Detecting outliers and anomalies in data streams

Improving outliers detection in data streams using LiCS and voting
Fatima-Zahra Benjelloun a
, Ahmed Oussous a
, Amine Bennani b
, Samir Belfkih a
, Ayoub Ait Lahcen a,⇑
a
LGS, National School of Applied Sciences (ENSA), Ibn Tofail University, Kenitra, Morocco
b
Capgemini, 1100, bd el Qods, Sidi Maarouf, CasaNearshore, Shore 8. Imm A., 20270, Morocco
a r t i c l e i n f o
Article history:
Received 1 February 2019
Revised 2 July 2019
Accepted 2 August 2019
Available online xxxx
Keywords:
Data streams
Outlier detection
High-dimensional data
Big data mining
Intrusion detection
a b s t r a c t
Detecting outliers in real-time is increasingly important for many real-world applications such as detect-
ing abnormal heart activity, intrusions to systems, spams or abnormal credit card transactions. However,
detecting outliers in data streams rises many challenges such as high-dimensionality, dynamic data dis-
tribution and unpredictable relationships. Our simulations demonstrate that some advanced solutions
still show drawbacks. In this paper, first, we improve the capacity to detect outliers of both micro-
clusters based algorithms (MCOD) and distance-based algorithms (Abstract-C and Exact-Storm) known
for their performance. This is by adding a layer called LiCS that classifies online the K-nearest-
neighbors (Knn) of each node based on their evolutionary status. This layer aggregates the results and
uses a count threshold to better classify nodes. Experiments on SpamBase datasets confirmed that our
technique enhances the accuracy and the precision of such algorithm and helps to reduce the unclassified
nodes.Second, we propose a hybrid solution based on iterative majority voting and our LiCS. Experiments
on real data proves that it outperforms discussed algorithms in terms of accuracy, precision and sensitiv-
ity in detecting outliers. It also minimizes the issue of unclassified instances and consolidate the different
outputs of algorithms.
Ó 2019 The Authors. Production and hosting by Elsevier B.V. on behalf of King Saud University. This is an
open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).
1. Introduction
Nowadays, detecting outliers became increasingly important. In
fact, millions of distributed applications, interconnected devices
and smartphones are now equipped with sensors that generate
every second massive unstructured Big Data. Consequently, vari-
ous real-world applications need reliable alerting systems that
can read such huge streams and generate in real-time alarms for
detected anomalies.
For instance, in e-health, it is vital to detect abnormal heart
activity, in information systems security it is essential to detect
intrusions or spams (Dolgikh et al., 2014; Benjelloun et al., 2017;
Anusha and Sathiyamoorthy, 2016). In finance, it is important
to detect frauds and abnormal credit card transactions. In
e-government and public services, it is essential to monitor power
usage.
In general, outlier detection is the concept of searching for
instances in a dataset which are inconsistent with the remainder
of that dataset. In fact, outliers represent a deviation from the nor-
mal values or patterns (Aggarwal, 2015; Kontaki et al., 2011). Out-
liers may belong to three categories: the first one is when a data
point is different or lies far from a group of points. The second case
is when a data point or an object shows a known abnormal behav-
ior. The third case is when the behavior of a data point is not
aligned with the normal known behavior (Sadik and Gruenwald,
2014).
Unlike static data, mining Big Data rises many issues because of
the complex nature of Big Data and their characteristics 3Vs
(velocity, volume and variety) (Oussous et al., 2018). Additional
challenges are encountered when detecting anomalies in an
infinite sequence of data points or streams (Nguyen et al.,
2015Benjelloun et al., 2017). In fact, researchers have to resolve
two main issues: on one hand, the detection solution has to man-
age the complex nature of streams such as high multidimensional-
ity, dynamic data distribution, changing patterns, unpredictable
data relationships, uncertainty and transiency (Vijayarani and
Jothi, 2013; Sadik and Gruenwald, 2014). So, algorithms have to
deal with issues related to concept drift by detecting anomalies
https://doi.org/10.1016/j.jksuci.2019.08.003
1319-1578/Ó 2019 The Authors. Production and hosting by Elsevier B.V. on behalf of King Saud University.
This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).
⇑ Corresponding author.
E-mail addresses: amine.bennani@capgemini.com (A. Bennani), samir.belfkih@
univ-ibntofail.ac.ma (S. Belfkih), ayoub.aitlahcen@univ-ibntofail.ac.ma (A. Ait
Lahcen).
Peer review under responsibility of King Saud University.
Production and hosting by Elsevier
Journal of King Saud University – Computer and Information Sciences xxx (xxxx) xxx
Contents lists available at ScienceDirect
Journal of King Saud University –
Computer and Information Sciences
journal homepage: www.sciencedirect.com
Please cite this article as: F.-Z. Benjelloun, A. Oussous, A. Bennani et al., Improving outliers detection in data streams using LiCS and voting, Journal of King
Saud University –Computer and Information Sciences, https://doi.org/10.1016/j.jksuci.2019.08.003

at varying sliding windows (time-based or count-based windows)
(Nguyen et al., 2015).
On the other hand, most real applications need a real-time and
reliable response. For that, the solution should process infinite
sequences of evolving instances while optimizing the CPU, storage
and time consumption. So, algorithms should reduce the number
of passes over data for fast queries. But, when experts try to
increase the detection performance (the number of outliers or
anomalies detected), algorithms tend to consume more memory
and computing time. In addition, when they try to extract more
outliers, the rate of false alarms usually increases. Another issue
is that dimensionality increases time and memory consumption
and it may affect the detection performance.
Nevertheless, traditional methods used to explore static data
lack scalability and performance needed to process big data
streams (Xiang et al., 2014). In addition, recent solutions designed
for streams cannot detect all anomalies, still show unsatisfactory
precision, a considerable rate of false alarm and let many nodes
unclassified. This lack in efficiency may mislead data analysts
and doctors. In fact, undetectable outliers may lead to wrong diag-
nosis, health problems, substantial financial losses, security issues
and other damages. So, there is a need for more powerful efficient
solutions to detect outliers in real-time with high accuracy, high
precision and a reduced number of unclassified nodes.
In the following, we resume our main contributions:
Proposing our concept called Life Cycle Status (LiCS) that
improves the accuracy and sensitivity of advanced algorithms
in detecting outliers, namely MCOD, Abstract-C and Exact-
Storm.
Reducing the number of nodes that remain unclassified by inte-
grating LiCS that boosts algorithms in setting the final status of
nodes.
Providing a hybrid voting solution that outperforms the studied
algorithms in terms of accuracy, precision and sensitivity. It
reduces also the number of unclassified nodes.
This paper has been structured as follows: Section 2 compares
the main works in outlier detection. Then, it demonstrates the lim-
itations of advanced algorithms. Section 3 explains the proposed
approaches with proves then it presents examples of real-world
applications. Section 4 presents the experimental results and com-
pares the performance of both the upgraded algorithms and the
proposed solution with existing solutions. Finally, Section 5 con-
cludes the paper and presents directions for future research.
2. Related work
This section focuses on solutions that integrate distance-based
algorithms or cluster-based approaches as our contribution heads
in this same direction.
2.1. Outliers detection methods
According to the reviewed works such as (Sadik and Gruenwald,
2014), we notice that most of the time, outlier detection
approaches are classified into those categories:
(1) Statistical based method. (2) Distance based method
(Angiulli and Fassetti, 2007; Cao et al., 2014 and Kontaki et al.,
2011). (3) Density based method (Vasudevan and Selvakumar,
2016). (4) Classification based methods (Nguyen et al., 2015). (5)
Clustering based methods (Aggarwal, 2015). To handle multi-
dimensional streams, another category called Information theo-
retic models was proposed by Aggarwal (2015,). Other studies pre-
ferred to categorize the methods according to their environment
(e.g., concentric or distributed network) or according to the meth-
ods applied or the classifier used as in (Hamid et al., 2016 and
Karami and Guerrero-Zapata, 2015).
2.2. Hybrid approaches
Globally, researchers use either one single algorithm to detect
outliers, a hybrid model by applying two consecutive but different
methods to identify outliers or ensemble model that aggregates the
result of multiple prediction models (Nguyen et al., 2015; Zhang
et al., 2011). Many hybrid solutions were inspired by clustering
methods such as (Kontaki et al., 2011; Vijayarani and Jothi, 2013;
Karami and Guerrero-Zapata, 2015; Singh and Aggarwal, 2013;
Kapse et al., 2016; Shou et al., 2017; Fa et al., 2015). A bioinformat-
ics clustering was proposed by Wurzenberger et al. (2016).
To tackle the issue of high dimensional data and large-scale
problems, various works were achieved. For instance,
Shambharkar and Sahare (2016) demonstrated the performance
of SVM classifier (Support Vector Machine algorithm) in compar-
ison to the K-Nearest Neighbor (KNN). Afterwards, Markad et al.
(2017) proved that systems based on features’ selection, reverse
nearest neighbor and outlier score have high accuracy. Instead,
Doan (2017) showed that their proposed incremental ensemble
model is able to learn with incomplete training datasets. Shou
et al. (2017) proposed the Anomaly Detection Framework that han-
dles the lack of data quality in large environmental sensing
systems.
For intrusion detection systems (IDS), Rachidi et al. (2016) com-
bined data driven clustering with Bayesian classification for host
IDS. Other works used also classification and various methods for
attack detection such as Gogoi et al. (2013) and Gupta et al.
(2016). Others used also feature selection techniques such as
Mazini et al. (2018a) that proposed an anomaly network-based
IDS (A-NIDS) using Artificial Bee Colony (ABC) for feature selection
and AdaBoost algorithm for features classifications. Sonowal and
Kuppusamy (2017) proposed to detect phishing sites using multi-
layer model PhiDMA that combines URL feature and Cantina
approach.
2.3. Our evaluation of DODDS algorithms and their limitations
The first aim of this study is to evaluate the efficiency and to
highlight the downsides of some well-known advanced algorithms
namely MCOD, Abstract-C and Exact-Storm that belong to
‘distance-based outlier detection in data streams’ (DODDS) cate-
gory. Many works proved their performance (Tran et al., 2016;
Poonsirivong and Jittawiriyanukoon, 2017) especially in terms of
memory and time consumption but unfortunately they neglect to
evaluate their limitations.
Consequently, we fill this gap and demonstrate the downsides
of the mentioned algorithms. To show their limitations, we added
code in each of those algorithms to trace the identity of outliers
and we computed their accuracy, sensitivity, precision as well as
the confusion matrix (TP, TN, FP, FN) and the unclassified nodes.
As input for each algorithm, we used a simulated stream from
UCI repository (Dheeru and Karra Taniskidou, 2017). So, the
extracted data file named ‘‘SpamBase_02_v01” represents a sample
of emails that contains 2897 emails including 88 spams. It is down-
sampled to 02 pct. Originally, each email record contains 57 fea-
tures (called attributes or properties) in continuous real values
[0,100]. The Class distribution is (3,038%) for spam and (96,96%)
for legitimate emails. Through experimental results in Table 1,
we noticed the following disadvantages:
Insufficient precision and sensitivity: the detection accuracy
of the studies algorithms is around 80%. However, all three
2 F.-Z. Benjelloun et al. / Journal of King Saud University – Computer and Information Sciences xxx (xxxx) xxx

algorithms showed a limited precision up to 12,46% and unsat-
isfactory sensitivity that does not exceed 33,63%.
Considerable rate of false alarms: over a total of 2897 emails,
we found that at least 387 emails are declared as spams while
they are normal emails (so 13% of FP). In addition, there are
between 4 to 11 emails (0,28% to 0,38% of FN) that are actually
spams but the studied algorithms declared them as normal.
Unclassified instances: results in Table 1 prove that the studied
algorithms suffer from the incapacity to set a clear status for
many instances. In fact, the number of unclassified nodes is
166 (5,7%) for MCOD, 157 (5,4%) for Exact-Storm and 140
(4,8%) for Abstract-C. Unfortunately, this important downside
has not been mentioned by any previous study.
Absence of consensus between algorithms: from experimen-
tal results, we noticed that the studied algorithms output differ-
ent list of outliers. Unfortunately, previous studies neglect to
discuss this issue.
For instance, some patients will be diagnosed as sick by a doctor
that uses MCOD while those same patients will be diagnosed as
healthy by a doctor that uses Abstract-C or Exact-Storm.
3. Our approach
In this paper, we decided to study and improve the following
advanced algorithms MCOD, Abstract-C and Exact-Storm because
they are well known for their proved performance in detecting out-
liers and they are also used by some open source platforms such as
MOA (Bifet et al., 2010). In fact, MCOD has the highest performance
among DODSS algorithms and it outperforms the most recent algo-
rithm Thresh-LEAP (Cao et al., 2014). In addition, Abstract-C and
Exact-Storm are among the well-known advanced algorithms that
are efficient in detecting outliers as confirmed by Tran et al. (2016)
and Poonsirivong and Jittawiriyanukoon (2017).
However, as far as we know, no study has been carried to inves-
tigate in detail their confusion matrix, the precision and the recall
that present serious weaknesses, see Sections 2.3 and 4.3. So, we
worked to fill this gap and to enhance each of those algorithms
by minimizing their downsides. Consequently, we achieved two
contributions:
First, improving the accuracy and the recall of those existing
advanced algorithms (MCOD, Abstract-C and Exact-Storm) by inte-
grating our proposed concept called Life Cycle Status (LiCS) in their
internal mechanisms.
Second, designing a hybrid approach for detecting outliers that
outperform the advanced MCOD, Abstract-C and Exact-Storms in
terms of accuracy, precision and recall. See the experimental
results in Section 4.3.3 (on WBC for breast cancer detection) and
Section 4.3.4 (on SpamBase for spam detection).
To validate our approach and compare it with existing solu-
tions, we used the standard and well known evaluation measure-
ments for point outliers and anomaly detection (Aggarwal, 2013).
3.1. Improving existing algorithms based on Life Cycle Status concept
The algorithms MCOD, Abstract-C and Exact-Storms read online
a data stream (S) that sends continuous data records called nodej.
Each nodej has various attributes. A nodej is read and processed in
a subsequent order according to its arrival time. Generally, in order
to determine the status of a nodej, those algorithms perform a
range query in a radius R and compute the number of nearest
neighbors for each nodej in a stream S. Thus, in a defined window
Wi, a nodej is an outlier if it has less than K nearest neighbors (knn
is a threshold) within a distance of at most R. Otherwise nodej is
inlier.
But counting the neighbors of a nodej through its life cycle, is
not sufficient because of all the downsides discussed in Section 2.3.
To solve them, we noticed through our various experimentations
that instead of considering just the count Knn to classify a node
(as in the studied algorithms), we go a step forward and monitor
the status of those nearest neighbors through their life cycle. We
explain here our proposed technique called Life Cycle Status (LiCS).
In more detail, we compute the frequency a nodej has been
neighbor to outliers through different sliding windows (Wj to
Wi + t), from its arrival to its departure. So, if the nOutlier exceed
the nInlier (nOutlier nInlier) then nodej is classified as an out-
lier. Otherwise, it is an inlier. But if (nOutlier == nInlier) then
nodej is unclassified by original algorithms. According to our LiCS,
the algorithm should check if nodej has been neighbor for only
outliers or if nodej has been neighbor for more outliers (num-
NeigOut) than inliers (numNeigIn) with respect to a threshold
K_nno (it is a count threshold for the minimum number of neigh-
bors for a defined nodej that should be outliers in order to con-
sider nodej as outlier).
Indeed, the experimentations results in Section 4.3.1 and 4.3.3
on two real datasets prove that such information may reveal that
nodej falls in a range (or a micro-cluster) of anomalous nodes espe-
cially if nodej has more than K_nno that are outliers. The results
demonstrated that LiCS boosts the performance of the studied
advanced algorithms by improving their accuracy and sensitivity
(TPR) and by decreasing the number of unclassified nodes. More-
over, LiCS has light weight operations. So real-time results can still
be ensured as the original versions of algorithms. The following
pseudo code of Algorithm1 aims to improve existing DODDS algo-
rithms by integrating our proposed LiCS (see Fig. 1).
3.2. The proposed hybrid solution
To detect outliers in a defined stream, our hybrid approach
combines the results of advanced Micro-clustering based algo-
rithm (MCOD) and distance based algorithms (Abstract-C and
Exact-Strom) that belong to DODDS category. As previous studies
(Kontaki et al., 2011; Tran et al., 2016), we used the type count-
based window (W).
Input: The solution reads online a data stream (S) that sends
continous data records (called nodej). A nodej is processed by each
algorithm in a subsequent order according to its arrival time.
Parameters: The user should tune those parameters K, R, W
(Bifet et al., 2010) to control the neighborhood density of each
nodej.
Output: the hybrid solution sets online the final status of nodes
in a stream according to the majority vote of three DODDS
algorithms.
The solution is based on a multi-level strategy that are defined
as follows:
Table 1
Our evaluation of the original version of studied algorithms.
Algorithms Acc P R F TP TN FP FN Unclassified
MCOD 80,36% 9,42% 24,68% 13,63% 58.0 2270.0 392.0 11.0 166.0
Storm 80,95% 12,04% 31,78% 17,46% 75.0 2270.0 391.0 4.0 157.0
AbstractC 81,53% 12,46% 33,63% 18,18% 75.0 2287.0 387.0 8.0 140.0
F.-Z. Benjelloun et al. / Journal of King Saud University – Computer and Information Sciences xxx (xxxx) xxx 3

1. Preprocessing: The preprocessing ensures data quality. It helps
also to improve detection accuracy and reduce time and mem-
ory consumption. To prepare datasets, we used filters provided
by WEKA platform (WEKA, 2011). See Section 4.2 for details
about the used techniques.
2. Outlier Detection: the outliers are detected by executing in
parallel the selected algorithms (MCOD, Exact-Storm and
Abstract-C). Thus, each of them launches its range query pro-
cess through various sliding windows. This phase defines the
status of each coming nodej from a stream S. In this step, we
used our new enhanced versions of each of those algorithms
based on our (LiCS) principle to benefit from its performance
advantages.
3. Dynamic voting: Majority vote is applied in a dynamic way. In
fact, the vote is executed in parallel to the outlier detection
phase. In more detail, during the detection phase, each nodej
read from a stream nodej 2 S is processed simultaneously by
each of the three upgraded versions of MCOD, Abstract-C,
Exact-Storm. So, each of them output the final status of nodej
as either inlier, outlier or unclassified. Finally, the vote is
instantly executed.
4. Iteration on cleaner data: For better results, the user can
choose to add voting iterations according to the type of its data
streams. Technically, after the first vote in a predefined number
of count-window, the solution removes the detected outliers,
save the inliers and unclassified nodes in a simulated stream file
(SF) and use the hybrid voting another time on cleaner data
using this file (SF). Sometimes one iteration is sufficient, some
data need more iterations to remove a bigger number of hidden
outliers. Additional iterations takes more time for more accu-
racy. It is worth mentioning that the majority vote has light
operations that do not add a burden in term of memory or time
consumption. This can be guaranteed by opting for a parallel
programing to execute algorithms in parallel.
4. Experimental results and analysis
4.1. Evaluation environment and criteria
All experiments were carried out on a workstation with Intel(R)
Core(TM) i5, CPU 2.53 GHz and 4 GB of RAM. The new approach
was developed in JAVA and Eclipse Jee Photon. For simulation pur-
poses, we used the MOA platform that we modified to include the
upgrades and required changes. For experiment purposes, we used
the two different types of datasets from the UCI Machine Learning
repository (Dheeru and Taniskidou, 2017). In fact, we extracted one
spam detection case including 2897 emails as explained in Sec-
tion 2.3. We tested also our model on Wisconsin Breast Cancer
Database. We tested our upgraded version of algorithms as well
as the new hybrid detection method under various stream settings
and different outlier rates.
Fig. 1. Processing in real-time nodes and their neighbors based on LiCS concept for a data stream.

4.2. Data preprocessing
Generally, a data stream S includes a number of nodej. Each
nodej has a set of features called also attributes. For instance in
WBC datasets (Dheeru and Taniskidou, 2017), part of the attributes
are clump thickness, uniformity of cell size, bland Chromatin,
mitoses. Their numerical values are in (Dolgikh et al., 2014 and
Xiang et al., 2014).
In the preprocessing step, first, we converted the data imported
from SpamBase and WBC into an ARFF format. Then, many filters
are applied on the original datasets using WEKA application, ver-
sion 3.8 (WEKA, 2011). First, the unsupervised technique called
Normalization is applied on the given dataset (Patro and Sahu,
2015). The Min-Max Normalization is used in order to scale the
entire set of attribute values (features) to fall numerically within
a small specified interval [0, 1] and thus have the same importance.
Normalization is a common preprocessing step in Big Data mining,
widely used to help improve classification accuracy (Patro and
Sahu, 2015).
Second, since the dataset of SpamBase contains many missing
features values, we used preprocessing option of WEKA and
applied the WEKA ”ReplaceMissingValues” filter. It replaces the
missing values of features with the modes and means of the data
numerical distribution.
Third, since our solution deal with high-dimentionnal data, we
opted for Feature selection technique. For that we used WEKA
Select Attributes option. So, the filter CfsSubsetEval is applied as
the attribute evaluator with the Best First search method. The full
training ’attribute selection’ mode is selected. Feature selection (or
dimensionality reduction) is widely used for high-dimentionnal
data. It aims to select just the relevant features of every stream.
It is proved that is an important pre-processing step to reduce
the time of computations (George, 2012; Papadimitriou et al.,
2007) for many large-scale information processing such as classifi-
cations (Yan et al., 2006).
Thus, we applied all the previous preprocessing step on the
dataset extracted from SpamBase for spam detection, named
SpamBase 02 v01. So, we got a stream in ARFF format with 2897
instances including 88 outliers (spams) and 2809 inliers (emails).
After feature selection, the stream included 13 attributes (features)
instead of 57 attributes.
The extracted Breast Cancer datasets from WBC contains a total
of 699 instances with 241 outliers (cancer cases). This dataset con-
tains only 9 features, so there is no need to apply feature reduction.
Thus, in this case, first ’Normalization’ technique is applied then
the WEKA filter is used to replace missing features with their
modes and means (based on the training datasets).
Finally, the preprocessed data streams are loaded as an.arff File
into MOA framework where we applied detection algorithms on
such simulated streams. The class labels were used for evaluating
the detection performance of each algorithm.
4.3. Simulation results
4.3.1. Improvements when using LiCS for Breast cancer detection
A simulated stream extracted from WBC dataset is used as input
to each of the studied algorithms with 699 patient records includ-
ing 241 sick patients that have breast cancer disease.
Table 2 demonstrate the importance of integrating LiCS concept
in the studied algorithms to get better results and to improve the
detection of cancers. In fact, Table 2 highlights that the accuracy
of the upgraded version of MCOD, Abstract-C and Exact-Storm
(that integrates our LiCS concept) is increased by (5, 15%, 4, 72%
and 4, 72%) respectively in comparison to their old versions. Indeed
and as demonstrated in Table 2, the accuracy of the upgraded ver-
sion of MCOD is 89, 56% instead of 86, 41% for the old MCOD. The
accuracy is 91, 27% for the upgraded Abstract-C and Exact-Storm
instead of 86, 55% for their old corresponding versions.
The Recall (called also sensitivity or TPR) is an efficient metric
when there is a high cost for FN. In fact, if contagious sick patient,
spam or fraudulent transaction (actual positive) are predicted as
negatives. The consequence can be bad. From Table 2, it is noticed
that when using the new versions of MCOD, Abstract-C and MCOD
based on our concept LiCS, the Recall is increased by (2,07%, 1,24%,
1,24%). The increase in Recall means that the new versions outper-
form their original versions in labeling actual positive data as pos-
itives. Thus, fewer cases of cancer disease are missed when using
the upgraded algorithms that integrates our LiCS concept. So more
actual sick patients are reported as positives when using our con-
cept LiCS. In addition, since the specificity is also increased by
(3,71%; 6,55%; 6,55%) for breast cancer detection using new algo-
rithms, it means that more negative patient records get correctly
classified as negatives.
Another important element is that the number of unclassified
patients records are decreased when using the upgraded versions
by 4,72% for MCOD and 6,29% for Abstract-C and Exact-Storm,
over a total of 699 instances. This means that doctors can benefit
from additional patient records that get classified using the new
versions based on LiCS concept.
4.3.2. Improvements when using LiCS for spam detection
In this subsection, we present the result of spam detection using
the enhanced algorithms that integrates our LiCS concept. For that,
we used as input a simulated stream in ARFF format extracted from
the SpamBase database with a total of 2897 emails logs, including
88 Outliers (Spam). Table 3 compares all the detection metrics
between the original version of each algorithm and its respective
upgraded versions that integrate our principle (LiCS).
It is worth mentioning that although that the original versions
of MCOD, Abstract-C and Exact-Storm show high accuracy above
96%. Our improved versions, that integrat LiCS concept, succeeded
to outperform those advanced algorithms and we gain an addi-
tional increase in accuracy of +0,42% for MCOD, +0,76% for Exact-
Table 2
Comparing the improved version of algorithms with their original versions and with the results of the proposed Hybrid model for Breast cancer detection (WBC datasets.Windows
size 10).
Algorithms Accuracy Recall Precision Specificity F-measure Unclassified patients records
OLD MCOD 86,41% 95,02% 84,81% 81,88% 89,63% 7,58%
New MCOD 89,56% 97,10% 81,82% 85,59% 88,80% 2,86%
Old E.Storm 86,55% 95,44% 84,87% 81,88% 89,84% 7,44%
New E.Storm 91,27% 96,68% 82,92% 88,43% 89,27% 1,14%
Old AbstractC 86,55% 95,44% 84,87% 81,88% 89,84% 7,44%
New AbstractC 91,27% 96,68% 82,92% 88,43% 89,27% 1,14%
Hybrid model 92,42% 99,17% 82,41% 88,86% 90,02% 0,14%
Diff Hybrid model and old MCOD +6,01% +18,25% +6,99% 2,40% +7,20% 7,44%
Diff Hybrid model and old Abstract-C +5,87% +17,90% +6,99% 2,46% +6,99% 7,30%

Storm and +0,89% for Abstract-C in comparison to their corre-
sponding original versions.
Another important achievement of our life cycle status principle
LiCS is that it improves the recall or the sensitivity of algorithms in
detecting outliers in general and spams in particular.
From Table 3, the recall is increased by (9,09%, 10,23%, 20,45%)
for spam detection when using the new versions of MCOD, Exact-
Storm and Abstract-C based on LiCS concept.
Since the spam dataset has an even class distribution. The accu-
racy metric is contributed by the large number of TN (legitimate
emails) and hence useful but not sufficient to evaluate models. In
this case, we used F-measure to check if there is a balance between
precision and recall. Since the F-measure is improved when using
our new versions of MCOD, Abstract-C and MCOD by (7,03%,
9,57%, 17,33%) respectively, the f-measure confirms that LiCS con-
tributes positively to improve outlier detection and spams.
One limit is that the precision is slightly lower in the new ver-
sions in comparison to original versions (as there is a decrease
between 0,71% and 7,63%). But, it is largely compensated by
improvement in accuracy, recall, specificity and f-measure. In addi-
tion to the advantageous reduction in the unclassified emails.
According to experimental simulations, New MCOD, new Exact-
Strom and New Abstract-C succeeded to correctly classify 50%, 68%
and 69% of unclassified emails respectively. Those results proves
that LiCS is efficient as it empowers those advanced algorithms
to detect more outliers (as true spams) and more inliers (as legiti-
mate emails).
4.3.3. Improvements when using hybrid model for Breast cancer
detection
In the following part, we compare the performance of the pro-
posed hybrid voting approach with the old version of Abstract-C,
MCOD and Exact-Storm. As input to algorithms, we used the same
simulated stream extracted from WBC datasets with 699 records
including 241 sick patients.
The results shown in Table 2 prove that when using the hybrid
voting strategy based on three iterations, the accuracy of detecting
breast cancers is improved by 5,87% to 6,01%. In fact, the accuracy
of the hybrid solution achieves 92,42% instead of only 86,55% for
Abstract-C and Exact-Storm and 86,42% for MCOD. The hybrid
approach demonstrates a recall of 99,17% in detecting spams
instead of only 80,92% for MCOD and 82,27 for Abstract-C and
Exact-Storm.
The recall is also increased by 17,90% to 18,25% in comparison
to those original algorithms. Such important increase in the recall
proves that the hybrid solution outperform original algorithms in
detecting more cancer cases.
From simulation results, we also note that our hybrid solution
based on voting and new versions of algorithms that integrates
LiCS concept, show a better specificity and a better F-measure
in comparison to original algorithms MOCD, Abstract-C or
Exact-Storm.
In fact as shown in Table 2, the specificity is increased by 6,99%
(88,86% instead of 81,88%), such results demonstrates that more
healthy patients get correctly classified as negatives. Since F-
measure (F1 score or the harmonic mean) reached 90,02% (instead
of 83,03% for original algorithms). This confirms that there is an
improved balance between recall and precision in detecting breast
cancer cases in specific and outliers in general.
Another important advantage of using the hybrid model is that
the number of unclassified patients records are decreased by 7,44%.
In fact, the hybrid model has the lowest number of unclassified
emails in comparison to each of the original versions and new ver-
sions based on LiCS of MCOD, E-Storm and Abstract-C. This means
that doctors can benefit from additional patient records that get
correctly classified by using the hybrid model.
4.3.4. Improvements when using hybrid model for spam detection
In this subsection, Table 3 presents the results of the hybrid vot-
ing based on three iterations following the process illustrated in
Fig. 2 to detect spams in a stream of emails logs. It compares the
hybrid solution with each of the original version of MCOD,
Abstract-C and Exact-Strom by measuring the known performance
metrics commonly used for outlier detection namely (accuracy,
recall, precision, specificity and F-measures), all of which based
on calculating the confusion matrix (TP, TN, FP,FN). We compare
also the performance of the hybrid model in terms of total nodes
that remain unclassified.
As input, we used a simulated stream in ARFF format extracted
from the spambase offered by UCI. The extracted file contains a
total of 2897 email logs including 88 Outliers (Spam).
Results in Table 3 demonstrate that the hybrid voting, that inte-
grates our LiCS concept, outperforms even the performance of the
original algorithms that have high accuracy above 96% in detecting
spams. In fact, when testing on the simulated stream of 2897
emails logs, the hybrid solution brings an additional increase in
accuracy (+1,20%) compared to old Abstract-C and old Exact-
Storm) and an increase of accuracy by (+1,24%) compared to old
MCOD. In fact, the hybrid solution achieves an accuracy of
97,89% instead of 96,69% for Abstract-C and Exact-Storm and
96,65% for MCOD.
The recall is also increased by 29,55% to 30,68% in comparison
to those original algorithms. Such important increase in the recall
proves that the hybrid solution outperform original algorithms in
detecting more spams.
From simulation results, we also note that our hybrid solution
based on voting and new versions of algorithms that integrates
LiCS concept, show a better specificity and a better F-measure in
comparison to original algorithms MOCD, Abstract-C or Exact-
Storm.
In fact as show in Table 3, the specificity is increased by 0,32%
(99,25% instead of 98,93%), such results demonstrates that more
legitimate emails get correctly classified as negatives (inliers).
Since F-measure (F1 score or the harmonic mean) reached
Table 3
Comparing performance metrics between the original version of each algorithm and our enhanced versions based on LiCS and the hybrid model, in SpamBase dataset. (Windows
size 10).
Algorithms Accuracy Recall Precision Specificity F-measure Unclassified emails
OLD MCOD 96,65% 23,86% 65,63% 98,93% 35,00% 1,24 %
New MCOD 97,07% 32,95% 58,00% 99,07% 42,03% 0,48%
Old E.Storm 96,69% 25,00% 66,67% 98,93% 36,36% 1,21%
New E.Storm 97,45% 35,23% 65,96% 99,39% 45,93% 0,10%
Old AbstractC 96,69% 25,00% 66,67% 98,93% 36,36% 1,21%
New AbstractC 97,58% 45,45% 65,57% 99,22% 53,69% 0,03%
Hybrid Model 97,89% 54,55% 70,59% 99,25% 61,54% 0,03%
Diff hybrid model and Abstract-C +1,20% +29,55% +3,92% +0,32% +25,18% 0%
Diff hybrid and MCOD +1,24% +30,68% +4,96% +0,32% +26,55% 1,21%

61,54% (instead of 35,00% for original algorithms). This confirms
that there is an improved balance between recall and precision
in detecting spams in specific and outliers in general.
In fact, one important disadvantage of the original versions is
that MCOD shows 36 unclassified emails while Abstract-C and
Exact-Storm show 35 unclassified emails. On the contrary, our
hybrid solution has only one 1 unclassified email. This means that
the hybrid solution outperform those studied algorithms in cor-
rectly classifying more emails by setting their status as spam or
normal emails.
4.4. Comparison of our approach with existing solutions
In this part, we compare our approach with other existing
solutions:
Instead of searching for new efficient ways to detect outliers,
our concept called LiCS enhances the detection capacity of
advanced algorithms widely implemented (e.g., MOA) and
known for their performance. This is by adding a layer to their
internal mechanisms. This layer first classifies online the evolu-
tionary status of k-nearest-neighbors KNN of each node through
many time windows. Then, it aggregates the results to better
define the node’s status. Consequently, data analyst can use
our enhanced versions of MCOD, Abstract-C and Exact-Storm
to detect outliers (e.g., spams, cancers, anomalies) with a better
accuracy and precision (see simulation results in Section 4.3).
They can also benefit from less nodes that remain unclassified.
In the testing phase, when using other approaches, the data
analyst sequentially tries many solutions to select the best
one for its use case. Our approach enables to tune the parame-
ters and compare the results of many algorithms in one trial and
thus save time.
Instead of using one individual algorithm, the data analyst can
select a variation of more than three algorithms (e.i.; KNN, dis-
tance based algorithms, micro-cluster based algorithms) and
execute them. In fact, the proposed hybrid solution uses the
power of the parallel processing and the online voting of algo-
rithms. As proved through simulations, this vote enhances the
accuracy, the recall and precision in detecting outliers (see Sec-
tion 4.3.4 for spam detection).
Some exiting solutions such as (Markad et al., 2017) use the
outlier score as a final step to select outliers. Instead, our
method uses a count threshold (Knno) for nearest neighbors
of a node that are outliers.
In the output, instead of getting different list of outliers/inliers
according to each solution, our approach enables to get in
real-time one consolidated result from multiple solutions.
Concerning extension, our hybrid solution is generic. It can be
extended to integrate other distance-based algorithms (LUE,
DUE, COD,and Thresh LEAP (Cao et al., 2014)) and other types
(density or machine learning algorithms).
Our approach like machine learning based methods (Doan, 2017)
uses a training phase to prepare data and to tunes the parameters
for the best outcome.
The following Table 4 compares between some existing solu-
tions and our approach based on several criteria.
4.5. Discussion of results
Through our various experimentation on two datasets extracted
from UCI repository (Dheeru and Karra Taniskidou, 2017) using
either Breast Cancer datasets to detect cancers or SpamBase to
detect spams and through performances metrics presented in Sec-
tion 4.3, we notice the following:
First, each of the enhanced versions of MCOD, Exact-Storm and
Abstract-C that integrates the LiCS principle outperforms the corre-
sponding original versions in terms of accuracy, recall, specificity.
For instance, doctors can detect cancer diseases with an enhanced
accuracy (91,27%), improved sensitivity (96,68%) and better speci-
ficity (88,43%). Those improvements are also confirmed through
experiments in spam detection.
To summarize, to detect point outliers or anomalies in data
streams, it is recommended to use the improved versions of algo-
rithms based on LiCS instead of their original versions. because
Fig. 2. Hybrid model for outliers detection based on distributed multi-algorithm detection and iterative majority vote.

LiCS brings additional accuracy, sensitivity, specificity with a good
balance proved by an enhanced F-measure (F1 score). This is
because LiCS, consider not only the status of nodes but it monitors
the evolution of their neighbors status through their various life
cycles in different sliding windows and uses a new score to filter
outliers based on N occurence of outliers in K nearest neighboring
nodes.
Integrating our concept LiCS brings another advantages. In fact,
new versions of MCOD, Exact-Storm and Abstract-C based on LiCS
are able to correctly classify 50% to 69% of all patients’ records and
emails that remained unclassified by the original algorithms.
Second, the hybrid voting model (in Fig. 3) goes further and out-
performs the old original versions as well as the upgraded versions
of Abstract-C, Exact-Strom and MCOD in detecting outliers (for
both breast cancer disease or spams detection). In fact, the hybrid
solution achieves the best accuracy of 97,89%, the best precision of
70,59%, the best recall of 54,55%, the best F-measure of 61,54% and
the best specificity of 99,25% in detecting spams followed by the
original Abstract-C and Exact-Storm then MCOD. In detecting out-
liers, the hybrid model has another advantages as it increases the
TP, TN and decreases the unclassified nodes. The experimental
results prove that the combination of all methods used in the
hybrid mode (features reduction, data quality, LiCS concept, major-
ity voting of advanced algorithms, iterations on cleaner data) are
efficient in enhancing outliers detection in different data streams
and can be used for other detection cases. The hybrid model can
be extended to integrate other detection algorithms that uses K-
nearest neighbor (KNN) principal.
In the worst case of voting strategy, our additional tests show
that we get at least comparable measurements as the best algo-
rithm suitable for our datasets. It is worth mentioning that by
using the voting strategy, we can also avoid the worst results
Table 4
comparison of methods used by different approaches and our methods.
References Features
selection
Outlier score Algorithms used Goals and advantages of solutions
Our approach based on
LiCS technique and
vote
X X Sum of k-
occurrence of
k-nearest
neighbors
Various algorithms based on Nearest
neighbors and micro clusters. It uses vote to
aggregate results of multiple algorithm
For Outlier detection in high dimensional streams with
different data classes. It is extendable to integrate other
types of algorithms. It outperforms MCOD, Abstract-C and
Exact-Strom.
(Markad et al., 2017) X X Reverse Nearest neighbors For outlier detection in anti-hub. It reduces computation
and time to find anti hubs.
(Shou et al., 2017) X Top n points Clustering and local density For outlier detection. This method needs less time and less
parameters in comparison to DBSCAN, and K-means
(Doan, 2017) X Bagging X Incremental ensemble model For Data mining and outliers detection. Random forest
outperforms classification and regression methods. It
learns with incomplete training datasets.
(Wurzenberger et al.,
2016)
X Clusters’s size Bioinformatics clustering For detecting anomalous system behavior based on data
logs. It improves scalability and reduces FPR.
(Mazini et al., 2018b) X Artificial
BeeColony
(ABC)
AdaBoost algorithm for classifications. For Network-based IDS.It shows high detection rate (DR)
with low FPR in comparison to existing IDS approaches. It
classifies different attacks and detect even the minority
class.
(Shambharkar and
Sahare, 2016)
SVM classifier SVM improves the accuracy and reduces the false negative
rate in comparison to the K-Nearest Neighbor (KNN)
algorithm.
(Rachidi et al., 2016) Data driven clustering and Bayesian
classification
For Host IDS.It has higher accuracy and detection rate in
comparison to other classification systems.
(Sonowal and
Kuppusamy, 2017)
X URL
feature
X accessibility
score filter
Multi layer and filter approach with Cantina For phishing detection. Better efficiency than URL feature
and Cantina.
(Saad et al., 2014) First, K-means and PSO is used for training.
Then Fuzzy Inference Classifier based on
distance-based and outlier detection methods
For Attack detection (DoS). It increases the high detection
rate and decrease the FPR compared to well-known
clustering algorithms (e.g. Kmean)
(Jiang et al., 2018) X Feature
abstraction
Deep Neural Network (DNN) For multichannel attack. It outperformed methods that use
Feature detection and Bayesian or SVM classifiers.
Fig. 3. Improving outliers detection based on the proposed LiCS concept and our hybrid model (results comparison).

shown by the algorithm that do badly in term of performance for a
certain type of data streams. So, if a user has limited knowledge
about its data, and if a user selects an algorithm that is not well
adapted to his data to detect outliers; the hybrid voting approach
is useful not only to eliminate the bad results but also to optimize
outliers detection.
5. Conclusion and future work
In this paper, after demonstrating the downsides of three well-
known outlier detection algorithms, we propose two contributions
to improve them. First, we propose to integrate a concept called
(Life Cycle Status (LiCS)) in their outlier detection process. As
proved through various experimentations on two real-datasets,
each of our enhanced version of MCOD, Exact-Storm and
Abstract-C, that integrates the proposed LiCS concept, outperforms
its corresponding original version in terms of accuracy, sensitivity,
TP, TN and unclassified nodes. Such improvements can be advanta-
geous for health services and other real-world applications that
need to detect outliers or anomalies in data streams.
Second, we propose a hybrid approach based on the majority
voting of our improved versions of MCOD, Abstract-C and Exact-
Storm. This approach is designed to detect anomalies in high
dimensional streams by combining the strength of those algo-
rithms and reducing their individual errors in setting the final sta-
tus of nodes. Simulations on the two real-data sets demonstrated
that our hybrid approach outperforms MCOD that has the highest
performance among DODSS algorithms and outperforms also the
advanced well known Abstract-C and Exact-Storm, in terms of
accuracy, precision, sensitivity and unclassified nodes. The solution
can be integrated as an Anomaly detection module in various mon-
itoring systems.
Currently, we are working to extend this work by integrating
LiCS in other DODDS algorithms such as DUE, LUE, COD. For future
direction, we aim to test and combine other type of algorithms (i.e.,
density or statistics based).
References
Aggarwal, C.C., 2013. An introduction to outlier analysis. Outlier Analysis. Springer,
pp. 1–40.
Aggarwal, C.C., 2015. Data Mining: The Textbook. Springer.
Aggarwal, C.C., 2015. Outlier analysis. Data Mining. Springer, pp. 237–263.
Angiulli, F., Fassetti, F., 2007. Detecting distance-based outliers in streams of data.
Proceedings of the sixteenth ACM conference on Conference on information and
knowledge management. ACM, pp. 811–820.
Anusha, K., Sathiyamoorthy, E., 2016. Omamids: ontology based multi-agent model
intrusion detection system for detecting web service attacks. J. Appl. Security
Res. 11, 489–508.
Benjelloun, F.Z., Ait Lahcen, A., Belfkih, S., 2017. Outlier detection techniques for big
data streams: focus on cyber security. Int. J. Internet Technol. Secured Trans. (In
press)
Bifet, A., Holmes, G., Kirkby, R., Pfahringer, B., 2010. Moa: massive online analysis. J.
Mach. Learn. Res. 11, 1601–1604.
Cao, L., Yang, D., Wang, Q., Yu, Y., Wang, J., Rundensteiner, E.A., 2014. Scalable
distance-based outlier detection over high-volume data streams. 2014 IEEE
30th International Conference on Data Engineering (ICDE). IEEE, pp. 76–87.
Dheeru, D., Karra Taniskidou, E., 2017. UCI machine learning repository..
Dheeru, D., Taniskidou, E.K., 2017. Uci Machine Learning Repository. Irvine, School
of Information and Computer Sciences, University of California.
Doan, T.S., 2017. Ensemble Learning for Multiple Data Mining Problems. Ph.D.
thesis. University of Colorado Colorado Springs. Kraemer Family Library.
Dolgikh, A., Birnbaum, Z., Liu, B., Chen, Y., Skormin, V., 2014. Cloud security auditing
based on behavioural modelling. Int. J. Business Process Integration Manage. 7,
137–152.
Fa, J.N., Parasuramanb, E., Bc, T., 2015. An efficient outlier detection using
amalgamation of clustering and attribute-entropy based approach. Malaya J.
Matematik.
George, A., 2012. Anomaly detection based on machine learning: dimensionality
reduction using pca and classification using svm. Int. J. Computer Appl. 47.
Gogoi, P., Bhattacharyya, D., Borah, B., Kalita, J.K., 2013. Mlh-ids: a multi-level
hybrid intrusion detection method. Computer J. 57, 602–623.
Gupta, B., Agrawal, D.P., Yamaguchi, S., 2016. Handbook of Research on Modern
Cryptographic Solutions for Computer and Cyber Security. IGI Global.
Hamid, Y., Sugumaran, M., Balasaraswathi, V., 2016. Ids using machine learning-
current state of art and future directions. British. J. Appl. Sci. Technol. 15.
Jiang, F., Fu, Y., Gupta, B.B., Lou, F., Rho, S., Meng, F., Tian, Z., 2018. Deep learning
based multi-channel intelligent attack detection for data security. IEEE
Transactions on. Sustainable Comput.
Kapse, M.D. et al., 2016. A survey on outlier detection technique in streaming data
using data clustering approach. Int. J. Eng. Computer Sci. 5.
Karami, A., Guerrero-Zapata, M., 2015. A fuzzy anomaly detection system based on
hybrid pso-kmeans algorithm in content-centric networks. Neurocomputing
149, 1253–1269.
Kontaki, M., Gounaris, A., Papadopoulos, A.N., Tsichlas, K., Manolopoulos, Y., 2011.
Continuous monitoring of distance-based outliers over data streams. 2011 IEEE
27th International Conference on Data Engineering (ICDE). IEEE, pp. 135–146.
Markad, K., Moholkar, K., Abdal, S., Thite, R., 2017. Unsupervised distance based
detection of outliers by using anti-hubs..
Mazini, M., Shirazi, B., Mahdavi, I., 2018a. Anomaly network-based intrusion
detection system using a reliable hybrid artificial bee colony and adaboost
algorithms. J. King Saud University-Computer Inform. Sci.
Mazini, M., Shirazi, B., Mahdavi, I., 2018b. Anomaly network-based intrusion
detection system using a reliable hybrid artificial bee colony and adaboost
algorithms. J. King Saud University – Computer Inform. Sci.
Nguyen, H.L., Woon, Y.K., Ng, W.K., 2015. A survey on data stream clustering and
classification. Knowl. Inform. Syst. 45, 535–569.
Oussous, A., Benjelloun, F.Z., Lahcen, A.A., Belfkih, S., 2018. Big data technologies: a
survey. J. King Saud University – Computer Inform. Sci. 30, 431–448.
Papadimitriou, S., Sun, J., Faloutsos, C., 2007. Dimensionality reduction and
forecasting on streams. Data Streams. Springer, pp. 261–288.
Patro, S., Sahu, K.K., 2015. Normalization: A preprocessing stage. arXiv preprint
arXiv:1503.06462..
Poonsirivong, K., Jittawiriyanukoon, C., 2017. A rapid anomaly detection technique
for big data curation. 2017 14th International Joint Conference on Computer
Science and Software Engineering (JCSSE). IEEE, pp. 1–6.
Rachidi, T., Koucham, O., Assem, N., 2016. Combined data and execution flow host
intrusion detection using machine learning. Intelligent Systems and
Applications. Springer, pp. 427–450.
Saad, R.M., Almomani, A., Altaher, A., Gupta, B., Manickam, S., 2014. Icmpv6 flood
attack detection using denfis algorithms. Indian J. Sci. Technol. 7, 168–173.
Sadik, S., Gruenwald, L., 2014. Research issues in outlier detection for data streams.
ACM SIGKDD Explorations Newsletter 15, 33–40.
Shambharkar, V., Sahare, V., 2016. An approach for supervised distance based
outlier detection. Int. J. Adv. Electron. Computer Sci. 3.
Shou, Z.Y., Li, M.Y., Li, S.M., 2017. Outlier detection based on multi-dimensional
clustering and local density. Journal of Central South University 24, 1299–1306.
Singh, J., Aggarwal, S., 2013. Survey on outlier detection in data mining. Int. J.
Computer Appl. 67.
Sonowal, G., Kuppusamy, K., 2017. Phidma–a phishing detection model with multi-
filter approach. J. King Saud University-Comput. Inform. Sci.
Tran, L., Fan, L., Shahabi, C., 2016. Distance-based outlier detection in data streams.
Proc. VLDB Endowment 9, 1089–1100.
Vasudevan, A.R., Selvakumar, S., 2016. Local outlier factor and stronger one class
classifier based hierarchical model for detection of attacks in network intrusion
detection dataset. Front. Computer Sci. 10, 755–766.
Vijayarani, S., Jothi, P., 2013. An efficient clustering algorithm for outlier detection
in data streams. Int. J. Adv. Res. Computer Commun. Eng. 2, 3657–3665.
WEKA, 2011. University of Waikato, Hamilton, New Zealand..
Wurzenberger, M., Skopik, F., Fiedler, R., Kastner, W., 2016. Discovering insider
threats from log data with high-performance bioinformatics tools. Proceedings
of the 8th ACM CCS International Workshop on Managing Insider Security
Threats. ACM, pp. 109–112.
Xiang, J., Westerlund, M., Sovilj, D., Pulkkis, G., 2014. Using extreme learning
machine for intrusion detection in a big data environment. Proceedings of the
2014 Workshop on Artificial Intelligent and Security Workshop. ACM, pp. 73–
82.
Yan, J., Zhang, B., Liu, N., Yan, S., Cheng, Q., Fan, W., Yang, Q., Xi, W., Chen, Z., 2006.
Effective and efficient dimensionality reduction for large-scale and streaming
data preprocessing. IEEE Trans. Knowledge Data Eng. 18, 320–333.
Zhang, P., Li, J., Wang, P., Gao, B.J., Zhu, X., Guo, L., 2011. Enabling fast prediction for
ensemble models on data streams. Proceedings of the 17th ACM SIGKDD
international conference on Knowledge discovery and data mining. ACM, pp.
177–185.

Detecting outliers and anomalies in data streams

More Related Content

What's hot (20)

Similar to Detecting outliers and anomalies in data streams (20)

Recently uploaded (20)

Detecting outliers and anomalies in data streams