Efficient NP Tests for Anomaly Detection Over Birth-Death Type DTMCs

Neyshabouri

IEEE Trans. Signal Process.

et al. 2019

We introduce an online outlier detection algorithm to detect outliers in a sequentially observed data stream. For this purpose, we use a two-stage filtering and hedging approach. In the first stage, we construct a multimodal probability density function to model the normal samples. In the second stage, given a new observation, we label it as an anomaly if the value of aforementioned density function is below a specified threshold at the newly observed point. In order to construct our multimodal density function, we use an incremental decision tree to construct a set of subspaces of the observation space. We train a single component density function of the exponential family using the observations, which fall inside each subspace represented on the tree. These single component density functions are then adaptively combined to produce our multimodal density function, which is shown to achieve the performance of the best convex combination of the density functions defined on the subspaces. As we observe more samples, our tree grows and produces more subspaces. As a result, our modeling power increases in time, while mitigating overfitting issues. In order to choose our threshold level to label the observations, we use an adaptive thresholding scheme. We show that our adaptive threshold level achieves the performance of the optimal prefixed threshold level, which knows the observation labels in hindsight. Our algorithm provides significant performance improvements over the state of the art in our wide set of experiments involving both synthetic as well as real data.

Section: A Preliminariesmentioning

confidence: 99%

Sequential Outlier Detection Based on Incremental Decision Trees

Neyshabouri

IEEE Trans. Signal Process.

et al. 2019

“…Even though there exist several nonparametric approaches to model the distribution of the nominal data [15]- [17], parametric models are usually more practical because of their faster learning behavior and high modeling powers [16]. The parametric models can suffer if only the assumed model is incapable of continuously modeling the data [1] in a robust manner.…”

Section: A Preliminariesmentioning

confidence: 99%

“…from (15), (16), (17), where w r 1 = 1/N . We next provide the performance bound of this mixture approach.…”

Section: Universal Density Estimatormentioning

confidence: 99%

Online Anomaly Detection With Minimax Optimal Density Estimation in Nonstationary Environments

IEEE Trans. Signal Process.

Kozat

2018

Self Cite

We introduce a truly online anomaly detection algorithm that sequentially processes data to detect anomalies in time series. In anomaly detection, while the anomalous data are arbitrary, the normal data have similarities and generally conforms to a particular model. However, the particular model that generates the normal data is generally unknown (even nonstationary) and needs to be learned sequentially. Therefore, a two stage approach is needed, where in the first stage, we construct a probability density function to model the normal data in the time series. Then, in the second stage, we threshold the density estimation of the newly observed data to detect anomalies. We approach this problem from an information theoretic perspective and propose minimax optimal schemes for both stages to create an optimal anomaly detection algorithm in a strong deterministic sense. To this end, for the first stage, we introduce a completely online density estimation algorithm that is minimax optimal with respect to the log-loss and achieves Merhav's lower bound for general nonstationary exponential-family of distributions without any assumptions on the observation sequence. For the second stage, we propose a threshold selection scheme that is minimax optimal (with logarithmic performance bounds) against the best threshold chosen in hindsight with respect to the surrogate logistic loss. Apart from the regret bounds, through synthetic and real life experiments, we demonstrate substantial performance gains with respect to the state-of-the-art density estimation based anomaly detection algorithms in the literature.

“…We emphasize that there exist nonparametric algorithms for density estimation [10], the parametric approaches have recently gained more interest due to their faster convergence [11], [12]. However, the parametric approaches fail if the assumed model is not capable of modeling the true underlying distribution [9].…”

Section: A Preliminariesmentioning

confidence: 99%

Sequential Outlier Detection based on Incremental Decision Trees

Neyshabouri¹,

Kozat²

2018

Preprint

We introduce an online outlier detection algorithm to detect outliers in a sequentially observed data stream. For this purpose, we use a two-stage filtering and hedging approach. In the first stage, we construct a multi-modal probability density function to model the normal samples. In the second stage, given a new observation, we label it as an anomaly if the value of aforementioned density function is below a specified threshold at the newly observed point. In order to construct our multimodal density function, we use an incremental decision tree to construct a set of subspaces of the observation space. We train a single component density function of the exponential family using the observations, which fall inside each subspace represented on the tree. These single component density functions are then adaptively combined to produce our multi-modal density function, which is shown to achieve the performance of the best convex combination of the density functions defined on the subspaces. As we observe more samples, our tree grows and produces more subspaces. As a result, our modeling power increases in time, while mitigating overfitting issues. In order to choose our threshold level to label the observations, we use an adaptive thresholding scheme. We show that our adaptive threshold level achieves the performance of the optimal pre-fixed threshold level, which knows the observation labels in hindsight. Our algorithm provides significant performance improvements over the state of the art in our wide set of experiments involving both synthetic as well as real data.