Hands-On Artificial Intelligence for Cybersecurity

Anomaly detection using the Gaussian distribution

The Gaussian distribution can be used to identify the outliers. Also, in this case, the anomaly element consists of the significant difference assumed by the outliers with respect to the rest of the data.

Obviously, the more the majority of the data is firmly concentrated around the mean value, µ, with a low variance, σ, the more significant the anomalous value assumed by the outlier is.

To use the Gaussian distribution in anomaly detection, we will have to perform the following steps:

1. Assume that the features of the training set are normally distributed (this can also be verified intuitively from the visual analysis of plotted data)
2. Estimate the µ and σ values, representative of the distribution ...