Figure 1.

The specialized network anomaly detection (SNAD) framework. This figure depicts the architecture of SNAD. It consists of two components: 1) Similarity Measurement (SNAD-SM) and 2) Anomaly Evaluation (SNAD-AE). The SNAD-SM component constructs local access networks and measures the similarity of the users in such networks. The SNAD-AE component assesses the extent to which suppression of a user from a local access network changes its similarity.