the performance of different algorithms varies depending on the characteristics of the data. Overall, this study provides insights into the strengths and limitations of different clustering algorithms for anomaly detection and can help guide the selection of appropriate algorithms for specific applications.

A Hybrid Clustering Algorithm Based on ART2 and Its Application in Anomaly Detection

An Enhanced ART2 Neural Network for Clustering Analysis

Hybrid Weighted K-Means Clustering and Artificial Neural Network for an Anomaly-Based Network Intrusion Detection System

Anomaly Detection Using Improved Hierarchy Clustering

Intrusion detection based on ART and artificial immune network clustering

An Efficient Parallel Anomaly Detection Algorithm Based on Hierarchical Clustering.

Intrusion Detection Based on Adaptive Polyclonal Clustering

An Adaptive Anomaly Detection Based on Hierarchical Clustering

A new ART neural networks for remote sensing image classification

Hybrid Intrusion Detection Method Based on CM-K-Means

An Efficient And Applicable Clustering Algorithm Using Fuzzy Art

A Modified Hybrid Method Based on PSO, GA, and K-Means for Network Anomaly Detection

Anomaly Detection Algorithm Based on Improved Density Clustering

A Hybrid Approach Of Http Anomaly Detection

KMDT: A Hybrid Cluster Approach for Anomaly Detection Using Big Data

A Novel Anomaly Detection Approach Based On Clustering And Decision-Level Fusion

An improved ART 2-A model for mixed numeric and categorical data

A Novel Method Based on Clustering Algorithm and SVM for Anomaly Intrusion Detection of Wireless Sensor Networks

A multiple-level hybrid intrusion detection system based on hierarchical clustering and decision trees

An Empirical Study on Anomaly Detection Using Density-based and Representative-based Clustering Algorithms

An Improved Kernel Clustering Algorithm Used in Computer Network Intrusion Detection.