hereby approve the attached thesis Incrementally Learning Rules for Anomaly Detection by

Committee Chair: Philip K. Chan, Ph.D. LERAD is an algorithm which learns rules that can be used for anomaly detection. However, because it is an offline algorithm, all training data has to be present before rules can be generated. We desire to create rules incrementally, as training data becomes available. Furthermore, accuracy should not suffer, remaining similar to offline LERAD. We present an algorithm that accomplishes this by carrying a small amount of data (namely, rules and sample sets) between days and pruning rules after the final day. Experimental results show that the difference in accuracy between incremental and offline LERAD is small enough to be statistically insignificant. Additionally, incremental LERAD achieves similar accuracy to offline while generating fewer rules, thereb

Proceedings of the Twenty-Third International Florida Artificial Intelligence Research Society Conference (FLAIRS 2010) Incrementally Learning Rules for Anomaly Detection

LERAD is a rule learning algorithm used for anomaly detection, with the requirement that all training data has to be present before it can be used. We desire to create rules incrementally, without needing to wait for all training data and without sacrificing accuracy. The algorithm presented accomplishes these goals by carrying a small amount of data between days and pruning rules after the final day. Experiments show that both goals were accomplished, achieving similar accuracy with fewer rules