Weakly Supervised Anomaly Detection via Knowledge-Data Alignment

TL;DR

This paper proposes KDAlign, a novel framework that enhances weakly supervised anomaly detection by aligning human expert rules with data using optimal transport, leading to improved detection accuracy on real-world datasets.

Contribution

The paper introduces KDAlign, integrating rule knowledge into WSAD via optimal transport to improve anomaly detection performance with limited labeled data.

Findings

KDAlign outperforms state-of-the-art methods on five datasets.

Incorporating knowledge improves detection of unseen anomalies.

Optimal transport effectively aligns knowledge and data representations.

Abstract

Anomaly detection (AD) plays a pivotal role in numerous web-based applications, including malware detection, anti-money laundering, device failure detection, and network fault analysis. Most methods, which rely on unsupervised learning, are hard to reach satisfactory detection accuracy due to the lack of labels. Weakly Supervised Anomaly Detection (WSAD) has been introduced with a limited number of labeled anomaly samples to enhance model performance. Nevertheless, it is still challenging for models, trained on an inadequate amount of labeled data, to generalize to unseen anomalies. In this paper, we introduce a novel framework Knowledge-Data Alignment (KDAlign) to integrate rule knowledge, typically summarized by human experts, to supplement the limited labeled data. Specifically, we transpose these rules into the knowledge space and subsequently recast the incorporation of knowledge as the alignment of knowledge and data. To facilitate this alignment, we employ the Optimal Transport (OT) technique. We then incorporate the OT distance as an additional loss term to the original objective function of WSAD methodologies. Comprehensive experimental results on five real-world datasets demonstrate that our proposed KDAlign framework markedly surpasses its state-of-the-art counterparts, achieving superior performance across various anomaly types.