The second approach uses the pattern library in an inverse fashion, meaning that the library encodes only the positive patterns, which are marked with green plus signs in the following diagram. When an observed behavior (the blue circle) cannot be matched against the library, it is considered anomalous:
This approach requires us to model only what we have seen in the past, that is, normal patterns. If we return to the doctor example, the main reason that we visited the doctor in the first place was because we did not feel well. Our perceived state of feelings (for example, a headache and sore skin) did not match ...
