Anomaly detection based on improved k-nearest neighbor rough sets

Abstract

Neighborhood rough set model is a resultful model for processing incomplete, imprecise, and other uncertain data. It has been used in several fields, such as anomaly detection and data classification. However, most of the current neighborhood rough set models suffer from the issues of unreasonable neighborhood radius determination and poor adaptability. To obtain an adaptive neighborhood radius and make granulation results more reasonable, an improved k-nearest neighbor rough set model is proposed in the paper by introducing kth-distance as the k-nearest neighborhood radius, and an anomaly detection model is constructed. In the method, the k-nearest neighborhood radius is used to calculate the k-nearest neighbor relation firstly. Then, the anomaly degree of granule (GAD) is defined to measure the anomaly degree of k-nearest neighbor granules by combining approximation accuracy with the local density. Furthermore, the GADs of an object's k-nearest neighbor granules generated by different attribute subsets are calculated, and the anomaly score (AS) is constructed. Finally, an anomaly detection algorithm is designed. Some mainstream anomaly detection methods are compared with the proposed method on public datasets. The results indicate that the capability of detecting anomalies of the proposed approach outperforms current detection methods.