This work presents a method for active anomaly detection which can be built upon existing deep learning solutions for unsupervised anomaly detection. We show that a prior needs to be assumed on what the anomalies are, in order to have performance guarantees in unsupervised anomaly detection. We argue that active anomaly detection has, in practice, the same cost of unsupervised anomaly detection but with the possibility of much better results. To solve this problem, we present a new layer that can be attached to any deep learning model designed for unsupervised anomaly detection to transform it into an active method, presenting results on both synthetic and real anomaly detection datasets. Anomaly detection (a.k.a. outlier detection) (Hodge & Austin, 2004; Chandola et al., 2009; Aggarwal, 2015) aims to discover rare instances that do not conform to the patterns of majority. From a business perspective, though, we are not only interested in finding rare instances, but "usefull anomalies". This problem has been amply studied recently (Liu et al., 2017; Li et al., 2017; Zong et al., 2018; Maurus & Plant, 2017; Zheng et al., 2017) , with solutions inspired by extreme value theory (Siffer et al., 2017) , robust statistics (Zhou & Paffenroth, 2017) and graph theory (Perozzi et al., 2014) .Unsupervised anomaly detection is a sub-area of outlier detection, being frequently applied since label acquisition is very expensive and time consuming. It is a specially hard task, where there is usually no information on what these rare instances are and most works use models with implicit priors or heuristics to discover these anomalies, providing an anomaly score s(x) for each instance in a dataset. Active anomaly detection is a powerful alternative approach to this problem, which has presented good results in recent works such as (Veeramachaneni et al., 2016; Das et al., 2016; 2017) .In this work, we first show that unsupervised anomaly detection requires priors to be assumed on the anomaly distribution; we then argue in favor of approaching it with active anomaly detection, an important, but under-explored approach (Section 2). We propose a new layer, called here Universal Anomaly Inference (UAI), which can be applied on top of any unsupervised anomaly detection model based on deep learning to transform it into an active model (Section 3). This layer uses the strongest assets of deep anomaly detection models, i.e. its learned latent representations (l) and anomaly score (s), to train a classifier on the few already labeled instances. An example of such an application can be seen in FIG0 , where an UAI layer is built upon a Deanoising AutoEncoder (DAE).We then present extensive experiments , analyzing the performance of our systems vs unsupervised, semi-supervised and active ones under similar budgets in both synthetic and real data, showing our algorithm improves state of the art results in several datasets, with no hyperparameter tuning (Section 4). Finally, we visualize our models learned latent representations, comparing them to unsupervised models' ones and analyze our model's performance for different numbers of labels (Appendix C). Grubbs (1969) defines an outlying observation , or outlier, as one that appears to deviate markedly from other members of the sample in which it occurs. Hawkins (1980) states that an outlier is an observation that deviates so much from other observations as to arouse suspicion that it was generated by a different mechanism. While Chandola et al. (2009) says that normal data instances occur in high probability regions of a stochastic model, while anomalies occur in the low probability ones. Following these definitions, specially the one from (Hawkins, 1980) , we assume there is a probability density function from which our 'normal' data instances are generated: X normal ∼ p normal (x) = p (x|y = 0), where x is an instance's available information 1 and y is a label saying if the point is anomalous or not. There is also a different probability density function from which anomalous data instances are sampled: X anom ∼ p anom (x) = p (x|y = 1). We proposed here a new architecture, Universal Anomaly Inference (UAI), which can be applied on top of any deep learning based anomaly detection architecture. We show that, even on top of very simple architectures, like a DAE, UaiNets can produce similar/better results to state-of-the-art unsupervised/semi-supervised anomaly detection methods. We also give both theoretical and practical arguments motivating active anomaly detection, arguing that, in most practical settings, there would be no detriment to using this instead of a fully unsupervised approach.We further want to make clear that we are not stating our method is better than our semi-supervised baselines (DAGMM, DCN, DSEBM-e). Our contributions are orthogonal to theirs. We propose a new approach to this hard problem which can be built on top of them, this being our main contribution in this work. To the best of our knowledge, this is the first work which applies deep learning to active anomaly detection. We use the strongest points of these deep learning algorithms (their learned representations and anomaly scores) to build an active algorithm, presenting an end-to-end architecture which learns representations by leveraging both the full dataset and the already labeled instances.Important future directions for this work are using the UAI layers confidence in its output to dynamically choose between either directly using its scores, or using the underlying unsupervised model's anomaly score to choose which instances to audit next. Another future direction would be testing new architectures for UAI layers, in this work we restricted all our analysis to simple logistic regression. A third important future work would be analyzing the robustness of UaiNets to mistakes being made by the labeling experts. Finally, making this model more interpretable, so that auditors could focus on a few "important" features when labeling anomalous instances, could increase labeling speed and make their work easier.
A method for active anomaly detection. We present a new layer that can be attached to any deep learning model designed for unsupervised anomaly detection to transform it into an active method.
{"src": "scitldr-AIC_train", "paper_id": "HJex0o05F7"}