A Geometric Framework for Unsupervised Anomaly Detection: Detecting Intrusions in Unlabeled Data
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
KNN operates only at the sample level.
“but it operates only at the sample level.”
From Deep Industrial Image Anomaly Detection: A Survey (2024) · cites this paper as [72]
K-nearest neighbors (KNN) is a widely used algorithm for unsupervised anomaly detection.
“K nearest neighbors (KNN) [72] is a widely used algorithm for unsupervised anomaly detection”
From Deep Industrial Image Anomaly Detection: A Survey (2024) · cites this paper as [72]
Cites
Estimating the Support of a High-Dimensional Distribution
Schölkopf, B., Platt, J. C., Shawe-Taylor, J., Smola, A. J., & Williamson, R. C. (2001) · Neural Computation · doi:10.1162/089976601750264965 · Cited by 6,168 · see citing works
Advances in kernel methods: support vector learning
Schölkopf, B., Burges, C. J. C., & Smola, A. J. (1999) · doi:10.5555/299094 · Cited by 5,809 · see citing works
Fast Training of Support Vector Machines Using Sequential Minimal Optimization
Platt, J. C. (1998) · The MIT Press eBooks · doi:10.7551/mitpress/1130.003.0016 · Cited by 5,501 · see citing works
LOF: identifying density-based local outliers
Breunig, M. M., Kriegel, H.-P., Ng, R. T., & Sander, J. (2000) · ACM SIGMOD Record · doi:10.1145/335191.335388 · Cited by 5,207 · see citing works
An Introduction to Support Vector Machines
Cristianini, N., & Shawe-Taylor, J. S. (2000) · ePrints Soton (University of Southampton) · Cited by 4,115 · see citing works
Denning, D. E. (1987) · IEEE Transactions on Software Engineering · doi:10.1109/tse.1987.232894 · Cited by 3,428 · see citing works
Bro: a system for detecting network intruders in real-time
Paxson, V. (1999) · Computer Networks · doi:10.1016/s1389-1286(99)00112-7 · Cited by 2,636 · see citing works
Advances in Large-Margin Classifiers
(2000) · The MIT Press eBooks · doi:10.7551/mitpress/1113.001.0001 · Cited by 1,902 · see citing works
Atkinson, A. C., BARNETT, V. D., & Lewis, T. (1995) · Journal of the Royal Statistical Society Series A (Statistics in Society) · doi:10.2307/2983451 · Cited by 1,688 · see citing works
Algorithms for Mining Distance-Based Outliers in Large Datasets
Knorr, E. M., & Ng, R. T. (1998) · Cited by 1,526 · see citing works
Intrusion detection using sequences of system calls
Hofmeyr, S. A., Forrest, S., & Somayaji, A. (1998) · Journal of Computer Security · doi:10.3233/jcs-980109 · Cited by 1,315 · see citing works
Balakrishnan, N., Barnett, V., & Lewis, T. (1995) · Biometrics · doi:10.2307/2533352 · Cited by 1,228 · see citing works
Data Mining Approaches for Intrusion Detection
Lee, W., & Stolfo, S. J. (2000) · doi:10.21236/ada401496 · Cited by 1,186 · see citing works
Self-citationDetecting intrusions using system calls: alternative data models
Warrender, C., Forrest, S., & Pearlmutter, B. A. (2003) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/secpri.1999.766910 · Cited by 1,112 · see citing works
A Sense of Self for Unix Processes
Forrest, S., Hofmeyr, S. A., Somayaji, A., et al. (1996) · Cited by 1,104 · see citing works
Efficient clustering of high-dimensional data sets with application to reference matching
McCallum, A., Nigam, K., & Ungar, L. (2000) · ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/347090.347123 · Cited by 1,102 · see citing works
Convolution kernels on discrete structures
Haussler, D. H. (1999) · Cited by 1,076 · see citing works
The Case against Accuracy Estimation for Comparing Induction Algorithms
Provost, F. J., Fawcett, T. E., & Kohavi, R. (1998) · Cited by 1,018 · see citing works
THE SPECTRUM KERNEL: A STRING KERNEL FOR SVM PROTEIN CLASSIFICATION
Leslie, C. S., Eskin, E., & Noble, W. S. (2001) · Pacific Symposium on Biocomputing (PSB) · doi:10.1142/9789812799623_0053 · Cited by 932 · see citing works
Self-citationIntrusion detection with unlabeled data using clustering
Portnoy, L. (2000) · doi:10.7916/d8mp5904 · Cited by 756 · see citing works
Self-citationAnomaly Detection over Noisy Data Using Learned Probability Distributions
Eskin, E. (2000) · doi:10.7916/d8c53skf · Cited by 483 · see citing works
Self-citationFinding Intensional Knowledge of Distance-Based Outliers
Knorr, E. M., & Ng, R. T. (1999) · Cited by 419 · see citing works
Bro: a system for detecting network intruders in real-time
Paxson, V. (1998) · Cited by 282 · see citing works
Learning Patterns from Unix Process Execution Traces for Intrusion Detection
Lee, W., Stolfo, S., & Chan, P. K. (1997) · doi:10.7916/d8b56rf2 · Cited by 268 · see citing works
Self-citationThe NIDES Statistical Component Description and Justification
Javitz, H. S., & Valdes, A. (1994) · Cited by 254 · see citing works
A Markov Chain Model of Temporal Behavior for Anomaly Detection
Ye, N. (2000) · Cited by 253 · see citing works
Watkins, C. (2000) · The MIT Press eBooks · doi:10.7551/mitpress/1113.003.0006 · Cited by 244 · see citing works
Modeling system calls for intrusion detection with dynamic window sizes
Eskin, E., Lee, W., & Stolfo, S. J. (2002) · doi:10.1109/discex.2001.932213 · Cited by 167 · see citing works
Self-citationSequence Matching and Learning in Anomaly Detection for Computer Security
Lane, T. D. R., & Brodley, C. E. (1997) · Cited by 156 · see citing works
Results of the DARPA 1998 offline intrusion detection evaluation
Lippmann, R. P., Cunningham, R. K., Fried, D. J., et al. (1999) · Recent Advances in Intrusion Detection · Cited by 91 · see citing works
A statistically based system for prioritizing information exploration under uncertainty
Helman, P., & Bhangoo, J. S. (1997) · IEEE Transactions on Systems Man and Cybernetics - Part A Systems and Humans · doi:10.1109/3468.594912 · Cited by 58 · see citing works
Ensemble-based Adaptive Intrusion Detection
Fan, W., & Stolfo, S. J. (2002) · SIAM International Conference on Data Mining · doi:10.1137/1.9781611972726.3 · Cited by 19 · see citing works
Self-citation
Flagged first, then by citations
Cited by
Sorted by citations
Chandola, V., Banerjee, A., & Kumar, V. (2009) · ACM Computing Surveys · doi:10.1145/1541880.1541882 · Cited by 11,687 · see citing works
Towards Total Recall in Industrial Anomaly Detection
Roth, K., Pemula, L., Zepeda, J., Scholkopf, B., Brox, T., & Gehler, P. (2022) · 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr52688.2022.01392 · Cited by 1,810 · see citing works
“This has given rise to other industrial anomaly detection methods reliant on better reuse of pretrained features such as SPADE [10], which utilizes memory banks comprising various feature hierarchies for finegrained, kNN-based [18] anomaly segmentation and image-level anomaly detection.”
BackgroundMethodDeep Industrial Image Anomaly Detection: A Survey
Liu, J., Xie, G., Wang, J., Li, S., Wang, C., Zheng, F., & Jin, Y. (2024) · Machine Intelligence Research · doi:10.1007/s11633-023-1459-z · Cited by 463 · see citing works
Sub-Image Anomaly Detection with Deep Pyramid Correspondences
Cohen, N., & Hoshen, Y. (2020) · arXiv · doi:10.48550/arxiv.2005.02357 · Cited by 372 · see citing works
A clustering-based method for unsupervised intrusion detections
Jiang, S., Song, X., Wang, H., Han, J.-J., & Li, Q.-H. (2006) · Pattern Recognition Letters · doi:10.1016/j.patrec.2005.11.007 · Cited by 164 · see citing works
An unsupervised anomaly-based detection approach for integrity attacks on SCADA systems
Almalawi, A., Yu, X., Tari, Z., Fahad, A., & Khalil, I. (2014) · Computers & Security · doi:10.1016/j.cose.2014.07.005 · Cited by 113 · see citing works
- Authors
- Eskin, E., Arnold, A., Prerau, M., Portnoy, L., & Stolfo, S.
- Affiliations
- Columbia University (US)
- Venue
- Advances in Information Security
- Publisher
- Springer US
- Published
- 2002
- Pages
- 77-101
- ISSN
- 1568-2633 (ISSN-L)
- OpenAlex
- W1554085250
- Cited by
- 683
- References
- 32
- Citations by year
- 2026: 10 · 2025: 21 · 2024: 26 · 2023: 29 · 2022: 31 · 2021: 43 · 2020: 45 · 2019: 45 · 2018: 40 · 2017: 44 · 2016: 33 · 2015: 33 · 2014: 48 · 2013: 21 · 2012: 23
- FWCI
- 24.60
- Type
- book chapter
- Language
- en
- Open access
- closed
- Licence
- Locations
- Advances in information security (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Engineering › Biomedical Engineering › Artificial Immune Systems Applications
- Keywords
- unsupervised anomaly detection, intrusion detection, geometric framework, feature maps, system call traces, network connections, sparse regions, KDD Cup 1999 dataset
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review