Interactive Anomaly Detection Based on Clustering and Online Mirror Descent

• In several applications, when anomalies are detected, human experts have to investigate or verify them one by one. As they investigate, they unwittingly produce a label - true positive (TP) or false positive (FP). In this paper, we propose a method (called OMD-Clustering) that exploits this label feedback to minimize the FP rate and detect more relevant anomalies, while minimizing the expert effort required to inves- tigate them. The OMD-Clustering method iteratively suggests the top-1 anomalous instance to a human expert and receives feedback. Before suggesting the next anomaly, the method re-ranks instances so that the top anomalous instances are similar to the TP instances and dissimi- lar to the FP instances. This is achieved by learning to score anomalies differently in various regions of the feature space. An experimental eval- uation on several real-world datasets is conducted. The results show that OMD-Clustering achieves significant improvement in both detection pre- cision and expert effort compared to state-of-the-art interactive anomaly detection methods.

Ämnesord

TEKNIK OCH TEKNOLOGIER  -- Elektroteknik och elektronik (hsv//swe)

ENGINEERING AND TECHNOLOGY  -- Electrical Engineering, Electronic Engineering, Information Engineering (hsv//eng)

Nyckelord

Interactive Anomaly Detection

Outlier Detection

User Feedback

Expert Effort

Publikations- och innehållstyp

ref (ämneskategori)

kon (ämneskategori)