A Review of Anomaly Detection Techniques Based on Nearest Neighbor

摘要

The concept of nearest neighbor has been used in several anomaly techniques, which supposes normal data instances occur in dense neighbors and anomalies occur far from their closest neighbors. So the techniques require a distance or similarity measure defined between two data instances. By now, there are several variants of basic technique extended by researchers in three different ways. The first set is to modify the definition of the anomaly score. The second set is to select different distance or density measure for different data type. The third set is to reduce the computation complexity. In this paper we have attempted to provide an overview of the previous work, although it is limited.