We present a new subspace-based method to construct probabilistic models for high-dimensional data and highlight its use in anomaly detection. The approach is based on a statistical estimation of probability density using densities of random subspaces combined with geometric averaging. In selecting random subspaces, equal representation of each attribute is used to ensure correct statistical limits. Gaussian mixture models (GMMs) are used to create the probability densities for each subspace with techniques included to mitigate singularities allowing for the ability to handle both numerical and categorial attributes. The number of components for each GMM is determined automatically through Bayesian information criterion to prevent overfitting. The proposed algorithm attains competitive AUC scores compared with prominent algorithms against benchmark anomaly detection datasets with the added benefits of being simple, scalable, and interpretable.
Interpretable Graph-Level Anomaly Detection via Contrast with Normal Prototypes
State Key Laboratory for Novel Software Technology, Nanjing University（新型软件技术国家重点实验室，南京大学）；School of Artificial Intelligence, Nanjing University（人工智能学院，南京大学）
University of Warwick（华威大学）；University of Cambridge（剑桥大学）；Amazon（亚马逊）
Anomaly detection at scale is an extremely challenging problem of great practicality. When data is large and high-dimensional, it can be difficult to detect which observations do not fit the expected behaviour. Recent work has coalesced on variations of (random) $k$\emph{d-trees} to summarise data for anomaly detection. However, these methods rely on ad-hoc score functions that are not easy to interpret, making it difficult to asses the severity of the detected anomalies or select a reasonable threshold in the absence of labelled anomalies. To solve these issues, we contextualise these methods…
In the research area of anomaly detection, novel and promising methods are frequently developed. However, most existing studies exclusively focus on the detection task only and ignore the interpretability of the underlying models as well as their detection results. Nevertheless, anomaly interpretation, which aims to provide explanation of why specific data instances are identified as anomalies, is an equally important task in many real-world applications. In this work, we propose a novel framework which synergizes several machine learning and data mining techniques to automatically learn invar…
Virginia Commonwealth University（弗吉尼亚联邦大学）；Idaho National Laboratory（爱达荷国家实验室）
Recent year has brought considerable advancements in Electric Vehicles (EVs) and associated infrastructures/communications. Intrusion Detection Systems (IDS) are widely deployed for anomaly detection in such critical infrastructures. This paper presents an Interpretable Anomaly Detection System (RX-ADS) for intrusion detection in CAN protocol communication in EVs. Contributions include: 1) window based feature extraction method; 2) deep Autoencoder based anomaly detection method; and 3) adversarial machine learning based explanation generation methodology. The presented approach was tested on …
Identifying anomalies in multi-dimensional datasets is an important task in many real-world applications. A special case arises when anomalies are occluded in a small set of attributes, typically referred to as a subspace, and not necessarily over the entire data space. In this paper, we propose a new subspace analysis approach named Agglomerative Attribute Grouping (AAG) that aims to address this challenge by searching for subspaces that are comprised of highly correlative attributes. Such correlations among attributes represent a systematic interaction among the attributes that can better re…
Function Based Isolation Forest (FuBIF): A Unifying Framework for Interpretable Isolation-Based Anomaly Detection
Brain, Mind and Computer Science, University of Padova, Italy（脑科学与计算机科学系，帕多瓦大学，意大利）；Department of Mathematics, Sapienza University of Roma, Italy（数学系，罗马萨皮恩扎大学，意大利）；Department of Information Engineering, University of Padova, Italy（信息工程系，帕多瓦大学，意大利）
Anomaly Detection is an unsupervised learning task aimed at detecting anomalous behaviours with respect to historical data. In particular, multivariate Anomaly Detection has an important role in many applications thanks to the capability of summarizing the status of a complex system or observed phenomenon with a single indicator (typically called `Anomaly Score') and thanks to the unsupervised nature of the task that does not require human tagging. The Isolation Forest is one of the most commonly adopted algorithms in the field of Anomaly Detection, due to its proven effectiveness and low comp…
For the highly imbalanced credit card fraud detection problem, most existing methods either use data augmentation methods or conventional machine learning models, while neural network-based anomaly detection approaches are lacking. Furthermore, few studies have employed AI interpretability tools to investigate the feature importance of transaction data, which is crucial for the black-box fraud detection module. Considering these two points together, we propose a novel anomaly detection framework for credit card fraud detection as well as a model-explaining module responsible for prediction exp…
NSF-MAP: Neurosymbolic Multimodal Fusion for Robust and Interpretable Anomaly Prediction in Assembly Pipelines
Artificial Intelligence Institute, University of South Carolina（南卡罗来纳大学人工智能研究所）；Clemson Composites Center, Clemson University（克莱姆森大学复合材料中心）；Intelligent Circuits, Architectures and Systems Lab, University of South Carolina（南卡罗来纳大学智能电路、架构和系统实验室）
Interpretable Maximum Margin Deep Anomaly Detection
School of Statistics and Mathematics, Yunnan University of Finance and Economics（云南财经大学统计与数学学院）；Academy for Multidisciplinary Studies, Capital Normal University（首都师范大学多学科研究院）
Autoencoder (AE) is a neural network (NN) architecture that is trained to reconstruct an input at its output. By measuring the reconstruction errors of new input samples, AE can detect anomalous samples deviated from the trained data distribution. The key to success is to achieve high-fidelity reconstruction (HFR) while restricting AE's capability of generalization beyond training data, which should be balanced commonly via iterative re-training. Alternatively, we propose a novel framework of AE-based anomaly detection, coined HFR-AE, by projecting new inputs into a subspace wherein the traine…
EVA-Net: Interpretable Anomaly Detection for Brain Health via Learning Continuous Aging Prototypes from One-Class EEG Cohorts
Qilu Hospital, ASU（青岛医院，亚利桑那州立大学）；Zhengzhou University（郑州大学）；University of Science and Technology Beijing（北京科技大学）；Southern University of Science and Technology（南方科技大学）；Qilu Hospital（青岛医院）
Virginia Commonwealth University（弗吉尼亚联邦大学）；Idaho National Laboratory（爱达荷国家实验室）
Monitoring traffic in computer networks is one of the core approaches for defending critical infrastructure against cyber attacks. Machine Learning (ML) and Deep Neural Networks (DNNs) have been proposed in the past as a tool to identify anomalies in computer networks. Although detecting these anomalies provides an indication of an attack, just detecting an anomaly is not enough information for a user to understand the anomaly. The black-box nature of off-the-shelf ML models prevents extracting important information that is fundamental to isolate the source of the fault/attack and take correct…
Towards Self-Interpretable Graph-Level Anomaly Detection
Monash University（莫纳什大学）；Northwestern University（西北大学）；Data61, CSIRO（澳大利亚联邦科学与工业研究组织Data61）；Northwest A&F University（西北农林科技大学）；The University of Adelaide（阿德莱德大学）；Griffith University（格里菲斯大学）
异常检测有许多应用，并已被广泛研究。我们考虑一个互补的问题，有一个稀疏的文献：异常描述。对异常的解释对于从业者进行意义判断、故障排除和计划行动至关重要。为此，我们提出了一种新的方法称为x-PACS（eXplaining Patterns of Anomalies with Characterizing Subspaces），它通过识别（1）它们形成的组（或模式）以及（2）将每个异常模式与正常实例分开的特征子空间和特征规则来“逆向工程”已知异常。分组解释异常不仅可以节省分析时间并深入了解各种类型的异常，还可以引起对潜在关键的重复异常的注意。在发展x-PACS，我们首先构建一个异常描述问题的desiderata。从描述性数据采掘的角度来看，我们的方法表现出五个所需的属性在我们的desiderata。也就是说，它可以发现异常模式（i）多种不同类型，（ii）隐藏在高维空间的任意子空间中，（iii）可由分析师解释，（iv）不同于数据的正常模式，以及最后（v）简洁，提供最短的数据描述。此外，x-PACS是高度并行化的，并在数据大小方面线性扩展。没有现有的工作异常描述同时满足所有这些属性。虽然不是我们的主要目标，但我们发现的异常模式可以作为可解释的“签名”，并可用于检测。我们展示了x-PACS在解释和检测现实世界的数据集相比，国家的最先进的有效性。
University of the Witwatersrand（金山大学）；University of Johannesburg（约翰内斯堡大学）
Hybrid methods have been shown to outperform pure statistical and pure deep learning methods at both forecasting tasks, and at quantifying the uncertainty associated with those forecasts (prediction intervals). One example is Multivariate Exponential Smoothing Long Short-Term Memory (MES-LSTM), a hybrid between a multivariate statistical forecasting model and a Recurrent Neural Network variant, Long Short-Term Memory. It has also been shown that a model that ($i$) produces accurate forecasts and ($ii$) is able to quantify the associated predictive uncertainty satisfactorily, can be successfull…
Tsinghua University（清华大学）；Hefei University of Technology（合肥工业大学）；Siemens AG（西门子股份公司）
Recent studies have shown that autoencoder-based models can achieve superior performance on anomaly detection tasks due to their excellent ability to fit complex data in an unsupervised manner. In this work, we propose a novel autoencoder-based model, named StackVAE-G that can significantly bring the efficiency and interpretability to multivariate time series anomaly detection. Specifically, we utilize the similarities across the time series channels by the stacking block-wise reconstruction with a weight-sharing scheme to reduce the size of learned models and also relieve the overfitting to u…
Nowadays, many classification algorithms have been applied to various industries to help them work out their problems met in real-life scenarios. However, in many binary classification tasks, samples in the minority class only make up a small part of all instances, which leads to the datasets we get usually suffer from high imbalance ratio. Existing models sometimes treat minority classes as noise or ignore them as outliers encountering data skewing. In order to solve this problem, we propose a bagging ensemble learning framework $ASE$ (Anomaly Scoring Based Ensemble Learning). This framework …
Privacy-Aware Video Anomaly Detection through Orthogonal Subspace Projection
School of Engineering and Built Environment, Griffith University（格里菲斯大学工程与环境学院）；School of Computer Science and Engineering, University of New South Wales（新南威尔士大学计算机科学与工程学院）；School of Information and Communication Technology, Griffith University（格里菲斯大学信息与通信技术学院）
University of São Paulo（圣保罗大学）；Stanford University（斯坦福大学）；VALE S.A（淡水河谷公司）
Despite the superior performance in modeling complex patterns to address challenging problems, the black-box nature of Deep Learning (DL) methods impose limitations to their application in real-world critical domains. The lack of a smooth manner for enabling human reasoning about the black-box decisions hinder any preventive action to unexpected events, in which may lead to catastrophic consequences. To tackle the unclearness from black-box models, interpretability became a fundamental requirement in DL-based systems, leveraging trust and knowledge by providing ways to understand the model's b…
DINAMO: Dynamic and INterpretable Anomaly MOnitoring for Large-Scale Particle Physics Experiments
Department of Experimental Physics, European Organization for Nuclear Research (CERN)（欧洲核子研究中心（CERN）实验物理学系）；Laboratory for Nuclear Science, Massachusetts Institute of Technology (MIT)（麻省理工学院核科学实验室）
Anomalies are by definition rare, thus labeled examples are very limited or nonexistent, and likely do not cover unforeseen scenarios. Unsupervised learning methods that don't necessarily encounter anomalies in training would be immensely useful. Generative vision models can be useful in this regard but do not sufficiently represent normal and abnormal data distributions. To this end, we propose constant curvature manifolds for embedding data distributions in unsupervised visual anomaly detection. Through theoretical and empirical explorations of manifold shapes, we develop a novel hyperspheri…
Complex devices are connected daily and eagerly generate vast streams of multidimensional state measurements. These devices often operate in distinct modes based on external conditions (day/night, occupied/vacant, etc.), and to prevent complete or partial system outage, we would like to recognize as early as possible when these devices begin to operate outside the normal modes. Unfortunately, it is often impractical or impossible to predict failures using rules or supervised machine learning, because failure modes are too complex, devices are too new to adequately characterize in a specific en…
Utrecht University（乌得勒支大学）；ZHAW School of Law and Management（苏黎世应用科技大学法律与管理学院）；Zurich University of Applied Sciences（苏黎世应用科技大学）
We combine the metrics of distance and isolation to develop the Analytic Isolation and Distance-based Anomaly (AIDA) detection algorithm. AIDA is the first distance-based method that does not rely on the concept of nearest-neighbours, making it a parameter-free model. Differently from the prevailing literature, in which the isolation metric is always computed via simulations, we show that AIDA admits an analytical expression for the outlier score, providing new insights into the isolation metric. Additionally, we present an anomaly explanation method based on AIDA, the Tempered Isolation-based…
Queensland University of Technology（昆士兰科技大学）；M3DICINE Pty Ltd（M3DICINE私人有限公司）
Traditionally, abnormal heart sound classification is framed as a three-stage process. The first stage involves segmenting the phonocardiogram to detect fundamental heart sounds; after which features are extracted and classification is performed. Some researchers in the field argue the segmentation step is an unwanted computational burden, whereas others embrace it as a prior step to feature extraction. When comparing accuracies achieved by studies that have segmented heart sounds before analysis with those who have overlooked that step, the question of whether to segment heart sounds before f…
Many applications like audio and image processing show that sparse representations are a powerful and efficient signal modeling technique. Finding an optimal dictionary that generates at the same time the sparsest representations of data and the smallest approximation error is a hard problem approached by dictionary learning (DL). We study how DL performs in detecting abnormal samples in a dataset of signals. In this paper we use a particular DL formulation that seeks uniform sparse representations model to detect the underlying subspace of the majority of samples in a dataset, using a K-SVD-t…
University of Sydney（悉尼大学）；Capital Markets Cooperative Research Centre（资本市场合作研究中心）；Data61/CSIRO（Data61/联邦科学与工业研究组织）；Australian National University（澳大利亚国立大学）
