Monotonic anomaly detection

TL;DR

This paper introduces two asymmetrical distance measures, ramp and signed distance, to improve semi-supervised anomaly detection by accounting for monotonic attribute relationships, with ramp distance showing superior real-world performance.

Contribution

It proposes novel monotonicity-aware distance measures for anomaly detection, demonstrating their effectiveness over traditional methods through extensive experiments.

Findings

Ramp distance improves detection performance over traditional absolute distance.

Signed distance performs well on synthetic data but poorly on real datasets.

Signed distance reduces anomaly detection to total attribute sum, limiting its effectiveness.

Abstract

Semi-supervised anomaly detection is based on the principle that potential anomalies are those records that look different from normal training data. However, in some cases we are specifically interested in anomalies that correspond to high attribute values (or low, but not both). We present two asymmetrical distance measures that take this monotonicity into account: ramp distance and signed distance. Through experiments on synthetic and real-life datasets, we show that ramp distance increases anomaly detection performance over the traditional absolute distance. While signed distance also performs well on synthetic data, it performs substantially poorer on real-life datasets. We argue that this is a consequence of the fact that when using signed distance, low values of certain attributes automatically compensate for high values of other attributes, such that anomaly detection is reduced to counting the total attribute value sum, which is too simplistic in practice.