New Method of Anomaly Detection Incorporates Human Feedback for Improved Performance

Anomaly detection is a valuable tool in distinguishing normal data from abnormal data. It is achieved by assigning anomaly scores to each instance, which are then ranked and evaluated. However, using a static unsupervised streaming anomaly detector can be difficult to dynamically adjust anomaly score calculation. To overcome this, a research team led by Prof. Zhiwen Yu has developed a new method of anomaly detection that incorporates human feedback.

Methodology and Results

The team’s new method, called ISPForest, is a human-machine interactive streaming anomaly detection method. It can be updated online under the guidance of human feedback, which is used to adjust the anomaly score calculation and structure of the detector. The feedback helps to attain more accurate anomaly scores in the future.

To improve the original anomaly detector, the research team analyzed the anomaly detection principle of the space partitioning forest model. They constructed regional likelihood function and instance likelihood function, respectively, to depict the consistency of the detection results and the human feedback. The parameters and structures of the original anomaly detector are adjusted timely according to the gradient decrease process following the principle of maximum likelihood estimation. Finally, an uncertainty function of the detection results is designed to control the frequency of human-machine interaction.

The experimental results showed that incorporating feedback can improve the performance of anomaly detectors with only a few human efforts. The method is useful in adapting to a dynamic environment, and the performance of the detector is improved promptly with a small increase in labor costs.

Future Work

Future work can consider the extension of the method and explore the time-series anomaly detection under the feedback mechanism. The new method, ISPForest, is a significant improvement over previous anomaly detection methods. It is a valuable tool to improve the accuracy of anomaly scores and to adapt to dynamic environments.