An density-based apparatus, computer program, and method are provided for reclassifying test data points as not being an anomaly. One or more test data points are received that are each classified as an anomaly. In connection with each of the one or more test data points, a density is determined for a plurality of known data points that are each known to not be an anomaly. Further, at least one of the one or more test data points is reclassified as not being an anomaly, based on the determination.
Please help me write a proper abstract based on the patent claims. CLAIM: 1. A computer readable media comprising computer executable instructions stored on a non-transitory computer readable medium that when executed by one or more processors prompt the one or more processors to: classify one or more test data points as an anomaly, utilizing a one-class support vector machine (OCSVM); in connection with each of the one or more test data points classified as an anomaly, determine a density of a plurality of known data points that are each known to not be an anomaly; and reclassify at least one of the one or more test data points as not being an anomaly, based on the determination to reduce a number of false positives. 2. The computer readable media of claim 1, wherein the computer instructions prompt the one or more processors to classify the one or more test data points as an anomaly, by: grouping a plurality of the test data points into a plurality of groups based on one or more parameters, and identifying at least one frontier for each group of the plurality of the test data points. 3. The computer readable media of claim 2, wherein the computer instructions prompt the one or more processors to classify the one or more test data points as an anomaly, by further: determining whether the one or more test data points are outside a corresponding frontier. 4. The computer readable media of claim 3, wherein the computer instructions prompt the one or more processors to classify the one or more test data points as an anomaly, by further: classifying the one or more test data points as an anomaly if the one or more test data points are outside the corresponding frontier. 5. The computer readable media of claim 1, wherein the computer instructions prompt the one or more processors to classify the one or more test data points as an anomaly, utilizing a K-means clustering algorithm. 6. The computer readable media of claim 1, wherein the computer instructions prompt the one or more processors to reclassify the at least one test data point as not being an anomaly, if the density determined in connection with the at least one test data point exceeds a configurable threshold. 7. The computer readable media of claim 1, wherein the one or more test data points include a plurality of the test data points. 8. The computer readable media of claim 7, wherein the computer instructions prompt the one or more processors to determine the density for each of the plurality of the test data points. 9. The computer readable media of claim 8, wherein the computer instructions prompt the one or more processors to generate density information corresponding with each of the plurality of the test data points. 10. The computer readable media of claim 9, wherein the computer instructions prompt the one or more processors to rank the plurality of the test data points, based on the density information. 11. The computer readable media of claim 10, wherein the computer instructions prompt the one or more processors to allocate resources, based on the ranking. 12. The computer readable media of claim 1, wherein the one or more test data points reflect security event occurrences. 13. A method, comprising: classifying one or more test data points as an anomaly; in connection with each of the one or more test data points classified as an anomaly, determining, utilizing at least one processor, a density of a plurality of known data points that are each known to not be an anomaly; and reclassifying, utilizing the at least one processor, at least one of the one or more test data points as not being an anomaly, based on the determination, for outputting a result thereof via at least one output device in communication with the at least one processor to reduce a number of false positives. 14. The method claim 13, wherein the at least one test data point is reclassified as not being an anomaly, if the density determined in connection with the at least one test data point exceeds a configurable threshold. 15. The method claim 13, wherein the determination of the density is performed for each of the plurality of the test data points, and further comprising: ranking the plurality of the test data points, based on density information corresponding with each of the plurality of the test data points. 16. The method of claim 15, and further comprising: allocating resources, based on the ranking. 17. An apparatus, comprising: an interface configured to receive one or more test data points that are each classified as an anomaly; a memory including computer executable instructions; and at least one processor in communication with the interface and the memory, the at least one processor, in response to an execution of the computer executable instructions, being prompted to: identify one or more test data points as an anomaly; in connection with one or more test data points that are each classified as an anomaly, determine a density of a plurality of known data points that are each known to not be an anomaly; and reclassify at least one of the one or more test data points as not being an anomaly, based on the determination to reduce a number of false positives. 18. The apparatus of claim 17, wherein the apparatus is configured such that the one or more test data points include a plurality of the test data points, the determination of the density is performed for each of the plurality of the test data points, and the determination of the density results in density information corresponding with each of the plurality of the test data points. 19. The apparatus of claim 18, wherein the apparatus is configured to rank the plurality of the test data points, based on the density information. 20. The apparatus of claim 19, wherein the apparatus is configured to allocate resources, based on the ranking. 21. The apparatus of claim 20, wherein the apparatus is configured such that the at least one test data point is reclassified as not being an anomaly, if the density determined in connection with the at least one test data point exceeds a configurable threshold.