## 4 BOA-GNG-Based Anomaly Detection of Streaming Data  
Anomaly detection methods learn a model from a reference set of regular (or normal) data and classify the unexpected data as irregular (or abnormal) [30]. However, if the reference data comes as a stream and its distribution is subject to change over time, the model trained over historical data may lose efficacy as the data distribution of the streaming data is changing. The proposed BOA-GNG can adapt to evolving data streams, and the representational topology structure is adaptively changing during the online anomaly detection of streaming data. In the detecting process, the distance-based method is used to estimate the anomaly state of input data, and the threshold \(T_{d}\) can be calculated as follows. \[T_{d}=\frac{1}{N_{C}}\sum_{(\omega_{i},\omega_{j})\in C}\left\|(\omega_{i}, \omega_{j})\right\| \tag{6}\]  
where \(N_{C}\) is the current number of edges in the BOA-GNG model, and \((\omega_{i},\omega_{j})\) is an edge connecting neurons. \(C\) is the set of edge-connecting neurons, \(\left\|\omega_{i},\omega_{j}\right\|\) is the Euclidean distance of \((\omega_{i},\omega_{j})\). Manually choosing a convenient value for the decision parameter \(T_{d}\) is hard because it not only depends on the dataset but also on the number of neurons in the model, which varies over time. Therefore, we heuristically set \(T_{d}\) equal to the expected distance between neighboring neurons in the model. In other words, \(T_{d}\) at any time is defined as the average length of edges at that time. Obviously, each neuron in the BOA-GNG model can be considered as the center of a hyper-sphere, and the model covers the space that represents regular data at any time. If a new instance \(x\) from the data streams comes in, and the distance between it and the winner neuron is larger than \(T_{d}\), it means that such data are not part of the existing topology of the model, and \(x\) is considered an anomaly. The anomaly judge rule is defined as follows. \[\left\|x-\omega_{s}\right\|_{s\in A}>T_{d} \tag{7}\]  
where \(A\) the set of all neurons, \(x\) is the current inputting data, \(\omega_{s}\) is the weight of the winning neuron \(s\), and \(\left\|x-\omega_{s}\right\|\) is the Euclidean distance between \(x\) and \(s\). \(T_{d}\) is calculated using Equation (6). As in Equation (7), the Euclidean distance of each \(x\) and its winner neuron is calculated for online anomaly detection. The whole process of the BOA-GNG can be described as the pseudocode in Algorithms 2 and 3, and the variants of BOA-GNG are shown in Table 2.  
```
1. Input: \(N_{m}\), \(N_{w}\), \(a_{max}\);
2. \(t\to 0\);
3. Initialize the network \(A\) with at least 2 neurons and \(c_{i}=0(i=1,2)\), \(C=\varnothing\);
4. For each new instance \(x\) from the data stream;
5. \(t\to t+1\);
6. Find the two neurons closest to \(x\) from \(A\), which are \(s\) and \(z\), by using the Euclidean distance: \(s=\text{argmin}_{n\in A}\|x-\omega_{n}\|\), \(z=\text{argmin}_{n\in A/\{s\}}\|x-\omega_{n}\|\);
7. Update the winning times of neuron \(s\): \(c_{s}=c_{s}+1\);
8. Increase the age of the edges associated with \(s\);
9. Calculate the learning rate \(\varepsilon_{1}\) and \(\varepsilon_{2}\) by Equation (4);
10. Update the weights of the winning neuron and the neurons connected to it: \(\omega_{s}=\omega_{s}+\varepsilon_{1}\times(x-\omega_{s}),\ \forall v\in n(s): \omega_{v}=\omega_{v}+\varepsilon_{2}\times(x-\omega_{v})\);
11. If \(s\) and \(z\) are connected by edges, reset the edge's age to 0;
12. Else link the \(s\) and \(z\) with an edge of age 0: \(c=c\cup\{(s,z)\}\)
13. Remove old edges with age \(>\ a_{max}\);
14. If the total number of neurons larger than \(N_{m}\): Delete the neurons, which become isolated and \(c<N_{w}\);
15. If \(\|x-\omega_{s}\|>N_{w}\), then create a new neuron \(r\) between \(s\) and \(x\), which: \(\omega_{r}=0.5\times(\omega_{s}+x)\)
```  
**Algorithm 2**The learning process of BOA-GNG  
```
1.