Online anomaly detection using KDE

Abstract

Large backbone networks are regularly affected by a range of anomalies. This paper presents an online anomaly detection algorithm based on Kernel Density Estimates. The proposed algorithm sequentially and adaptively learns the definition of normality in the given application, assumes no prior knowledge regarding the underlying distributions, and then detects anomalies subject to a user-set tolerance level for false alarms. Comparison with the existing methods of Geometric Entropy Minimization, Principal Component Analysis and One-Class Neighbor Machine demonstrates that the proposed method achieves superior performance with lower complexity.