You are presented with multiple paper abstracts, alongside the associated literature review and chapter titles. Given the provided information, you are going to do a literature review. Please generate a coherent literature review that synthesizes the content, draws connections between different works, highlights major findings, and identifies any gaps in the existing research.

Literature Review Title: A Survey of Outlier Detection Methods in Network Anomaly Identification 
Chapter Title:  Density-based outlier detection approach 
1. Abstract of Cited Paper (BIB001):  For many KDD applications, such as detecting criminal activities in E-commerce, finding the rare instances or the outliers, can be more interesting than finding the common patterns. Existing work in outlier detection regards being an outlier as a binary property. In this paper, we contend that for many scenarios, it is more meaningful to assign to each object a degree of being an outlier. This degree is called the local outlier factor (LOF) of an object. It is local in that the degree depends on how isolated the object is with respect to the surrounding neighborhood. We give a detailed formal analysis showing that LOF enjoys many desirable properties. Using real-world datasets, we demonstrate that LOF can be used to find outliers which appear to be meaningful, but can otherwise not be identified with existing approaches. Finally, a careful performance evaluation of our algorithm confirms we show that our approach of finding local outliers can be practical. 
2. Abstract of Cited Paper (BIB002):  This paper proposed a new anomaly detection algorithm that can update normal profile of system usage pattern dynamically. The feature used to model systempsilas usage pattern was program behavior. When system usage pattern changed, new program behaviors will be inserted into old profiles by density-based incremental clustering. Compared to traditional re-clustering updating, it is much more efficiently. Experiments with 1998 DARPA BSM audit data, shows that normal profiles generated by our algorithm is less sensitive to noise data objects than profile generated by analogous incremental algorithm ADWICE. So our algorithm shows an incremental detection quality and a much lower false alarm rate.

Literature Review:
A density-based approach uses an outlier factor as a measurement of being an outlier. In the LOF BIB002 algorithm, a local outlier factor (LOF) is used as a measurement for finding a sample as outlier. This local outlier factor is computed from the sample's nearest neighbour objects rather than from the entire set of data as a whole. LOF is the mean value of the ratio of the density distribution estimate in the neighbourhood of the object analysed to the distribution densities of its neighbours. LOF is computed using Equation 2. Another density-based anomaly detection method is found in BIB003 . An important advantage of this method is its capability to update normal profile of system usage pattern dynamically. It models the system usage pattern based on features of program behavior. When system usage pattern changes, new program behaviours are inserted into old profiles by density-based incremental clustering. It uses DBSCAN BIB001 to generate the initial clusters for normal program behavior profiles. The profiles are updated by modifying DBSCAN's clusters using incremental clustering. This method has incremental detection quality and a much lower false alarm rate.