Unsupervised parsimonious cluster-based anomaly detection (PCAD)

Group anomaly detection (AD), i.e. detection of clusters of anomalous samples in a test batch, with the samples in a given such cluster exhibiting a common pattern of atypicality (relative to a null model) has important applications to discovering unknown classes present in a test data batch and, equivalently, to zero-day threat detection in a security context. When the feature space is large, clusters may manifest anomalies on very small feature subsets, which is well-captured by the parsimonious mixture modelling (PMM) framework. Thus, we propose a generalized likelihood ratio test (GLRT-like) group AD framework, with PMMs used for both the null and the alternative hypothesis (that an anomalous cluster is present), and with the Bayesian Information Criterion (BIC) used to adjudicate between these hypotheses. We demonstrate our approach on network traffic data sets, detecting Zeus (web) bots and peer-to-peer traffic as zero-day activities. Our PCAD achieves substantially better detection results than a previous group AD method applied to this domain.