Anomaly, novelty, one-class classification: A short introduction

In data analysis and decision making we need frequently to judge whether the observed data items are normal or abnormal. This happens in banking, credit card use, diagnosing a patients health state, fault detection in an engine or device like an off-shore oil platform or gearbox in an airplane motor. Sometimes the normal cases are boring and only the abnormal cases are of interest (anomaly hunting). In practice, it happens quite frequently that the normal state has a good representation, however the abnormal cases are rare and the abnormal class is ill-defined - then we have to judge on the abnormality using information from the normal class only. The problem is named `one-class classification´ (OCC). The paper gives a survey of methods for performing the OCC. There is also an example: how to detect a masquerader (non-legitimate user) in a computer system - when observing a sequence of commands several thousands long.