# An Intuitionistic Fuzzy-Rough Set-Based Classification for Anomaly Detection
## 1 Introduction  
Anomaly detection (AD) can be termed as the detection of the patterns that deviate from the expected normal behavior [1]. Anomaly detection is essential when such abnormality in the datasets can provide sufficient system information [2]. An anomaly may be malicious activities, instrumentation errors, human errors, etc. It is an emerging research area with applications in fields such as cybersecurity, medicine, intrusion detections, financial fraud, etc. With the advancement of computers and networks and their extensive uses, organizations are becoming vulnerable to malicious activities. Although the existing defense mechanism can provide protection up to a reasonable extent, the malicious attackers are becoming more sophisticated in intruding across the networks. In the case of internal attack, it might be interesting and challenging to identify the anomalies. The detection of anomaly from network data has been accepted as one of the most promising research areas of information security. Intrusion detection systems (IDSs) [3] are security devices for shielding networks or systems from unauthorized activity that could endanger accessibility, privacy, or integrity. Anomaly-detection-based and signature-recognition-based techniques are the two main categories of IDSs. By monitoring the systems and categorizing the actions as normal or anomalous, the former [4] is utilized to find network and computer misuse or intrusions. Anomaly-based IDS is the name given to the ensuing system [3, 4]. However, a signature-recognition-based intrusion detection technique [5] uses a database of knownattack signatures and raises an alarm whenever network traffic matches any signature. Usually, a computer and associated network can easily use an anomaly-based IDS as a risk mitigation technique. Several anomaly detection approaches were developed in the previous decade [6; 7; 8; 9; 10; 11]. The classification-based approach is one such approach. The classification [12] is a data processing tool to classify the items into predefined classes, and it has been applied in several areas such as pattern recognition, anomaly detection, prediction, machine vision, etc. [13; 14; 15; 16]. An anomaly detection algorithm using neighborhood rough set classification for dataset with mixed attributes was proposed in [13]. In [14], the authors proposed a decision-tree-based approach for the detection of anomaly in the results of computer assessment to improve the quality of educational management. In [15], the authors proposed a Bayesian-network-based anomaly detection method. In [16], the authors developed a single deep RBF network, used to predict control actions and to detect hostile cyber physical system attacks. In [17], the authors presented an anomaly detection method using a rough-set-based attribute reduction. In [18], the authors introduced an anomalous event identification approach on video surveillance applications. In [19], the authors introduced a neural-network-based semi-supervised approach for efficient anomaly detection. A problem similar to classification approach is also addressed using the clustering approach [20; 21; 22; 23; 24]. In [25], the authors proposed a complex method for detecting anomaly from real-time data using recurrence and fractal analysis. In [26], the authors made a detailed comparative analysis of five different time series models of anomaly detection. In [27], an ensemble learning model was applied to investigate and forecast outliers of the enormous system logs. In [28], the authors suggested a strategy for anomaly detection that permits the use of state-of-the-art feature selection techniques for idea representation of meta-features. A new outline focusing on data-technology-based real-time AD was proposed in [29], which uses a streaming sliding window factor coset clustering algorithm. In [30], the authors proposed a mixed clustering algorithm (MCAD) for detecting anomaly in real-time data.