Ordering sampling rules for sequential anomaly identification under sampling constraints

TL;DR

This paper introduces ordering sampling rules for sequential anomaly detection in multiple data streams under sampling constraints, demonstrating their asymptotic optimality and improved finite-sample performance over probabilistic rules.

Contribution

It establishes the first asymptotic optimality results for ordering sampling rules with multiple sources sampled per instant, without prior knowledge of the number of anomalies.

Findings

Ordering sampling rules outperform probabilistic rules in finite regimes.

The proposed rules achieve first-order asymptotic optimality.

A novel proof technique handles various problem cases.

Abstract

We consider the problem of sequential anomaly identification over multiple independent data streams, under the presence of a sampling constraint. The goal is to quickly identify those that exhibit anomalous statistical behavior, when it is not possible to sample every source at each time instant. Thus, in addition to a stopping rule that determines when to stop sampling, and a decision rule that indicates which sources to identify as anomalous upon stopping, one needs to specify a sampling rule that determines which sources to sample at each time instant. We focus on the family of ordering sampling rules that select the sources to be sampled at each time instant based not only on the currently estimated subset of anomalous sources as the probabilistic sampling rules \cite{Tsopela_2022}, but also on the ordering of the sources' test-statistics. We show that under an appropriate design specified explicitly, an ordering sampling rule leads to the optimal expected time for stopping among all policies that satisfy the same sampling and error constraints to a first-order asymptotic approximation as the false positive and false negative error thresholds go to zero. This is the first asymptotic optimality result for ordering sampling rules, when more than one sources can be sampled per time instant, and it is established under a general setup where the number of anomalous sources is not required to be known. A novel proof technique is introduced that encompasses all different cases of the problem concerning sources' homogeneity, and prior information on the number of anomalies. Simulations show that ordering sampling rules have better performance in finite regime compared to probabilistic sampling rules.