Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What are good algorithms for detecting abnormality?

Background

Here is the problem:

  1. A black box outputs a new number each day.
  2. Those numbers have been recorded for a period of time.
  3. Detect when a new number from the black box falls outside the pattern of numbers established over the time period.

The numbers are integers, and the time period is a year.

Question

What algorithm will identify a pattern in the numbers?

The pattern might be simple, like always ascending or always descending, or the numbers might fall within a narrow range, and so forth.

Ideas

I have some ideas, but am uncertain as to the best approach, or what solutions already exist:

  • Machine learning algorithms?
  • Neural network?
  • Classify normal and abnormal numbers?
  • Statistical analysis?
like image 791
Joseph Garvin Avatar asked Sep 22 '10 15:09

Joseph Garvin


People also ask

Which algorithm is best for anomaly detection?

Local outlier factor (LOF) Local outlier factor is probably the most common technique for anomaly detection. This algorithm is based on the concept of the local density. It compares the local density of an object with that of its neighbouring data points.

What are the three 3 basic approaches to anomaly detection?

There are three main classes of anomaly detection techniques: unsupervised, semi-supervised, and supervised. Essentially, the correct anomaly detection method depends on the available labels in the dataset.

What are the suggested algorithms that would be appropriate for anomaly detection related to identifying unusual activities in network activities or data?

If you are specifically interested in Network/Graph analytics, the two main methods used for identifying anomalies in network graphs are the Direct Neighbour Outlier Detection Algorithm (DNODA) and Community Neighbour Algorithm (CNA).


2 Answers

Cluster your data.

If you don't know how many modes your data will have, use something like a Gaussian Mixture Model (GMM) along with a scoring function (e.g., Bayesian Information Criterion (BIC)) so you can automatically detect the likely number of clusters in your data. I recommend this instead of k-means if you have no idea what value k is likely to be. Once you've constructed a GMM for you data for the past year, given a new datapoint x, you can calculate the probability that it was generated by any one of the clusters (modeled by a Gaussian in the GMM). If your new data point has low probability of being generated by any one of your clusters, it is very likely a true outlier.

If this sounds a little too involved, you will be happy to know that the entire GMM + BIC procedure for automatic cluster identification has been implemented for you in the excellent MCLUST package for R. I have used it several times to great success for such problems.

Not only will it allow you to identify outliers, you will have the ability to put a p-value on a point being an outlier if you need this capability (or want it) at some point.

like image 78
awesomo Avatar answered Oct 13 '22 16:10

awesomo


You could try line fitting prediction using linear regression and see how it goes, it would be fairly easy to implement in your language of choice. After you fitted a line to your data, you could calculate the mean standard deviation along the line. If the novel point is on the trend line +- the standard deviation, it should not be regarded as an abnormality.

PCA is an other technique that comes to mind, when dealing with this type of data.

You could also look in to unsuperviced learning. This is a machine learning technique that can be used to detect differences in larger data sets.

Sounds like a fun problem! Good luck

like image 3
Theodor Avatar answered Oct 13 '22 18:10

Theodor