Distributed anomaly detection by model sharing

We present a novel general framework for distributed anomaly detection. In the framework, normal behavior is first learned from data from individual data sites using standard anomaly detection algorithms and then these models are combined when predicting anomalies from a new data set. We have investigated seven semi-supervised anomaly detection algorithms for learning normal behavior, as well as proposed method for combining anomaly detection models. Experiments have shown that our proposed combining technique may achieve comparable or even slightly better prediction performance than the anomaly detection models built on the data sets merged from distributed sites.