# Unsupervised Feature Selection for Outlier Detection on Streaming Data to Enhance Network Security
## 4 Unsupervised Feature Selection for Streaming Outlier Detection
### Model for Scoring and Clustering Features  
In this section, details of the internal working of UFSSOD (Figure 1) with regard to the core modules, ufssod_scoring() and ufssod_clustering(), is provided. Motivated by the functionality of Loda to rank features according to their contribution, UFSSOD leverages an  
Figure 3: Conceptualization of module interaction for unsupervised FS for OD on SD (parallel approach). adapted version of \(\text{Loda}_{\text{Cont}}\). that continuously processes the feature scores for ranking and proposing the top-\(\gamma\)-features. Besides, it is able to provide outlier scores for each incoming \(\mathbf{x}_{t}\). It fulfills all the requirements of FS for SD and OD stated in Section 3.1. Also encouraged by IBFS, which exploits the training process of iForest for FS, we aimed to bring the nature of an online OD algorithm into this field as well but for the SD context. However, Loda seems more appropriate since it handles high-dimensional data more efficiently and is able to handle concept drifts. We see ourselves validated in our approach, since the evaluations of [14] prove that projection-based methods, as is the case with Loda, are advantageous in high dimensions with many irrelevant features, because the features relevant for OD are less likely to be selected by other methods that operate with \(\mathcal{F}\). Therefore, sorting out those irrelevant features from high-dimensional data will significantly aid other OD methods by increasing their performance. Furthermore, the author of Loda already showed the capability of the algorithm to identify meaningful features in his experiments. Our basis for \(\text{Loda}_{\text{Cont}}\). is the _Appendix: online histogram_ stated in [52]. However, it must be noted that both of its Algorithms 3 and 4 contain minor mistakes. In the former \(z_{max}\) is computed by the \(min\) instead of the correct \(max\) function and referring to the latter, the formula for the probability \(p(z)\) should depend on a weighted average of the bin counts. With the formula given, one obtains negative results in the case for negative \(z_{i}\) and \(z_{i+1}\). A corrected version has also been proposed by [56] such that for instance if \(z\) is closer to \(z_{i}\), \(p(z)\) gets weighted closer to \(p(z_{i})\) accordingly (Equation (5)). \[p(z)=\frac{(z_{i+1}-z)m_{i}+(z-z_{i})m_{i+1}}{M(z_{i+1}-z_{i})} \tag{5}\]  
```
Input: The averaged feature scores \(\bar{\mathbf{s}}_{f}\) and optional=(\(\gamma\), \(\gamma_{min}\), distance) Output: The set of indices of \(\mathcal{F}_{S}\) for \(\mathbf{x}_{t}\) to obtain \(\mathbf{x}_{t}^{*}\) if\(\gamma\) is setthen return\(\text{indices}\leftarrow\text{first }\gamma\) of \(\text{argsort}(\bar{\mathbf{s}}_{f}\), descending) if\(\gamma_{min}\) not setthen \(\gamma_{min}\leftarrow\sqrt{|\bar{\mathbf{s}}_{f}|}\)  result \(\leftarrow\) ckmeans_1d_dp(\(\bar{\mathbf{s}}_{f}\)) while\(\text{result}.|cluster_{1}|<\gamma_{min}\)do  k \(\leftarrow\text{result}.k_{opt}\) - 1  result \(\leftarrow\) ckmeans_1d_dp(\(\bar{\mathbf{s}}_{f}\), k) indices \(\leftarrow\text{result}.cluster_{1}\) ifdistance==truethen \(cr_{1}\leftarrow\mathcal{O}cluster_{1}/2\) \(cr_{2}\leftarrow\mathcal{O}cluster_{2}/2\) if\(i-1\) while\(cr_{i}+cr_{i+1}>\text{center\_distance}(cluster_{i},cluster_{i+1})\)do \(i\gets i+1\) \(cr_{i+1}\leftarrow\mathcal{O}cluster_{i+1}/2\)  indices \(\leftarrow\text{indices}\) + result.cluster\({}_{i+1}\) returninolices
```  
**Algorithm 3**Feature clustering of UFSSOD--ufssod_clustering(). The one-tailed two-sample \(t\) test has been proposed by the author of Loda, referring to Equation (4) in [52] to measure the statistic significance of each feature to its contribution of a sample's anomalousness.