Anomaly detection, which aims at identifying unexpected trends and data patterns, has widely been used to build error detectors, failure predictors or intrusion detectors. Internal faults or malicious attacks have a different impact on the behavior of the system. They usually manifest as different observable deviations from the expected behavior, which may be identified by anomaly detection algorithms. Our study aims at investigating the suitability of unsupervised algorithms and their families in detecting either point, contextual or collective anomalies. To provide a complete picture, we consider both sliding and non-sliding window algorithms which operate in unsupervised mode. Along with qualitative analyses of each algorithm and family, we conduct an experimental campaign in which we run each algorithm on three state-of-the-art datasets in which we inject either point, contextual or collective anomalies. Results show that non-sliding algorithms are capable to detect point and collective anomalies, while they cannot effectively deal with contextual ones. Instead, sliding window algorithms require shorter periods of training and naturally build a local context, which allow them to effectively deal with contextual anomalies. Such observations are summarized to support the choice of the correct algorithm depending on the investigated class(es) of anomaly.

On Algorithms Selection for Unsupervised Anomaly Detection / tommaso zoppi, andrea ceccarelli, andrea bondavalli. - ELETTRONICO. - 2018-December:(2018), pp. 279-288. (Intervento presentato al convegno PACIFIC RIM INTERNATIONAL SYMPOSIUM ON DEPENDABLE COMPUTING tenutosi a Taipei, Taiwan nel 4-7/12/2018) [10.1109/PRDC.2018.00050].

On Algorithms Selection for Unsupervised Anomaly Detection

tommaso zoppi
;
andrea ceccarelli;andrea bondavalli
2018

Abstract

Anomaly detection, which aims at identifying unexpected trends and data patterns, has widely been used to build error detectors, failure predictors or intrusion detectors. Internal faults or malicious attacks have a different impact on the behavior of the system. They usually manifest as different observable deviations from the expected behavior, which may be identified by anomaly detection algorithms. Our study aims at investigating the suitability of unsupervised algorithms and their families in detecting either point, contextual or collective anomalies. To provide a complete picture, we consider both sliding and non-sliding window algorithms which operate in unsupervised mode. Along with qualitative analyses of each algorithm and family, we conduct an experimental campaign in which we run each algorithm on three state-of-the-art datasets in which we inject either point, contextual or collective anomalies. Results show that non-sliding algorithms are capable to detect point and collective anomalies, while they cannot effectively deal with contextual ones. Instead, sliding window algorithms require shorter periods of training and naturally build a local context, which allow them to effectively deal with contextual anomalies. Such observations are summarized to support the choice of the correct algorithm depending on the investigated class(es) of anomaly.
2018
Proceedings of IEEE Pacific Rim International Symposium on Dependable Computing, PRDC
PACIFIC RIM INTERNATIONAL SYMPOSIUM ON DEPENDABLE COMPUTING
Taipei, Taiwan
4-7/12/2018
Goal 17: Partnerships for the goals
tommaso zoppi, andrea ceccarelli, andrea bondavalli
File in questo prodotto:
File Dimensione Formato  
PRDC_CameraReady.pdf

accesso aperto

Tipologia: Pdf editoriale (Version of record)
Licenza: Creative commons
Dimensione 380.64 kB
Formato Adobe PDF
380.64 kB Adobe PDF

I documenti in FLORE sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificatore per citare o creare un link a questa risorsa: https://hdl.handle.net/2158/1139125
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 7
  • ???jsp.display-item.citation.isi??? 6
social impact