# Efficacy Improvement of Anomaly Detection by Using Intelligence Sharing Scheme
## 3 Related Work and State-of-the-Art
### Outlier Ensemble Models
#### 3.1.1 Model Normalization
A similarly trivial normalization technique would be to scale \(\mathit{Sreg}\) to fit within the \([0,1]\) interval in the following way:  
\[S_{norm}(o)=\frac{S_{\mathit{reg}}\ (o)}{\mathit{max}\mathit{\mathit{\mathit{ \mathit{\mathit{\mathit{\mathit{\mathit{\mathit{\mathit{\mathit{\mathit{\mathit{ \mathit{\mathit{\mathit{\mathit{\mathit  
all. In our case, nearly half of the networks do not contain any anomalies so this makes the rank-only normalization unsuitable.  
Another option is to transform outlier scores into probability distributions. Two methods for achieving this goal are described in [29]. The first method assumes that the posterior probability of a sample being an outlier follows a logistic function in relation to its outlier score and learns the parameters of this function from the distribution of outlier scores. The second method models the outlier scores as a mixture of two distributions: exponential for the background and Gaussian for the outliers. Parameters of these distributions are learned and posterior probabilities are calculated using the Bayes' rule. In order to learn in an unsupervised manner, a generalized expectation maximization (EM) algorithm is used to jointly learn the distribution parameters and classifications of data points. Authors show modest improvements over the plain feature bagging in an ensemble model [28]. It favors extreme values of 0 and 1 in the resulting probabilities, which does not lend itself well to combination [30]. Moreover, it is not very stable due to the usage of the EM algorithm and the results can degenerate if there are only a few outliers in a sample, which is frequently the case in the network security field. This means the form of the EM algorithm is not applicable in our case.  
[PERSON] et al. [30] transforms outlier scores into probability values using a different approach. They assume that the outlier scores follow a chosen distribution to estimate its parameters and use its cumulative distribution function to arrive at the probability values. For example, for a normal distribution, an outlier score \(S\left(\cdot\right)\) is transformed into a normalized score \(Norm1\left(\cdot\right)\) as follows:  
\[Norm1(o)=max\left\{0,2.\ cdfgauss(S(o))-1\right\}\]  
where \(cdfx(. )\) is a cumulative distribution function of an estimated distribution \(x\). Scaling and maximum are used due to interest in a one-tailed probability value only; an average case is assigned the outlier score of zero. Note that the probability \(Norm1(\cdot)\) cannot be directly interpreted as a probability of the sample being an outlier; this is not needed since the goal is just making the values comparable. Instead of the Gaussian distribution, other distributions can be used in the same manner; the paper proposes also the use of uniform and gamma distributions. Although it is argued that the precise choice of a distribution is not very important, Gaussian scaling shows the best results in the majority of tests. In the last step, normalization without assuming a concrete probability distribution is discussed. Instead, the sample means can be normalized to zero and residuals to one by subtracting the sample mean \(\mu\) and dividing by sample standard deviation \(\sigma\)[35]. \[Norm_{2}(o)=\frac{S(o)-\ u}{\sigma}\]  
This is similar to the Gaussian normalization \(Norm1\) discussed above, but for the use of the \(cdfgauss\) function. However, the result is not guaranteed to lie in the interval [0, 1] and high values are not exponentially dampened by the cumulative distribution function that exponentially approaches one. After being normalized by one of the techniques described above, the ensemble model outputs must be combined to form a single value. In the next section, such model combination functions are described.