probability of being a new behavior. Figure 3 shows
an example using two dimensions (for example, average and standard deviation). LoOP has the advantage
of being more robust and providing a much more
intuitive output. By using LoOP we can rank novel
behaviors by novelty probability showing first the
behaviors with higher chances to be truly novel.
Novel Behavior Detection —
We use LoOP (Kriegel et al. 2009) to find whether a
new behavior is novel with respect to a set of given
behaviors. If the set of given behaviors consists of
nominal behaviors only, and LoOP finds that the
Figure 2. Statistical Features.
Feature extraction and side-by-side comparison of the XMM anomaly shown in figure 5. Every point represents a time period; its position
in the chart is given by its statistical features. Legend: blue consists of nominal periods ( 1 January 2009 – 31 March 2009), green represents
a spike in April, and red represents the thermostat dithering anomaly3. This two-dimensional example is only an easy way to visualize this
representation. In reality, four dimensions (average, standard deviation, maximum, and minimum) are used simultaneously.
type nominal april may
average average average
min min min