Loda: Lightweight on-line detector of anomalies

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21230%2F16%3A00237783" target="_blank" >RIV/68407700:21230/16:00237783 - isvavai.cz</a>

Result on the web

<a href="http://dx.doi.org/10.1007/s10994-015-5521-0" target="_blank" >http://dx.doi.org/10.1007/s10994-015-5521-0</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1007/s10994-015-5521-0" target="_blank" >10.1007/s10994-015-5521-0</a>

Result language

angličtina

Original language name

Loda: Lightweight on-line detector of anomalies

Original language description

In supervised learning it has been shown that a collection of weak classifiers can result in a strong classifier with error rates similar to those of more sophisticated methods. In unsupervised learning, namely in anomaly detection such a paradigm has not yet been demonstrated despite the fact that many methods have been devised as counterparts to supervised binary classifiers. This work partially fills the gap by showing that an ensemble of very weak detectors can lead to a strong anomaly detector with a performance equal to or better than state of the art methods. The simplicity of the proposed ensemble system (to be called Loda) is particularly useful in domains where a large number of samples need to be processed in real-time or in domains where the data stream is subject to concept drift and the detector needs to be updated on-line. Besides being fast and accurate, Loda is also able to operate and update itself on data with missing variables. Loda is thus practical in domains with sensor outages. Moreover, Loda can identify features in which the scrutinized sample deviates from the majority. This capability is useful when the goal is to find out what has caused the anomaly. It should be noted that none of these favorable properties increase Loda’s low time and space complexity. We compare Loda to several state of the art anomaly detectors in two settings: batch training and on-line training on data streams. The results on 36 datasets from UCI repository illustrate the strengths of the proposed system, but also provide more insight into the more general questions regarding batch-vs-on-line anomaly detection.

Czech name

—

Czech description

—

Type

J_x - Unclassified - Peer-reviewed scientific article (Jimp, Jsc and Jost)

CEP classification

JD - Use of computers, robotics and its application

OECD FORD branch

—

Project

<a href="/en/project/GPP103%2F12%2FP514" target="_blank" >GPP103/12/P514: Real-time detection of anomalous events in a non-stationary environment</a><br>

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year

2016

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Name of the periodical

Machine Learning

ISSN

0885-6125

e-ISSN

—

Volume of the periodical

102

Issue of the periodical within the volume

2

Country of publishing house

US - UNITED STATES

Number of pages

30

Pages from-to

275-304

UT code for WoS article

000371460000005

EID of the result in the Scopus database

2-s2.0-84955680786