Online Nonparametric Anomaly Detection based on Geometric Entropy Minimization

TL;DR

This paper introduces a fast, nonparametric online anomaly detection method combining Geometric Entropy Minimization and CUSUM, effective for high-dimensional data and near-optimal in detection delay.

Contribution

It develops a novel nonparametric anomaly detection algorithm that integrates GEM with CUSUM, including new asymptotic analysis and interpretation, applicable to high-dimensional datasets.

Findings

Achieves near-optimal detection delay performance

Effective in high-dimensional datasets

Validated with simulated and real data

Abstract

We consider the online and nonparametric detection of abrupt and persistent anomalies, such as a change in the regular system dynamics at a time instance due to an anomalous event (e.g., a failure, a malicious activity). Combining the simplicity of the nonparametric Geometric Entropy Minimization (GEM) method with the timely detection capability of the Cumulative Sum (CUSUM) algorithm we propose a computationally efficient online anomaly detection method that is applicable to high-dimensional datasets, and at the same time achieve a near-optimum average detection delay performance for a given false alarm constraint. We provide new insights to both GEM and CUSUM, including new asymptotic analysis for GEM, which enables soft decisions for outlier detection, and a novel interpretation of CUSUM in terms of the discrepancy theory, which helps us generalize it to the nonparametric GEM statistic. We numerically show, using both simulated and real datasets, that the proposed nonparametric algorithm attains a close performance to the clairvoyant parametric CUSUM test.