Improve black-box sequential anomaly detector relevancy with limited user feedback