Wisdom of the Contexts: Active Ensemble Learning for Contextual Anomaly Detection

TL;DR

This paper introduces WisCon, an active ensemble learning method that automatically generates and combines multiple contexts to improve the detection of complex contextual anomalies, outperforming existing methods.

Contribution

The paper presents a novel approach, WisCon, that automatically constructs and ensembles multiple contexts for more effective contextual anomaly detection without prior context knowledge.

Findings

WisCon outperforms baseline methods on seven datasets.

Multiple contexts are more effective than a single context for anomaly detection.

Leveraging multiple contexts captures diverse anomalies effectively.

Abstract

In contextual anomaly detection, an object is only considered anomalous within a specific context. Most existing methods for CAD use a single context based on a set of user-specified contextual features. However, identifying the right context can be very challenging in practice, especially in datasets, with a large number of attributes. Furthermore, in real-world systems, there might be multiple anomalies that occur in different contexts and, therefore, require a combination of several "useful" contexts to unveil them. In this work, we leverage active learning and ensembles to effectively detect complex contextual anomalies in situations where the true contextual and behavioral attributes are unknown. We propose a novel approach, called WisCon (Wisdom of the Contexts), that automatically creates contexts from the feature set. Our method constructs an ensemble of multiple contexts, with varying importance scores, based on the assumption that not all useful contexts are equally so. Experiments show that WisCon significantly outperforms existing baselines in different categories (i.e., active classifiers, unsupervised contextual and non-contextual anomaly detectors, and supervised classifiers) on seven datasets. Furthermore, the results support our initial hypothesis that there is no single perfect context that successfully uncovers all kinds of contextual anomalies, and leveraging the "wisdom" of multiple contexts is necessary.