anomalybased

Anomaly-based detection refers to methods that identify data points or events that deviate from established normal behavior. In information security, anomaly-based intrusion detection systems monitor network traffic, user activity, or system calls to flag unusual patterns that may indicate a breach. Unlike signature-based approaches, which rely on known attack patterns, anomaly-based techniques aim to detect previously unseen threats by recognizing deviations from a model of normal operation.

Typical approaches build a model from historical data representing normal behavior. Modelling techniques include statistical methods, clustering, and machine learning such as one-class classifiers, neural networks, and isolation forests. Data sources include network flows, host logs, process metrics, and application events. Detection may be online or offline and can be supervised, semi-supervised, or unsupervised depending on label availability.

Advantages include detecting novel attacks and unusual activity that signature-based systems may miss. Limitations include higher false positive rates, sensitivity to changes in normal behavior, data quality requirements, and model maintenance. Interpretation of alerts can be challenging, and performance overhead may be nontrivial in high-volume environments.

Applications extend beyond security to fraud detection, health monitoring, and industrial process control. Evaluation uses metrics such as true positive rate, false positive rate, precision, recall, and ROC AUC. Common algorithms include one-class SVM, Local Outlier Factor, Isolation Forest, and Gaussian mixture models. Datasets such as NSL-KDD and UNSW-NB15 are used for benchmarking.