Temporal sequence learning and data reduction for anomaly detection

The anom~y detection problem can be formtiated as one of learning to characterize the behaviom of an individud, system, or network in terms of temporal sequences of dic rete data. We present an approach to this problem based on instance based learning (IBL) techniques. To cast the anom~y detection task in an IBL framework, we employ an approach that transforms temporal sequences of discrete, unordered observations into a metric space via a similarity measure that encodes intra-attribute dependence=. Classification boundaries are selected from an a posterior characterization of the v&d user's behaviors, coupled with a dm ain heuristic. An empirical evrduation of the approach on user command data demonstratees that we can accurately differentiate the profled user from alternative users when the avdable featura encode sticient information. Futherrnore, we demonstrate that the system detects anomalous conditions quickly -an important qufity for reducing potential damage by a mdcious user. We present several techniques for reducing the data storage requirements of the user profle, including instance selection methods and clustering. An empirical evahtation shows that a new greedy clustering dgonthm reduces the size of the user model by 70% with ordy a smd loss in accuracy. A comparison of the greedy clustering technique to clustering with K-centers shows that greedy clustering is preferable in terms of accuracy and computation time for this domain.