Using Median as a Threshold in Determining Anomaly in Back-End Authentication

Abstract

In anomaly detection, as threshold, we typically use the 1.5 times or more of the interquartile range (IQR) in the parametric statistical method or 3σ in normal distribution. However, this criterion is not suitable for our application domain. Because the threshold value is so high that the IQR or 3σ is not secure. Therefore, we consider using median value as a threshold. Using the median value is more secure than using the IQR or 3σ as the number is smaller. In this paper, we first introduce our application domain and then verify that using the median value is more suitable in our application domain. In addition, we conclude that, depending on the situation, other measurements such as σ, 2σ, mean, and mode can be suitable criteria.