# Unsupervised Feature Selection for Outlier Detection on Streaming Data to Enhance Network Security
## 4 Unsupervised Feature Selection for Streaming Outlier Detection
### Operation Modes
However, the latter is not the focus of this work since for domain specific applications features are assumed to be known beforehand. Since  
Figure 2: Conceptualization of module interaction for unsupervised FS for OD on SD (sequential approach). most of the state-of-the-art unsupervised OD algorithms are operating on a fixed set of features with a fixed cardinality, a windowed approach can be utilized if the subsequently applied online OD algorithm is able to dynamically change its model during runtime. Thus, it can replace the old feature subset with the newly proposed one after the current time window elapsed. Possible algorithms would be iForest_ASD, which rebuilds its forest after a certain condition is met, thus also allowing to rebuild it with a different feature subset, or LodaTwo Hist. and HS-Trees using windowing where models are replaced with the ones currently built and the ones that will be built can use the current feature subset. With respect to LodaTwo Hist, the old histograms built and classified with \(\mathcal{F}_{S(t-t)}\) will be replaced with the new histograms using \(\mathcal{F}_{S(t)}\), also allowing to change the cardinality (different top-\(\gamma\)-features). If this sequential operation limits the throughput, a parallel approach can be utilized where both modules UFSSOD and Unsupervised Online OD work in parallel. As depicted in Figure 3 the online OD algorithm for each \(t\) operates with the previously proposed subset \(\mathcal{F}_{S2}\), while the UFSSOD module continuously proposes a new \(\mathcal{F}_{S}\), which is stored within \(\mathcal{F}_{S1}\). The Unsupervised Online OD module can now decide whether it changes its feature subset for each \(t\) by using the one proposed by UFSSOD in \(t-1\) switching between \(\mathcal{F}_{S1}\) and \(\mathcal{F}_{S2}\) or switching subsets again in a windowed fashion. The latter seems more convenient if the setup must not truly work online since the OD algorithm can work with the full throughput using the static feature subset until its model gets replaced or updated with the new subset, which was generated within the current time window. Furthermore, it should be noted that ufssod_clustering with respect to Algorithm 2 must not necessarily be performed for each sample in order to preserve resources while operating in the windowed mode. Thus, continuously ufssod_scoring is performed but ufssod_clustering is only performed if the subsequent classifier demands a new feature subset. With respect to LodaTwo Hist, and Figure 3, the old histograms built and classified with \(\mathcal{F}_{S2}\) will be replaced with the new histograms switching to \(\mathcal{F}_{S1}\) when the window size is reached, whereas UFSSOD continuously updates \(\mathcal{F}_{S1}\) until switching. ```
Input: A sample \(\mathbf{x_{t}}\) Output: The scaled outlier score \(\hat{y}_{0}\) and the averaged feature scores \(\mathbf{\hat{s}}_{f}\)
1\(y_{0}\), \(\mathbf{s}_{f}\leftarrow\) Loda_cont.update_score(\(\mathbf{x_{t}}\))
2\(\mu_{t}\leftarrow\) outlier_score.moving_mean(\(y_{0}\))
3\(\sigma_{t}\leftarrow\) outlier_score.moving_sd(\(y_{0}\))
4\(\hat{y}_{0}\leftarrow\) argmax(0, erf(\(\frac{y_{0}-\mu_{t}}{\sigma_{t}\sqrt{2}}\)))
5\(\mathbf{\hat{s}}_{f}\leftarrow\) feature_scores.moving_mean(\(\mathbf{s}_{f}\)) return\(\hat{y}_{0}\),\(\mathbf{\hat{s}}_{f}\)
```  
**Algorithm 2** Scoring functionality of UFSSOD-ufssod_scoring().