week 3

Question 1

anomalies

Answer 1

point anomaly
contextual (sequential) anomaly - anomalous within a context, use sliding windows, learn model for predicting next value, compute expected next value, evaluate residual using real next value, use decision threshold to decide if it is anomaly
collective anomaly - individual points are not anomalous by themselves, treat set of points as datasets, compare these sets (kind of like a sliding window)

Question 2

classification

Answer 2

OSVM - maximize negative space, minimize positive space
Isolation Forest - repeat N times - pick feature f, split randomly, continue until all leaves contain singletons, path length to leaf = isolation score, average isolation score over all trees => anomaly score (goal is to isolate anomalies)

Question 3

NN based

Answer 3

distance-based = a point is anomalous if distant from other points
density-based = a point is anomalous if in low density region
LOF(q) = ratio of average local reachability density of q’s k-nn and local reachability density of q
if LOF(q) < 1 => higher density => inlier
if LOF(q) > 1 => lower density => outlier

Question 4

Clustering based

Answer 4

normal data records belong to large and dense clusters
anomalies do not belong to any cluster or form very small clusters
local anomalies are distant from all other points in the same cluste

Question 5

Clustering based

Answer 5

normal data records belong to large and dense clusters
anomalies do not belong to any cluster or form very small clusters
local anomalies are distant from all other points in the same cluster

Question 6

Spectral techniques

Answer 6

PCA - outliers have variability in the smallest Principle Component (datapoints that vary in unexplained dimensions are anomalous)
Autoencoder - encode data into low dimension, decode it back to high dimension, see difference between original and reconstructed data

Question 7

Sequential (discrete) processes

Answer 7

Markov processes - dependent only on last action
state transition diagrams - if n states possible, nxn matrix describing probability of going from 1 state to another (remember laplace smoothing)
ngrams - instead of future depending only on last action, it can depend on last 2/3/4/… actions => process in sequences