Given a stream of entries in a multi-aspect data setting i.e., entries having multiple dimensions, how can we detect anomalous activities in an unsupervised manner? For example, in the intrusion detection setting, existing work seeks to detect anomalous events or edges in dynamic graph streams, but this does not allow us to take into account additional attributes of each entry. Our work aims to define a streaming multi-aspect data anomaly detection framework, termed MSTREAM which can detect unusual group anomalies as they occur, in a dynamic manner. MSTREAM has the following properties: (a) it detects anomalies in multi-aspect data including both categorical and numeric attributes; (b) it is online, thus processing each record in constant time and constant memory; (c) it can capture the correlation between multiple aspects of the data. MSTREAM is evaluated over the KDDCUP99, CICIDS-DoS, UNSW-NB 15 and CICIDS-DDoS datasets, and outperforms state-of-the-art baselines.

翻译：鉴于多层数据设置中的一系列条目,即具有多个维度的条目,我们如何能以不受监督的方式探测异常活动?例如,在入侵探测设置中,现有工作力求探测动态图形流中的异常事件或边缘,但这使我们无法考虑到每个条目的更多属性。我们的工作旨在界定一个流流多层数据异常现象探测框架,称为MSTREAM,它能够动态地探测到异常群体异常现象。MSTREAM具有以下特性:(a) 它检测到多层数据中的异常现象,包括绝对和数字属性;(b) 它是在线的,因此处理每个记录的时间和恒定记忆;(c) 它能够捕捉到数据多个方面的相互关系。MSTREAM是KDCUP99、CICCDS-DoS、UNSW-NB 15和CICIDS-DOS数据集,以及外形的状态基线。