Most existing algorithms of anomaly detection are suitable for static data where all data are available during detection but are incapable of handling dynamic data streams. In this study, we proposed an improved iLOF (incremental local outlier factor) algorithm based on the landmark window model, which provides an efficient method for anomaly detection in data streams and outperforms conventional methods. What is more, data windows as updating units are introduced to reduce the false alarm rate, and multiple tests are taken here to identify candidate anomalies and real anomalies. The improved iLOF shows its obvious advantage with its false positive rate. Furthermore, the proposed algorithm instantly deletes data points of identified real anomalies. We analyzed the performance of the improved algorithm and the sensitivity of certain parameters via empirical experiments using synthetic and real data sets. The experimental results demonstrate that the proposed improved algorithm achieved better performance on the higher detection rate and the lower false alarm rate compared with the original iLOF algorithm and its improvements.

大多数现有的异常检测算法都适用于静态数据，其中所有数据在检测过程中都可用，但无法处理动态数据流。在本研究中，我们提出了一种基于界标窗口模型的改进 iLOF（增量局部异常值因子）算法，该算法为数据流中的异常检测提供了一种有效的方法，并且优于传统方法。更重要的是，引入数据窗口作为更新单元以降低误报率，并在此处进行多次测试以识别候选异常和真实异常。改进后的 iLOF 以其误报率显示出明显的优势。此外，所提出的算法会立即删除识别出的真实异常的数据点。我们通过使用合成和真实数据集的经验实验分析了改进算法的性能和某些参数的敏感性。实验结果表明，与原始iLOF算法及其改进相比，所提出的改进算法在更高的检测率和更低的误报率上取得了更好的性能。