Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
Cited by 715

The DOI matches its Crossref record; 6 of the 6 references it cites were found in a registry or an index.

Anomaly Detection for Discrete Sequences: A Survey

Open access
Chandola, V., Banerjee, A., Kumar, V.·2012·IEEE Transactions on Knowledge and Data Engineering
DOI 10.1109/tkde.2010.235
Open this paper in CoChat — free account

Abstract

This survey attempts to provide a comprehensive and structured overview of the existing research for the problem of detecting anomalies in discrete/symbolic sequences. The objective is to provide a global understanding of the sequence anomaly detection problem and how existing techniques relate to each other. The key contribution of this survey is the classification of the existing research into three distinct categories, based on the problem formulation that they are trying to solve. These problem formulations are: 1) identifying anomalous sequences with respect to a database of normal sequences; 2) identifying an anomalous subsequence within a long sequence; and 3) identifying a pattern in a sequence whose frequency of occurrence is anomalous. We show how each of these problem formulations is characteristically distinct from each other and discuss their relevance in various application domains. We review techniques from many disparate and disconnected application domains that address each of these formulations. Within each problem formulation, we group techniques into categories based on the nature of the underlying algorithm. For each category, we provide a basic anomaly detection technique, and show how the existing techniques are variants of the basic technique. This approach shows how different techniques within a category are related or different from each other. Our categorization reveals new variants and combinations that have not been investigated before for anomaly detection. We also provide a discussion of relative strengths and weaknesses of different techniques. We show how techniques developed for one problem formulation can be adapted to solve a different formulation, thereby providing several novel adaptations to solve the different problem formulations. We also highlight the applicability of the techniques that handle discrete sequences to other related areas such as online anomaly detection and time series anomaly detection.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/tkde.2010.235

Cites

6 of 6 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Show all 6 references

Research works printed but not linked: 90

  1. 10.1137/1.9781611972771.43 · DOI
  2. 10.1109/ICDM.2006.138 · DOI
  3. wei, 2005, Assumption-Free Anomaly Detection in Time Series, Proc 17th Int'l Conf Scientific and Statistical Database Management, 237
  4. 10.1145/1014052.1014077 · DOI · Paper page
  5. 10.1109/ICDM.2006.122 · DOI
  6. 10.1145/775047.775128 · DOI · Paper page
  7. fu, 2006, Finding Time Series Discords Based on Haar Transform, Proc Second Int'l Conf Advanced Data Mining and Applications, 31, 10.1007/11811305_3 · DOI
  8. ghosh, 1999, Learning Program Behavior Profiles for Intrusion Detection, Proc First USENIX Workshop Intrusion Detection and Network Monitoring, 51
  9. 10.1137/1.9781611972764.70 · DOI
  10. ghosh, 1999, Using Program Behavior Profiles for Intrusion Detection, Proc SANS Third Conf and Workshop Intrusion Detection and Response
  11. 10.1007/s10115-004-0174-5 · DOI
  12. 10.1137/1.9781611972757.55 · DOI
  13. 10.1145/359581.359603 · DOI · Paper page
  14. sokal, 1958, A Statistical Method for Evaluating Systematic Relationships, Univ of Kansas Scientific Bull, 38, 1409
  15. smyth, 1997, Clustering Sequences with Hidden Markov Models, Proc Advances in Neural Information Processing Systems, 9
  16. debar, 1998, Fixed vs. Variable-Length Patterns for Detecting Suspicious Process Behavior, Proc Fifth European Symp Research in Computer Security, 1
  17. 10.1109/CSAC.1998.738647 · DOI
  18. lane, 1997, Sequence Matching and Learning in Anomaly Detection for Computer Security, Proc AI Approaches to Fraud Detection and Risk Management, 43
  19. lane, 1999, Hidden Markov Models for Human/Computer Interface Modeling, Proc IJCAI-99 Workshop Learning about Users, 35
  20. 10.1109/PROC.1973.9030 · DOI · Paper page
  21. 10.1145/1081870.1081927 · DOI
  22. 10.1002/cpe.889 · DOI
  23. 10.1023/A:1026490906255 · DOI
  24. 10.1049/el:20020467 · DOI
  25. 10.1109/ICDE.2003.1260785 · DOI
  26. 10.1109/PDCAT.2003.1236299 · DOI
  27. 10.1007/s10115-006-0034-6 · DOI
  28. 10.1145/347090.347151 · DOI · Paper page
  29. 10.1109/ICDM.2005.79 · DOI · Paper page
  30. 10.1109/CBMS.2005.34 · DOI
  31. 10.1023/B:AIRE.0000045502.10941.a9 · DOI · Paper page
  32. 10.1145/1541880.1541882 · DOI · Paper page
  33. srivastava, 2005, Discovering System Health Anomalies Using Data Mining Techniques, Proc Joint Army Navy NASA Airforce Conf Propulsion
  34. pavlov, 2002, A Maximum Entropy Approach to Collaborative Filtering in Dynamic, Sparse, High-Dimensional Domains, Proc Advances in Neural Information Processing Systems
  35. chakrabarti, 1998, Mining Surprising Patterns Using Temporal Description Length, Proc 24th Int'l Conf Very Large Data Bases, 606
  36. 10.1145/342009.335437 · DOI · Paper page
  37. 10.1109/ICDM.2003.1250927 · DOI
  38. jain, 1988, Algorithms for clustering data
  39. eskin, 2002, A Geometric Framework for Unsupervised Anomaly Detection, Applications of Data Mining in Computer Security, 78
  40. 10.1109/CSAC.1998.738646 · DOI
  41. 10.1109/SUTC.2006.1636219 · DOI
  42. gwadera, 2010, Ranking Sequential Patterns with Respect to Significance, Proc Pacific-Asia Conf on Knowledge Discovery and Data Mining (PAKDD), 286, 10.1007/978-3-642-13657-3_32 · DOI
  43. 10.1137/1.9781611972788.43 · DOI
  44. 10.1137/1.9781611972795.36 · DOI
  45. 10.1109/ICDM.2008.146 · DOI
  46. 10.1109/ICDE.2008.4497544 · DOI
  47. 10.1145/956804.956828 · DOI
  48. 10.1214/aoms/1177697196 · DOI · Paper page
  49. 10.1016/B978-1-55860-377-6.50023-2 · DOI · Paper page
  50. eskin, 2000, Protein Family Classification Using Sparse Markov Transducers, Proc Int'l Conf Intelligent Systems for Molecular Biology (ISMB '08), 134
  51. 10.1145/366173.366197 · DOI
  52. ye, 2004, A Markov Chain Model of Temporal Behavior for Anomaly Detection, Proc Fifth Ann IEEE Information Assurance Workshop
  53. 10.1137/1.9781611972771.25 · DOI
  54. 10.1016/j.neucom.2006.10.017 · DOI
  55. 10.1109/ICMLC.2002.1176779 · DOI
  56. budalakoti, 2006, Anomaly Detection in Large Sets of High-Dimensional Symbol Sequences, Technical Report NASA TM-2006-214553
  57. 10.1145/604264.604269 · DOI
  58. budalakoti, 2007, Anomaly Detection and Diagnosis Algorithms for Discrete Symbol Sequences with Applications to Airline Safety, Proc IEEE Int'l Conf Systems Man and Cybernetics, 37
  59. 10.1137/1.9781611972764.9 · DOI
  60. 10.1109/ICDM.2008.151 · DOI
  61. 10.1017/CBO9780511574931 · DOI · Paper page
  62. 10.1109/ICDSN.2000.857599 · DOI
  63. 10.1109/SECPRI.1996.502675 · DOI · Paper page
  64. 10.1137/1.9781611972757.36 · DOI
  65. 10.1109/DISCEX.2001.932213 · DOI
  66. 10.1109/CIDM.2007.368917 · DOI · Paper page
  67. 10.1145/322510.322526 · DOI · Paper page
  68. pawling, 2008, Anomaly Detection in Streaming Sensor Data, Intelligent Techniques for Warehousing and Mining Sensor Network Data
  69. 10.1073/pnas.96.12.7011 · DOI
  70. gwadera, 2004, Detection of Significant Sets of Episodes in Event Sequences, Proc Fourth IEEE Int'l Conf Data Mining, 3
  71. 10.1007/s10994-008-5093-3 · DOI
  72. forrest, 1999, Detecting Intrusions Using System Calls: Alternate Data Models, Proc IEEE Symp on Security and Privacy, 133
  73. 10.1137/1.9781611972733.3 · DOI · Paper page
  74. 10.1109/ACSAC.2000.898854 · DOI
  75. hofmeyr, 1998, Intrusion Detection Using Sequences of System Calls, J Computer Security, 6, 151, 10.3233/JCS-980109 · DOI · Paper page
  76. florez-larrahondo, 2005, Efficient Modeling of Discrete Events for Anomaly Detection Using Hidden Markov Models, Information Security, 3650, 506, 10.1007/11556992_38 · DOI
  77. lee, 1998, Data Mining Approaches for Intrusion Detection, Proc Seventh USENIX Security Symp
  78. 10.1007/11604655_61 · DOI
  79. lee, 1997, Learning Patterns from Unix Process Execution Traces for Intrusion Detection, Proc AAAI 97 Workshop AI Methods in Fraud and Risk Management
  80. forrest, 2004, A Formal Framework for Positive and Negative Detection Schemes, IEEE Trans Systems Man and Cybernetics Part B, 34, 357, 10.1109/TSMCB.2003.817026 · DOI
  81. 10.1109/ICDM.2007.61 · DOI
  82. 10.1111/j.1365-2966.2006.10327.x · DOI
  83. 10.1023/A:1026195112518 · DOI · Paper page
  84. forrest, 1996, An Immunological Approach to Change Detection: Algorithms, Analysis and Implications, Proc IEEE Symp Security and Privacy, 110
  85. 10.1109/CEC.2002.1004386 · DOI
  86. forrest, 1996, Novelty Detection in Time Series Data Using Ideas from Immunology, Proc Fifth Int'l Conf Intelligence Systems
  87. 10.1109/RISP.1994.296580 · DOI · Paper page
  88. 10.1109/ICSMC.2000.884976 · DOI
  89. 10.1109/52.605929 · DOI
  90. lane, 1997, An Application of Machine Learning to Anomaly Detection, Proc 20th Nat'l Information Systems Security Conf, 366

Cited by

See all 715

Metadata

Authors
Chandola, V., Banerjee, A., & Kumar, V.
Venue
IEEE Transactions on Knowledge and Data Engineering
Publisher
Institute of Electrical and Electronics Engineers (IEEE)
Published
2012-05
Volume
24
Issue
5
Pages
823-839
ISSN
1041-4347 (ISSN-L)
DOI
10.1109/tkde.2010.235
OpenAlex
W2038819732
Cited by
715
References
6
FWCI
31.97
Type
journal article
Language
en
Open access
green
Licence
ieeexplore.ieee.org/Xplorehelp/downloads/license-information/IEEE.html (vor)

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

How to cite

Cite CoChat for the checks on this page, and the paper for its own findings.

This page
CoChat. (2026). Citation check: Anomaly Detection for Discrete Sequences: A Survey. https://app.cochat.ai/papers/10.1109/tkde.2010.235
The paper
Chandola, V., Banerjee, A., & Kumar, V. (2012). Anomaly Detection for Discrete Sequences: A Survey. IEEE Transactions on Knowledge and Data Engineering. https://doi.org/10.1109/tkde.2010.235

Data sources

Bibliographic data: Semantic Scholar, OpenAlex, Crossref.

Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).

Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.