# Online Transition-Based Feature Generation for Anomaly Detection in Concurrent Data Streams

arXiv: https://arxiv.org/abs/2308.10893 · HTML: https://mlsanity.com/paper/2308.10893/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 5 of its 41 references that are in the map.
- First posted on arXiv 17 Aug 2023.

## Builds on (most cited first, 5 of 5)

- [Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection](https://mlsanity.com/paper/1802.09089/) (2018)
- [A Neural Network Architecture Combining Gated Recurrent Unit (GRU) and Support Vector Machine (SVM) for Intrusion Detection in Network Traffic Data](https://mlsanity.com/paper/1709.03082/) (2017)
- [Anomaly-based Intrusion Detection in Industrial Data with SVM and Random Forests](https://mlsanity.com/paper/1907.10374/) (2019)
- [Can process mining help in anomaly-based intrusion detection?](https://mlsanity.com/paper/2206.10379/) (2022)
- [Process Mining Algorithm for Online Intrusion Detection System](https://mlsanity.com/paper/2205.12064/) (2022)

## Abstract (arXiv)

In this paper, we introduce the transition-based feature generator (TFGen) technique, which reads general activity data with attributes and generates step-by-step generated data. The activity data may consist of network activity from packets, system calls from processes or classified activity from surveillance cameras. TFGen processes data online and will generate data with encoded historical data for each incoming activity with high computational efficiency. The input activities may concurrently originate from distinct traces or channels. The technique aims to address issues such as domain-independent applicability, the ability to discover global process structures, the encoding of time-series data, and online processing capability.