Monotonic anomaly detection

arXiv (Cornell University)

Abstract

Semi-supervised anomaly detection is based on the principle that any record that looks different from normal training data is a potential anomaly. However, in some cases we are specifically interested in anomalies that correspond to high attribute values (or low, but not both). For distance-based methods, we propose an asymmetrical distance measure that takes this monotonicity into account by incorporating the ramp function. For the Isolation Forest algorithm, we propose a modified path length algorithm. Through experiments on synthetic and real-life datasets, we show that these proposals increase anomaly detection performance on datasets with monotonic attributes.

Authors 2

1. Oliver Urs Lenz

   Ghent University

   Affiliation as printed

   Department of Mathematics, Computer Science and Statistics , Ghent University

2. Matthijs van Leeuwen Aachen Leiden Institute of Advanced Computer Science

   Leiden University

   Affiliation as printed

   Leiden Institute of Advanced Computer Science , Leiden University