Sequential anomaly identification with observation control under generalized error metrics

TL;DR

This paper develops sequential anomaly detection methods that adaptively select data sources to monitor under sampling constraints, optimizing detection speed while controlling generalized error metrics.

Contribution

It introduces a novel framework for sequential anomaly detection with observation control, providing asymptotic bounds and policies for generalized error metrics.

Findings

Achieves asymptotic lower bounds on expected stopping time.

Proposes policies that attain these bounds in the full-sampling case.

Demonstrates effectiveness through simulation studies comparing finite regimes.

Abstract

The problem of sequential anomaly detection and identification is considered, where multiple data sources are simultaneously monitored and the goal is to identify in real time those, if any, that exhibit ``anomalous" statistical behavior. An upper bound is postulated on the number of data sources that can be sampled at each sampling instant, but the decision maker selects which ones to sample based on the already collected data. Thus, in this context, a policy consists not only of a stopping rule and a decision rule that determine when sampling should be terminated and which sources to identify as anomalous upon stopping, but also of a sampling rule that determines which sources to sample at each time instant subject to the sampling constraint. Two distinct formulations are considered, which require control of different, ``generalized" error metrics. The first one tolerates a certain user-specified number of errors, of any kind, whereas the second tolerates distinct, user-specified numbers of false positives and false negatives. For each of them, a universal asymptotic lower bound on the expected time for stopping is established as the error probabilities go to 0, and it is shown to be attained by a policy that combines the stopping and decision rules proposed in the full-sampling case with a probabilistic sampling rule that achieves a specific long-run sampling frequency for each source. Moreover, the optimal to a first order asymptotic approximation expected time for stopping is compared in simulation studies with the corresponding factor in a finite regime, and the impact of the sampling constraint and tolerance to errors is assessed.