  In this paper, we implement an anomaly detection system using the
Dempster-Shafer method. Using two standard benchmark problems we show that by
combining multiple signals it is possible to achieve better results than by
using a single signal. We further show that by applying this approach to a
real-world email dataset the algorithm works for email worm detection.
Dempster-Shafer can be a promising method for anomaly detection problems with
multiple features (data sources), and two or more classes.
