{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,13]],"date-time":"2026-02-13T06:58:59Z","timestamp":1770965939809,"version":"3.50.1"},"reference-count":24,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2011,7,1]],"date-time":"2011-07-01T00:00:00Z","timestamp":1309478400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Internet Technol."],"published-print":{"date-parts":[[2011,7]]},"abstract":"<jats:p>Anomaly detection involves identifying observations that deviate from the normal behavior of a system. One of the ways to achieve this is by identifying the phenomena that characterize \u201cnormal\u201d observations. Subsequently, based on the characteristics of data learned from the \u201cnormal\u201d observations, new observations are classified as being either \u201cnormal\u201d or not. Most state-of-the-art approaches, especially those which belong to the family of parameterized statistical schemes, work under the assumption that the underlying distributions of the observations are stationary. That is, they assume that the distributions that are learned during the training (or learning) phase, though unknown, are not time-varying. They further assume that the same distributions are relevant even as new observations are encountered. Although such a \u201cstationarity\u201d assumption is relevant for many applications, there are some anomaly detection problems where stationarity cannot be assumed. For example, in network monitoring, the patterns which are learned to represent normal behavior may change over time due to several factors such as network infrastructure expansion, new services, growth of user population, and so on. Similarly, in meteorology, identifying anomalous temperature patterns involves taking into account seasonal changes of normal observations. Detecting anomalies or outliers under these circumstances introduces several challenges. Indeed, the ability to adapt to changes in nonstationary environments is necessary so that anomalous observations can be identified even with changes in what would otherwise be classified as \u201cnormal\u201d behavior. In this article we propose to apply a family of weak estimators for anomaly detection in dynamic environments. In particular, we apply this theory to spam email detection. Our experimental results demonstrate that our proposal is both feasible and effective for the detection of such anomalous emails.<\/jats:p>","DOI":"10.1145\/1993083.1993086","type":"journal-article","created":{"date-parts":[[2011,8,3]],"date-time":"2011-08-03T16:16:13Z","timestamp":1312388173000},"page":"1-16","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":32,"title":["Anomaly Detection in Dynamic Systems Using Weak Estimators"],"prefix":"10.1145","volume":"11","author":[{"given":"Justin","family":"Zhan","sequence":"first","affiliation":[{"name":"North Carolina A&amp;T State University"}]},{"given":"B. John","family":"Oommen","sequence":"additional","affiliation":[{"name":"Carleton University"}]},{"given":"Johanna","family":"Crisostomo","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University"}]}],"member":"320","published-online":{"date-parts":[[2011,7]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/345508.345569"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/1541880.1541882"},{"key":"e_1_2_1_3_1","volume-title":"Proceedings of the Canadian Conference on Electrical and Computer Engineering (CCECE\u201906)","author":"Chopra M."},{"key":"e_1_2_1_4_1","unstructured":"Didion J. 2004. The Java WordNet Library. http:\/\/jwordnet.sourceforge.net\/. Didion J. 2004. The Java WordNet Library. http:\/\/jwordnet.sourceforge.net\/."},{"key":"e_1_2_1_5_1","unstructured":"Enron. 2006. Enron-spam dataset. http:\/\/www.aueb.gr\/ users\/ion\/data\/enron-spam\/. Enron . 2006. Enron-spam dataset. http:\/\/www.aueb.gr\/ users\/ion\/data\/enron-spam\/."},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2009.02.037"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2006.257"},{"key":"e_1_2_1_8_1","unstructured":"Kushner H. and Yin G. 2003. Stochastic Approximation and Recursive Algorithms and Applications 2nd Ed. Springer Berlin. Kushner H. and Yin G. 2003. Stochastic Approximation and Recursive Algorithms and Applications 2nd Ed. Springer Berlin."},{"key":"e_1_2_1_9_1","first-page":"9","article-title":"Controlling spam with spamassassin","volume":"153","author":"McGregor C.","year":"2007","journal-title":"Linux J."},{"key":"e_1_2_1_10_1","volume-title":"Proceedings of the 3rd Conference on Email and Anti-Spam (CEAS). 125--134","author":"Metsis V."},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/219717.219748"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1145\/1008992.1009034"},{"key":"e_1_2_1_13_1","unstructured":"Narendra K. and Thathachar M. 1989. Learning Automata. An Introduction. Prentice Hall Englewood Cliffs NJ. Narendra K. and Thathachar M. 1989. Learning Automata. An Introduction . Prentice Hall Englewood Cliffs NJ."},{"key":"e_1_2_1_14_1","unstructured":"Norris J. 1999. Markov Chains. Springer Berlin. Norris J. 1999. Markov Chains . Springer Berlin."},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/WIMOB.2006.1696374"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2005.09.007"},{"key":"e_1_2_1_17_1","unstructured":"Open NLP. 2008. Open NLP. http:\/\/opennlp.sourceforge.net. Open NLP . 2008. Open NLP. http:\/\/opennlp.sourceforge.net."},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSMCB.2006.872256"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/505282.505283"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10044-006-0045-7"},{"key":"e_1_2_1_21_1","unstructured":"Watkins C. 1989. Learning from delayed rewards. Ph.D. dissertation University of Cambridge UK. Watkins C. 1989. Learning from delayed rewards. Ph.D. dissertation University of Cambridge UK."},{"key":"e_1_2_1_22_1","volume-title":"Proceedings of the 14th International Conference on Machine Learning (ICML\u201997)","author":"Yang Y."},{"key":"e_1_2_1_23_1","volume-title":"Proceedings of the IEEE International Conference on Social Computing. IEEE","author":"Zhan J."},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/1039621.1039625"}],"container-title":["ACM Transactions on Internet Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1993083.1993086","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1993083.1993086","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T11:05:46Z","timestamp":1750244746000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1993083.1993086"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2011,7]]},"references-count":24,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2011,7]]}},"alternative-id":["10.1145\/1993083.1993086"],"URL":"https:\/\/doi.org\/10.1145\/1993083.1993086","relation":{},"ISSN":["1533-5399","1557-6051"],"issn-type":[{"value":"1533-5399","type":"print"},{"value":"1557-6051","type":"electronic"}],"subject":[],"published":{"date-parts":[[2011,7]]},"assertion":[{"value":"2001-01-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2011-01-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2011-07-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}