The extraction of clusters from a dataset which includes multiple clusters and another significant portion of "background" samples is a task of practical importance. The traditional spectral clustering algorithm, relying on the leading @math eigenvectors to detect the @math clusters, fails in such cases. This paper proposes the spectral embedding norm which sums the squared values of the first @math (normalized) eigenvectors, where @math can be larger than @math . We prove that the quantity can be used to separate clusters from the background under generic conditions motivated by applications such as anomaly detection. The performance of the algorithm is not sensitive to the choice of @math , and we present experiments on synthetic and real-world datasets.
Spectral methods for anomaly detection . The following papers have employed spectral embeddings for anomaly detection in different applications: in images @cite_40 @cite_22 , fraud detection @cite_9 , in graphs @cite_42 @cite_39 , sensor networks @cite_3 , computer systems @cite_38 and in general applications @cite_6 @cite_17 @cite_30 . For a general review of anomaly detection methods, the interested reader is referred to @cite_25 @cite_7 @cite_34 . As has been shown in @cite_39 @cite_31 @cite_9 @cite_42 , and we will demonstrate, the eigenvectors in an anomaly setting can lie deep within the spectrum of the affinity matrix. This gives rise to the notion of abandoning the guideline of focusing on @math eigenvectors and rather choosing to look deeper into the spectrum, both for clustering and for anomaly detection. Similar to the embedding norm which we propose, the square sum of principle components (called leverage score'') has been used in a different setting as a indicator of outlier sample points for linear regression and other applications in statistics @cite_13 .
@cite_30 @cite_38 @cite_22 @cite_7 @cite_9 @cite_42 @cite_3 @cite_39 @cite_6 @cite_40 @cite_31 @cite_34 @cite_13 @cite_25 @cite_17
2962796373 2399921532 2169357279 2333568743
We consider the change-point detection problem of deciding, based on noisy measurements, whether an unknown signal over a given graph is constant or is instead piecewise constant over two induced subgraphs of relatively low cut size. We analyze the corresponding generalized likelihood ratio (GLR) statistic and relate it to the problem of nding a sparsest cut in a graph. We develop a tractable relaxation of the GLR statistic based on the combinatorial Laplacian of the graph, which we call the spectral scan statistic, and analyze its properties. We show how its performance as a testing procedure depends directly on the spectrum of the graph, and use this result to explicitly derive its asymptotic properties on few graph topologies. Finally, we demonstrate both theoretically and by simulations that the spectral scan statistic can outperform naive testing procedures based on edge thresholding and 2 testing. This paper addresses an application of anomaly detection from subsequences of time series (STS) to autonomous robots’ behaviors. An important aspect of mining sequential data is selecting the temporal parameters, such as the subsequence length and the degree of smoothing. For example in the task at hand, the patterns of the robot’s velocity, which is one of its fundamental features, vary significantly subject to the interval for measuring the displacement. Selecting the time scale and resolution is difficult in unsupervised settings, and is often more critical than the choice of the method. In this paper, we propose an ensemble framework for aggregating anomaly detection from different perspectives, i.e., settings of user-defined, temporal parameters. In the proposed framework, each behavior is labeled whether it is an anomaly in multiple settings. The set of labels are used as meta-features of the respective behaviors. Cluster analysis in a meta-feature space partitions anomalous behaviors pertained to a specific range of parameters. The framework also includes a scalable implementation of the instance-based anomaly detection. We evaluate the proposed framework by ROC analysis, in comparison to conventional ensemble methods for anomaly detection. We consider the change-point detection problem of deciding, based on noisy measurements, whether an unknown signal over a given graph is constant or is instead piecewise constant over two connected induced subgraphs of relatively low cut size. We analyze the corresponding generalized likelihood ratio (GLR) statistics and relate it to the problem of finding a sparsest cut in a graph. We develop a tractable relaxation of the GLR statistic based on the combinatorial Laplacian of the graph, which we call the spectral scan statistic, and analyze its properties. We show how its performance as a testing procedure depends directly on the spectrum of the graph, and use this result to explicitly derive its asymptotic properties on few significant graph topologies. Finally, we demonstrate both theoretically and by simulations that the spectral scan statistic can outperform naive testing procedures based on edge thresholding and @math testing. Abstract For many data mining problems, obtaining labels is costly and time consuming, if not practically infeasible. In addition, unlabeled data often includes categorical or ordinal features which, compared with numerical features, can present additional challenges. We propose a new unsupervised spectral ranking method for anomaly (SRA). We illustrate that the spectral optimization in SRA can be viewed as a relaxation of an unsupervised SVM problem. We demonstrate that the first non-principal eigenvector of a Laplacian matrix is linked to a bi-class classification strength measure which can be used to rank anomalies. Using the first non-principal eigenvector of the Laplacian matrix directly, the proposed SRA generates an anomaly ranking either with respect to the majority class or with respect to two main patterns. The choice of the ranking reference can be made based on whether the cardinality of the smaller class (positive or negative) is sufficiently large. Using an auto insurance claim data set but ignoring labels when generating ranking, we show that our proposed SRA significantly surpasses existing outlier-based fraud detection methods. Finally we demonstrate that, while proposed SRA yields good performance for a few similarity measures for the auto insurance claim data, notably ones based on the Hamming distance, choosing appropriate similarity measures for a fraud detection problem remains crucial.