# A Novel Anomaly Behavior Detection Scheme for Mobile Ad Hoc Networks
## 3 Related Work  
In MANETs, the outliers can be introduced from several sources, such as hardware/software [19], environment [20], deviance from consistent system arrangement for security conciliation [21], or uncertainty of data [22; 23]. These outliers can arise at any level, such as a node, data, or network level [24]; they may be statistical/knowledge-based outliers [25], Markov-/hidden-Markov-based outliers [26], density-based outliers [27; 28; 29], distance-based outliers [30; 31; 32], or global/semiglobal/distributed outliers [33]. In statistical/knowledge-based outliers, the common methodology to solve the outlier detection problem is built on the construction of probabilistic data models utilizing mathematical methods of applied statistics and probability theory. The outlier detection system, based on a statistical approach, studies the behavior of users through measuring techniques. The system in its running state detects outliers constantly through methods based on regression analysis [25]. A Markov chain is a random process of discrete state space and is described as \"the next state is dependent only on the current state and does not depend on how the system has been reached in the current state\". Generally, a normal profile using the Markov chain is constructed that captures the temporal dependency among the network activities [26]. The density-based approach was first proposed by [PERSON] et al. [27]. Such methods evaluate the various density-based distributions of the input keys, and find different outliers as the ones that exist in low-density regions [28]. Such outlier detection methods also evaluate different instances of data at various specified zones; these instances can be determined for distance-based methods of an outlier at a dense zone [29]. Such distance-based detections are calculated for distances for object data with geometric interpretations. For each outlier factor, a function F is specified as F: x \(\rightarrow\) R, where an outlier can be given as object x from different objects R. Various common definitions associated with distance-based outlier detection are provided in [30; 31; 32]. As stated, the outliers are introduced in MANETs through various sources and at different levels. Various researchers in the field have faced the challenge of outlier detection: [PERSON] et al. [34] combined misuse detection and anomaly detection to exploit the advantages of both techniques; They used the dynamic programming approach of the hidden Markov model (HMM) to share information history and scheduling in order to save on costs related to security requirements. The simulation results present the efficiency of the proposed scheme. [PERSON] [35] proposed a C4.5 clustering-based anomaly detection method; the outcomes show that the proposed method efficiently detects anomalies where the false alarm ratio (FAR) is low, making sure that the detected anomalies are real attacks. [PERSON] et al. [36] proposed a mathematical-model-based adaptive trust threshold (ATT) strategy for isolating misbehaving nodes in MANETs; The findings show that the ATT is robust in comparison with an existing approach in terms of convergence to the same trust threshold value computed at all neighbor nodes for malicious nodes, and is also energy efficient. [PERSON] et al. [37] proposed a method to improve security by an anomaly-based intrusion detection process, and used a zone-based, ad hoc, on-demand distance vector routing protocol to find the shortest path; this method comprises feature selection for anomalous IDs, and identifies new attacks by using decision rules from the database. [PERSON] et al. [38] used reactive protocols for routing traffic in MANETs, and analyzed anomalous activities to detect outliers that were then matched with ground data; the findings in their study show that a rapid rise in traffic pointed to an anomaly; this is useful for resource and path allocation, as well as fault avoidance. [PERSON] et al.