new behavior is an outlier with high probability, it
can mean only two things: the new behavior is either
an anomaly or it is nominal in a new way (for example, it behaves differently than other nominal behaviors in the nominal set). The more nominal time periods the nominal set has, the more the chances that
the reported novelties are really anomalies.
Behaviors are characterized by simple statistical
features (average, standard deviation, maximum, and
minimum) in a fixed-size time period (for example,
To be mode independent of the choice of the
parameter k (number of closest points to compute
density) we try several k = { 10, 20, 30} and use as out-
lier probability the minimum value of these differ-
0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
0.24
0.16
0.22
0.11
0.16
0.2
0.18 0.13
0.29
0.19
0.17
0.36
0.14
0.42
0.25
0.12
0.12
0.11
0.27
0.11
0.31
0.13 0.60
0.76
0.86
0.64
0.66
0.84
0.46
0.62
0.51
0.52
Figure 3. LoOP.
Local outlier probabilities outlier detection technique graphical example with two dimensions. Points with high outlier probability indicate a potential novel behavior.
