Integrated learning method by exchanging local models

Detecting anomalous behavior from terabytes of collected record data has emerged as a crucial component for many systems for Data Mining System. Processing record data collected from various locations or providers cannot often be directly aggregated for anomaly analysis due to the proprietary nature of the data. This paper proposes a novel general framework for anomaly detection from distributed data sources that cannot be directly merged. In the proposed method, anomaly detection algorithm is first applied to data from individual provider and then their results are combined. We investigated ten semi-supervised anomaly detection algorithms, as well as four methods for combining anomaly detection results. Our experiments show that the proposed method is more suitable for the task of distributed anomaly detection than others.