Detecting Relative Anomaly

TL;DR

This paper introduces a new anomaly detection method called relative anomaly detection, which is designed to effectively identify anomalies that occur frequently by considering their relation to typical observations, suitable for large-scale real-time applications.

Contribution

The paper presents a novel anomaly detection approach that is robust to frequent anomalies and computationally feasible for large datasets, improving detection accuracy in such scenarios.

Findings

Effective detection of frequent anomalies demonstrated on real-world datasets.

Method is computationally efficient and suitable for real-time applications.

Outperforms traditional frequency-based anomaly detection methods.

Abstract

System states that are anomalous from the perspective of a domain expert occur frequently in some anomaly detection problems. The performance of commonly used unsupervised anomaly detection methods may suffer in that setting, because they use frequency as a proxy for anomaly. We propose a novel concept for anomaly detection, called relative anomaly detection. It is tailored to be robust towards anomalies that occur frequently, by taking into account their location relative to the most typical observations. The approaches we develop are computationally feasible even for large data sets, and they allow real-time detection. We illustrate using data sets of potential scraping attempts and Wi-Fi channel utilization, both from Google, Inc.