Unsupervised Anomaly Detection Based on Principal Components Analysis

Intrusion detection systems need a mass of the labeled data in the process of training It hampers the application and popularity of traditional IDSs A study was conducted to realize the automation of the learning process of the detection models where the training data is unsupervised A novel method of unsupervised anomaly detection based on principal components analysis （PCA） is presented The main characteristics of the training samples are learned under the principle of least mean square errors The information of the samples is duplicated in the process of encoding and decoding The anomaly behaviors can be detected according to the anomaly factor defined by the square errors between the original vector and the resultant one The experiment of the simulation system proves that the method of unsupervised anomaly detection based on PCA does not need the participation of experts in the prophase The experimental result shows its effectiveness