2023/05/22 by Jonas Soenen, Soenen, Jonas, Elia Van Wolputte +7
Computer Science · Engineering · #Anomaly Detection Techniques and Applications #Artificial Immune Systems Applications #FOS: Computer and information sciences #Machine Learning (cs.LG) #Network Security and Intrusion Detection
paper · pdf · doi:10.48550/arxiv.2305.12958
openalex publication_date 2023/05/22 · openalex created_date 2023/05/24 · openalex updated_date 2026/08/01
Most anomaly detection systems try to model normal behavior and assume anomalies deviate from it in diverse manners. However, there may be patterns in the anomalies as well. Ideally, an anomaly detection system can exploit patterns in both normal and anomalous behavior. In this paper, we present AD-MERCS, an unsupervised approach to anomaly detection that explicitly aims at doing both. AD-MERCS identifies multiple subspaces of the instance space within which patterns exist, and identifies conditions (possibly in other subspaces) that characterize instances that deviate from these patterns. Experiments show that this modeling of both normality and abnormality makes the anomaly detector performant on a wide range of types of anomalies. Moreover, by identifying patterns and conditions in (low-dimensional) subspaces, the anomaly detector can provide simple explanations of why something is considered an anomaly. These explanations can be both negative (deviation from some pattern) as positive (meeting some condition that is typical for anomalies).