Conditional Anomaly Detection

作者：Xiuyao Song, Mingxi Wu, Christopher Jermaine, Sanjay Ranka · 发表于：IEEE Transactions on Knowledge and Data Engineering · 年份：2007 · DOI：10.1109/tkde.2007.1009 · 被引用次数：371 · 研究领域：Anomaly Detection Techniques and Applications、Network Security and Intrusion Detection、Data-Driven Disease Surveillance

When anomaly detection software is used as a data analysis tool, finding the hardest-to-detect anomalies is not the most critical task. Rather, it is often more important to make sure that those anomalies that are reported to the user are in fact interesting. If too many unremarkable data points are returned to the user labeled as candidate anomalies, the software can soon fall into disuse. One way to ensure that returned anomalies are useful is to make use of domain knowledge provided by the user. Often, the data in question includes a set of environmental attributes whose values a user would never consider to be directly indicative of an anomaly. However, such attributes cannot be ignored because they have a direct effect on the expected distribution of the result attributes whose values can indicate an anomalous observation. This paper describes a general purpose method called conditional anomaly detection for taking such differences among attributes into account, and proposes three different expectation-maximization algorithms for learning the model that is used in conditional anomaly detection. Experiments with more than 13 different data sets compare our algorithms with several other more standard methods for outlier or anomaly detection