A Dynamic Normal Profiling for Anomaly Detection

Machine learning-based anomaly detection approaches have attracted increasing attention in the intrusion detection community because of their intrinsic capabilities in discovering novel attacks. This paper introduces a dynamic normal profiling for anomaly detection system. It focuses on three specific contributions: (i) It continuously updates the normal profile by keeping the dynamic window size. (ii) The dynamic window adjustment through a concept drift learning algorithm which helps to keep relevant patterns and get rid of the outdated patterns. (iii) The dynamical normal profiling approach makes it a possible way for real-time anomaly detection. Experimental results show that our anomaly detection schemes are successful in automatically detecting the anomaly.