Detecting Relative Anomaly

Multivariate anomaly detection may be categorized broadly into supervised and unsupervised detection. In supervised anomaly detection, training data are labeled by domain experts as normal or anomalous, and a model is trained to classify future observations. In unsupervised anomaly detection, which is the focus of this article, labels are not known, because labeling is too difficult or costly. The goal is to approximately recover the missing expert judgements using empirical characteristics of the data. The data themselves typically first undergo a feature selection and feature engineering process to devise informative covariates. An unsupervised model can be evaluated by comparing its predictions with actual domain expert labels. Potential applications include intrusion detection, fraud detection and process control. Frequency is commonly chosen as the target criterion for unsupervised anomaly detection.