{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,19]],"date-time":"2026-01-19T11:17:30Z","timestamp":1768821450228,"version":"3.49.0"},"reference-count":48,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2007,3,24]],"date-time":"2007-03-24T00:00:00Z","timestamp":1174694400000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Knowl Inf Syst"],"published-print":{"date-parts":[[2008,3]]},"DOI":"10.1007\/s10115-007-0072-8","type":"journal-article","created":{"date-parts":[[2007,3,23]],"date-time":"2007-03-23T10:24:48Z","timestamp":1174645488000},"page":"377-392","source":"Crossref","is-referenced-by-count":10,"title":["The importance of generalizability for anomaly detection"],"prefix":"10.1007","volume":"14","author":[{"given":"Gilbert L.","family":"Peterson","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Brent T.","family":"McBride","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2007,3,24]]},"reference":[{"key":"72_CR1","doi-asserted-by":"crossref","unstructured":"Avcibas I, Memon N, Sankur B (2002) Image steganalysis with binary similarity measures. In: International conference on image processing, Rochester, NY","DOI":"10.1109\/ICIP.2002.1039053"},{"key":"72_CR2","doi-asserted-by":"crossref","first-page":"469","DOI":"10.1145\/235815.235821","volume":"22","author":"CB Barber","year":"1997","unstructured":"Barber CB, Dobkin DP, Huhdanpaa HT (1997) The quickhull algorithm for convex hulls. ACM Trans Math Softw 22:469\u2013483","journal-title":"ACM Trans Math Softw"},{"key":"72_CR3","unstructured":"Barber CB, Huhdanpaa HT (2002) Qhull, Version 2002.1. 283k. Computer Software. Available at: http:\/\/www.thesa.com\/software\/qhull\/"},{"key":"72_CR4","doi-asserted-by":"crossref","unstructured":"Barron AR (1991) Approximation and estimation bounds for artificial neural networks. In: Proceedings of the fourth annual workshop on computational learning theory, Morgan Kaufmann, Palo Alto, CA, pp 243\u2013249","DOI":"10.1016\/B978-1-55860-213-7.50025-0"},{"key":"72_CR5","unstructured":"Baum EB, Haussler D (1988) What size net gives valid generalization?. In: Proceedings of neural information processing systems, New York, pp 81\u201390"},{"key":"72_CR6","unstructured":"Blake CL, Merz CJ (1998) UCI repository of machine learning databases. University of California, Department of Information and Computer Science, Irvine, CA. Available at: http:\/\/www.ics.uci.edu\/~mlearn\/MLRepository.html"},{"key":"72_CR7","doi-asserted-by":"crossref","unstructured":"Brotherton T, Johnson T (2001) Anomaly detection for advanced military aircraft using neural networks. In: IEEE Aerospace Conference, Big Sky, MT","DOI":"10.1109\/AERO.2001.931329"},{"key":"72_CR8","doi-asserted-by":"crossref","unstructured":"Chang CI, Chiang SS (2002) Anomaly detection and classificiation for hyperspectral imagery. IEEE Trans Geosci Remote Sens 40(6):1314\u20131325","DOI":"10.1109\/TGRS.2002.800280"},{"issue":"1","key":"72_CR9","doi-asserted-by":"crossref","first-page":"45","DOI":"10.1016\/S0167-4048(03)00112-3","volume":"22","author":"SB Cho","year":"2003","unstructured":"Cho SB, Park HJ (2003) Efficient anomaly detection by modeling privilege flows using hidden Markov model. Comput Secur 22(1):45\u201355","journal-title":"Comput Secur"},{"key":"72_CR10","doi-asserted-by":"crossref","unstructured":"Cohen WW (1988) Generalizing number and learning from multiple examples in explanation based learning. Mach Learn 256\u2013269","DOI":"10.1016\/B978-0-934613-64-4.50032-3"},{"key":"72_CR11","volume-title":"Regular polytopes","author":"HSM Coxeter","year":"1973","unstructured":"Coxeter HSM (1973) Regular polytopes, 3rd ed. Dover, New York","edition":"3"},{"key":"72_CR12","doi-asserted-by":"crossref","unstructured":"Dasgupta D, Gonzales F (2002) An immunity-based technique to characterize intrusions in computer networks. IEEE Trans Evol Comput 6(3):281\u2013291","DOI":"10.1109\/TEVC.2002.1011541"},{"key":"72_CR13","unstructured":"Delany SJ, Cunningham P (2006) ECUE: A spam filter that uses machine learning to track concept drift. Technical Report TCD-CS-2006-05. Trinity College Dublin, Computer Science Department, Ireland"},{"key":"72_CR14","doi-asserted-by":"crossref","unstructured":"Denning DE (1987) An intrusion detection model. IEEE Trans Softw Eng SE-13:222\u2013232","DOI":"10.1109\/TSE.1987.232894"},{"key":"72_CR15","unstructured":"Drummond C, Holte R (2005) Learning to live with false alarms. In: KDD-2005 workshop on data mining methods for anomaly detection, 21\u201325 August, Chicago, IL, pp 21\u201324"},{"key":"72_CR16","volume-title":"Pattern classification","author":"RO Duda","year":"2001","unstructured":"Duda RO, Hart PE, Stork DG (2001) Pattern classification, 2nd edn. Wiley, New York","edition":"2"},{"key":"72_CR17","unstructured":"Eskin, E (2000) Anomaly detection over noisy data using learned probability distributions. In: Proceedings of the international conference on machine learning, Stanford University, Stanford, CA"},{"key":"72_CR18","unstructured":"Eskin E, Arnold A, Prerau M, Portnoy L, Stolfo S (2002) A geometric framework for unsupervised anomaly detection: detecting intrusions in unlabeled data. Appl Data Min Comp Secur 82\u2013102"},{"key":"72_CR19","doi-asserted-by":"crossref","unstructured":"Faird H, Lyu S (2003) Higher-order wavelet statistics and their application to digital forensics. In: IEEE workshop on statistical analysis in computer vision, Madison, WI","DOI":"10.1109\/CVPRW.2003.10093"},{"issue":"5","key":"72_CR20","doi-asserted-by":"crossref","first-page":"507","DOI":"10.1007\/s10115-003-0132-7","volume":"6","author":"W Fan","year":"2004","unstructured":"Fan W, Miller M, Stolfo S, Lee W, Chan P (2004) Using artificial anomalies to detect unknown and known network intrusions. Knowl Inf Syst 6(5):507\u2013527","journal-title":"Knowl Inf Syst"},{"key":"72_CR21","doi-asserted-by":"crossref","unstructured":"Fridrich J, Goljan M, Du R (2001) Detecting LSB steganography in color and gray-scale images. In: IEEE Multimedia Magazine, Special Issue on Security, October 2001, pp 22\u201328","DOI":"10.1109\/93.959097"},{"key":"72_CR22","doi-asserted-by":"crossref","unstructured":"Gupta A, Sekar R (2003) An approach for detecting self-propagating email using anomaly detection. In: Recent advances in intrusion detection: 6th international symposium, RAID 2003, Lecture notes in computer science, Pittsburgh, PA, 8\u201310 September","DOI":"10.1007\/978-3-540-45248-5_4"},{"key":"72_CR23","unstructured":"Haines J, Lippmann R, Fried D, Tran E, Boswell S, Zissman M (1999) DARPA intrusion detection system evaluation: design and procedures. MIT Lincoln Laboratory Technical Report, Cambridge"},{"key":"72_CR24","unstructured":"Hamerly G, Elkan C (2003) Learning the k in k-means. Adv Neural Inf Process Syst 15: 289\u2013296 (NIPS)"},{"key":"72_CR25","unstructured":"Inous H, Forrest S (2002) Anomaly intrusion detection in dynamic execution environments. In: New Security Paradigms Workshops, pp 52\u201360"},{"key":"72_CR26","unstructured":"Jackson J (2003) Targeting covert messages: A unique approach for detecting novel steganography. Masters Thesis, Air Force Institute of Technology, Wright Patterson AFB, OH"},{"key":"72_CR27","doi-asserted-by":"crossref","unstructured":"Kharrazi M, Sencar T, Memon N (2005) Benchmarking steganographic and steganalysis techniques. In: IEEE SPIE, San Jose, CA, 16\u201320 January","DOI":"10.1117\/12.587375"},{"key":"72_CR28","unstructured":"Kubler TL (2006) Ant clustering with locally weighting ant perception and diversified memory. Masters Thesis, Air Force Institute of Technology, Wright Patterson AFB, OH"},{"key":"72_CR29","unstructured":"Lambert T (1998) Convex hull algorithms applet, UNSW School of Computer Science and Engineering. Availabe at: http:\/\/www.cse.unsw.edu.au\/~lambert\/java\/3d\/hull.html"},{"issue":"1","key":"72_CR30","doi-asserted-by":"crossref","first-page":"73","DOI":"10.1023\/A:1021830128811","volume":"51","author":"T Lane","year":"2003","unstructured":"Lane T, Brodley C (2003) An empirical study of two approaches to sequence learning for anomaly detection. Mach Learn 51(1):73\u2013107","journal-title":"Mach Learn"},{"key":"72_CR31","unstructured":"Lazarevic A, Ertoz L, Ozgur A, Srivastava J, Kumar V (2003) Evaluation of outlier detection schemes for detecting network intrusions. In: Proceedings of the third SIAM international conference on data mining, San Francisco, CA"},{"key":"72_CR32","doi-asserted-by":"crossref","unstructured":"Lyu S, Farid H (2002) Detecting hidden messages using higher-order statistics and support vector machines. In: Information hiding: 5th international workshop, IH 2002, Noordwijkerhout, The Netherlands, 7\u20139 October","DOI":"10.1007\/3-540-36415-3_22"},{"key":"72_CR33","doi-asserted-by":"crossref","unstructured":"Lyu S, Farid H (2004) Steganalysis using color wavelet statistics and one-class support vector machines. In: SPIE symposium on electronic Imaging, San Jose, CA","DOI":"10.1117\/12.526012"},{"key":"72_CR34","unstructured":"MacQueen J (1967) Some methods for classification and analysis of multivariate observations. In: Proceedings of the 5th Berkeley symposium on mathematical statistics and probability, pp 281\u2013297"},{"key":"72_CR35","doi-asserted-by":"crossref","unstructured":"Mahoney M, Chan P (2003) An analysis of the 1999 DARPA\/Lincoln laboratory evaluation data for network anomaly detection. In: Proceedings of the recent advances in intrusion detection, RAID 2003. Pittsburgh, PA, 8\u201310 September","DOI":"10.1007\/978-3-540-45248-5_13"},{"key":"72_CR36","unstructured":"McBride B, Peterson G, (2004) Blind data classification using hyper-dimensional convex polytopes. In: Proceedings of the 17th international FLAIRS conference, Miami, FL, pp 520\u2013526"},{"key":"72_CR37","doi-asserted-by":"crossref","first-page":"50","DOI":"10.1016\/j.diin.2005.01.003","volume":"2","author":"BT McBride","year":"2005","unstructured":"McBride BT, Peterson GL, Gustafson SC (2005) A new blind method for detecting novel steganography. Digit Invest 2:50\u201370","journal-title":"Digit Invest"},{"key":"72_CR38","unstructured":"Melnik O (2002) Decision region connectivity analysis: A method for analyzing high-dimensional classifiers. Mach Learn 48:(1\/2\/3)"},{"key":"72_CR39","doi-asserted-by":"crossref","first-page":"203","DOI":"10.1016\/0004-3702(82)90040-6","volume":"18","author":"TM Mitchell","year":"1982","unstructured":"Mitchell TM (1982) Generalization as search. Artif Intell 18:203\u2013226","journal-title":"Artif Intell"},{"issue":"1","key":"72_CR40","first-page":"47","volume":"1","author":"TM Mitchell","year":"1986","unstructured":"Mitchell TM, Keller RM, Kedar-Cabelli ST (1986) Explanation-based generalization: A unifying view. Mach Learn 1(1):47\u201380","journal-title":"Mach Learn"},{"key":"72_CR41","unstructured":"Nguyen H, Melnik O, Nissim K (2003) Explaining high-dimensional data. unpublished presentation. Available at: http:\/\/dimax.rutgers.edu\/~hnguyen\/GOAL.ppt. Accessed 4 Aug 2003"},{"key":"72_CR42","doi-asserted-by":"crossref","DOI":"10.1017\/CBO9780511804120","volume-title":"Computation geometry in C","author":"K O\u2019Rourke","year":"1998","unstructured":"O\u2019Rourke K (1998) Computation geometry in C, 2nd edn. Cambridge University Press, Cambridge, UK","edition":"2"},{"key":"72_CR43","unstructured":"Pelleg D, Moore A (2000) X-means: extending K-means with efficient estimation of the number of clusters. In: Proceedings of the 17th international conference on machine learning (ICML), pp 727\u2013734"},{"key":"72_CR44","unstructured":"Peterson GL, Mills RF, McBride BT, Alred WC (2005) A comparison of generalizability for anomaly detection. In: KDD-2005 workshop on data mining methods for anomaly detection, 21\u201325 August, Chicago, IL, pp 53\u201357"},{"key":"72_CR45","unstructured":"Thrun S (1995) Lifelong learning: a case study. Technical Report CMU-CS-95-208, Carnegie Mellon University, Computer Science Department, Pittsburgh, PA"},{"issue":"1","key":"72_CR46","doi-asserted-by":"crossref","first-page":"175","DOI":"10.1109\/69.755626","volume":"11","author":"BW Wah","year":"1999","unstructured":"Wah BW (1999) Generalization and generalizability measures. IEEE Trans Knowl Data Eng 11(1):175\u2013186","journal-title":"IEEE Trans Knowl Data Eng"},{"issue":"1","key":"72_CR47","first-page":"68","volume":"23","author":"G Widmer","year":"1996","unstructured":"Widmer G, Kubat M (1996) Learning in the presence of concept drift and hidden contexts. Mach Learn 23(1):68\u2013101","journal-title":"Mach Learn"},{"key":"72_CR48","unstructured":"Wong C, Chen C, Yeh S (2000) K-means-based fuzzy classifier design. In: The ninth IEEE international conference on fuzzy systems, vol. 1, pp 48\u201352"}],"container-title":["Knowledge and Information Systems"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10115-007-0072-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s10115-007-0072-8\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10115-007-0072-8","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,5,29]],"date-time":"2019-05-29T10:10:16Z","timestamp":1559124616000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s10115-007-0072-8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2007,3,24]]},"references-count":48,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2008,3]]}},"alternative-id":["72"],"URL":"https:\/\/doi.org\/10.1007\/s10115-007-0072-8","relation":{},"ISSN":["0219-1377","0219-3116"],"issn-type":[{"value":"0219-1377","type":"print"},{"value":"0219-3116","type":"electronic"}],"subject":[],"published":{"date-parts":[[2007,3,24]]}}}