Online outlier detection over data streams

Outlier detection is an important data mining task. Recently, online discovering outlier under data stream model has attracted attention for many emerging applications, such as network intrusion detection. Because the algorithms on data streams are restricted to fulfil their works with only one pass over data sets and limited resources, it is a very challenging problem to detect outliers over streams. In this paper, we present an unsupervised outlier detection approach to online network intrusion detection over data streams. Our method continuously maintains online summary and obtains a set of clusters, and those small clusters far away from big clusters are regarded as outlier clusters. We also propose a novel definition of outlier degree to measure the outlying degree of each cluster. When a new data arrives, it is considered as an outlier if it lies in the top-k outlier clusters. Experiment results demonstrate the effectiveness of our method.