# Unsupervised Feature Selection for Outlier Detection on Streaming Data to Enhance Network Security
## 4 Unsupervised Feature Selection for Streaming Outlier Detection  
Existing work targeting FS for SD is mainly supervised and for the clustering, regression, or classification task on balanced data. FS for OD is either supervised or in the unsupervised case, where even fewer publications are available [4], not capable of coping with SD. Most of the latter require a dedicated training phase, thus making it impossible to function for SD in near real-time. However, there is limited work of FS for OD because it is challenging to define feature relevance given its unsupervised nature. Some work defines relevancy in the context of correlation between features, which is not really useful for detecting outliers since some features can be strongly relevant for OD but do not correlate to others. In addition, if there is no dedicated batch training phase, as is the case with SD, FS becomes a challenging task. To the best of the authors' knowledge, unsupervised FS for OD on SD is a completely new field. Thus, we propose _UFSSOD_ referring to Unsupervised Feature Selection for Streaming Outlier Detection that can be applied to improve off-the-shell online OD methods. However, the two following assumptions are made in order to deal with the problem that is mostly neglected in the literature due to either the supervised nature or the batch approach but is present with FS on SD within the context of OD. Discarding irrelevant or redundant features in time \(t\) due to unsupervised and streaming FS might contain outliers in time \(t+i\). Therefore we assume that (i) attacks are complex and indicators of attacks resulting in outliers might affect not only the one feature being identified as irrelevant or redundant, and is thus dropped, and (ii) attacks and their affecting outliers predominantly correspond to the same features. Particularly the second could be shown in [51] where some features have been more significant over multiple attack scenarios, e.g., _B.Packet Len Std_, _Flow Duration_, or _Flow IAT Std_. Most of the state-of-the-art work of FS within the context of OD does not discuss this dilemma since they are either working supervised and know which features contain the outliers or they are working in an offline setting, having training data available. Therefore they know all the data including those containing outliers beforehand. In the next two sections, we present the conceptualization alongside \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline
**Work** & **\begin{tabular}{c} **\#S** \\ **\#S** \\ \end{tabular} & **\begin{tabular}{c} **\#S** \\ **\#S** \\ \end{tabular} & **\begin{tabular}{c} **\#S** \\ \end{tabular}** & **\begin{tabular}{c} **\#S** \\ \end{tabular}** & **\begin{tabular}{c} **\#S** \\ \end{tabular}** & **\begin{tabular}{c} **\#S** \\ \end{tabular}** & **\begin{tabular}{c} **\#S** \\ \end{tabular}** & **\begin{tabular}{c} **\#S** \\ \end{tabular}** & **\begin{tabular}{c} **\#S** \\ \end{tabular}** & **\
\begin{tabular}{c} **\#S** \\ \end{tabular}** & **
\begin{tabular}{c} **\#S** \\ \end{tabular}** \\ \hline FS-CVI [39] & ✓ & ✗ & ✗ & ✗ & ✓ & ✓ & ✓ & – & ✗ \\ BAHSIC- & ✓ & ✗ & – & ✓ & ✓ & ✓ & ✗ & ✗ \\ AD [40] & ✓ & ✗ & + & ✗ & ✓ & ✓ & + & ✓ \\ MI-FS [41] & ✓ & ✗ & + & ✗ & ✓ & ✓ & + & ✓ \\ UPS\_CCI [44] & ✓ & ✗ & ✗ & ✗ & ✓ & ✓ & ++ & ✗ \\ CBRW- FS [42] & ✓ & ✗ & – & ✗ & ✓ & ✓ & + & ✓ \\ CUFS-DSFS [4] & ✓ & ✗ & – & ✗ & ✓ & ✓ & + & ✓ \\ CINFO [43] & ✓ & ✗ & + & ✓ & ✓ & ✓ & ++ & ✓ \\ ODEFS [45] & ✓ & ✗ & + & ✓ & ✓ & ✓ & ++ & ✓ \\ IBFS [46] & ✓ & ✗ & ++ & ✓ & ✓ & ✓ & ++ & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Comparison of existing FS work for OD with the requirements defined in Section 3.1 (✗ denote that the requirement is either fulfilled or not, ✗ denotes missing information to analyze the respective requirement, (++/+/ –) for R-FS04 and R-FS08 are denoting, as objectively as possible, how well the requirement is fulfilled, R-FS02 and R-FS03 are combined since R-FS03 is a phenomenon associated with R-FS02 and none of the existing work in this table fulfills both).