Constraining Anomaly Detection with Anomaly-Free Regions

TL;DR

This paper introduces anomaly-free regions (AFR) as a new concept to improve anomaly detection by leveraging known regions free of anomalies, leading to more accurate and constrained detection methods.

Contribution

It provides a theoretical foundation and implementation for using AFRs to enhance anomaly detection, outperforming existing methods and baselines.

Findings

AFRs improve anomaly detection accuracy.

Constrained detection outperforms unconstrained methods.

State-of-the-art methods are outperformed with AFRs.

Abstract

We propose the novel concept of anomaly-free regions (AFR) to improve anomaly detection. An AFR is a region in the data space for which it is known that there are no anomalies inside it, e.g., via domain knowledge. This region can contain any number of normal data points and can be anywhere in the data space. AFRs have the key advantage that they constrain the estimation of the distribution of non-anomalies: The estimated probability mass inside the AFR must be consistent with the number of normal data points inside the AFR. Based on this insight, we provide a solid theoretical foundation and a reference implementation of anomaly detection using AFRs. Our empirical results confirm that anomaly detection constrained via AFRs improves upon unconstrained anomaly detection. Specifically, we show that, when equipped with an estimated AFR, an efficient algorithm based on random guessing becomes a strong baseline that several widely-used methods struggle to overcome. On a dataset with a ground-truth AFR available, the current state of the art is outperformed.