Active Hypothesis Testing for Correlated Combinatorial Anomaly Detection

TL;DR

This paper introduces ECC-AHT, an adaptive method for detecting anomalous subsets in correlated noise environments, leveraging active measurement design to improve efficiency and accuracy in cyber-physical system monitoring.

Contribution

The paper presents ECC-AHT, a novel adaptive algorithm that exploits correlation for efficient anomaly detection, achieving optimal sample complexity and outperforming existing methods.

Findings

ECC-AHT achieves optimal sample complexity guarantees.

It significantly outperforms state-of-the-art baselines.

The method effectively exploits correlation for anomaly detection.

Abstract

We study the problem of identifying an anomalous subset of streams under correlated noise, motivated by monitoring and security in cyber-physical systems. This problem can be viewed as a form of combinatorial pure exploration, where each stream plays the role of an arm and measurements must be allocated sequentially under uncertainty. Existing combinatorial bandit and hypothesis testing methods typically assume independent observations and fail to exploit correlation for efficient measurement design. We propose ECC-AHT, an adaptive algorithm that selects continuous, constrained measurements to maximize Chernoff information between competing hypotheses, enabling active noise cancellation through differential sensing. ECC-AHT achieves optimal sample complexity guarantees and significantly outperforms state-of-the-art baselines in both synthetic and real-world correlated environments. The code is available on https://github.com/VincentdeCristo/ECC-AHT