# An Incremental Local Outlier Detection Method in the Data Stream
## 3 Results
### Outlier Detection  
Three real-life data sets with clear normal or outlier data information were used to verify the outlier detection performance of the proposed method. Based on each dataset, to compare the proposed CLOF method with the kLOF method, the receiver operating characteristic curves (ROC) (false positive rate (FPR) versus true/positive detection rate (DR)) were depicted with different \(k\) and sliding window widths \(n\) related to the outlier detection threshold \(t\). The area under the ROC curve (AUC) was calculated as outlier detection accuracy. Furthermore, for two classic data flows: KDD Cup 1999 and Shuttle datasets [30], the same descriptions in [31] were followed, and these two real-life data sets had enough data and could simulate a data stream. For the Labelled Wireless Sensor Network Data Repository (LWSNDR) [32], the size of consecutive outliers was cut down by equal interval sampling to reduce computational complexity. All experiments are implemented in MatLabR2013a with a Windows 7 system running on a Core i5-4590 CPU (3.3 GHz). KDD Cup 1999 dataset: 60,593 normal data and 228 outlier data (U2R attacks) with 36 attributes arranged randomly and normalized to [0, 1]. Shuttle dataset: 34,108 normal data (class 1) and 2644 outlier data (class 2, 3, 5, 6, 7) with nine attributes arranged randomly and normalized to [0, 1]. LWSNDR dataset: Two attributes, sampling one data at the interval of four original data from the multi-hop outdoor moetid1 dataset and the multi-hop indoor moetid3 dataset; then, the sampled moetid1 dataset had 1158 normal data and 14 outliers, and the sampled moetid3 dataset had 1147 normal data and 25 outliers. Firstly, different \(k\) were involved to investigate the effect of \(k\) on detection performance. As shown in Figure 10, ROC curves of kLOF and CLOF methods on the KDD Cup 1999 dataset were drawn with different \(k\) (changing from 2 to 20 with interval 2) related to \(t\) (changing from 50 to 1 with interval 1) and n (fixed to 50). After comparing the results in Figure 10a,b, it was obvious that both FPR and DR increased with a decrease in \(t\) and an increase in \(k\). For the same \(k\), \(t\), and FPR, the DR of the new CLOF method was much better than that of the kLOF method, which also led to a much higher AUC value than that of the kLOF method (see Figure 11a). The boxplots in Figure 11b show the changes of  
Figure 9: The further analysis of updating time on standard Gaussian distribution synthetic datasets: (**a–c**) the time at \(k=5\), \(D=2\), 6, 10, and \(N=100\), 500, 1000, 2000, 3000, 4000, and 5000 respectively; (**d–f**) the time at \(k=5\), \(D=2\), 6, 10 and \(N=100\), 500, 1000 respectively. kLOF and CLOF AUC values with different \(k\), and indicates that the CLOF method has better outlier detection performance and stability against \(k\) changing than the kNN-based method. Next, the parameter \(n\) was adopted to investigate its effect on detection performance. As shown in Figure 12, ROC curves of kLOF and CLOF methods on the KDD Cup 1999 dataset were drawn with different \(n\) (changing from 20 to 80 with interval 10) related to \(t\) (changing from 20 to 1 with interval 1) and \(k\) (fixed to 10). It was shown that both FPR and DR increased with the decrease of \(t\) and the increase of \(n\). For the same \(k\), \(t\), and FPR, the DR of the new CLOF method was also much better than that of the kLOF method, which led to a much higher AUC value (see Figure 13a). The boxplots in Figure 13b showed the dispersion of kLOF and CLOF AUC values, and indicates that the CLOF method had better outlier detection performance and stability against \(n\) changing than the kNN-based method. Figure 11: AUC values of kLOF and CLOF methods on KDD Cup 1999 dataset with different \(k\) related to \(t\) and the box plots for kLOF and CLOF: (**a**) the AUC values of kLOF and CLOF methods; (**b**) the box plots for kLOF and CLOF methods.