System and method for one-class similarity machines for anomaly detection
One embodiment provides a system for facilitating anomaly detection. During operation, the system determines, by a computing device, a set of training instances, wherein a training instance represents a single class of data within a predefined range. The system computes a similarity score for each testing instance in a set of testing instances, wherein the similarity score is based on a similarity function which takes as input a respective testing instance and the set of training instances. The system determines a boundary threshold based on an ordering of the similarity score for each testing instance. The system classifies a first testing instance as an anomaly responsive to determining that the first testing instance falls outside the boundary threshold, thereby enhancing data mining and outlier detection in the single class of data using unlabeled training instances.
1. A computer-implemented method for facilitating anomaly detection, the method comprising:
determining, by a computing device, a set of training instances, wherein a training instance represents a single class of data associated with a physical system and within a predefined range;
computing a first similarity score for each testing instance in a set of testing instances, wherein the first similarity score is based on a similarity function which takes as input a respective testing instance and the set of training instances;
determining a first boundary threshold based on an ordering of the first similarity score for each testing instance;
classifying a first testing instance as an anomaly responsive to determining that the first testing instance falls outside the first boundary threshold;
computing a second similarity score for each training instance, wherein the second similarity score is based on a second similarity function which takes as input a respective training instance and each of a remainder of the set of training instances;
determining a second boundary threshold based on an ordering of the second similarity score for each training instance; and
classifying a second testing instance as an anomaly responsive to determining that the second testing instance falls outside the second boundary threshold,
thereby enhancing data mining and outlier detection in the single class of data using unlabeled training instances.
2. The method of claim 1 , wherein the similarity function is based on one or more of:
a radial basis function;
a linear kernel function;
a polynomial function of a predetermined degree;
a similarity function which meets specific characteristics of the training instances and the testing instances; and
any similarity function.
3. The method of claim 1 , wherein prior to computing the first similarity score for each testing instance, the method further comprises:
pre-processing the set of training instances by:
determining one or more potential anomalies in the set of training instances; and
removing the one or more potential anomalies based on a method for detecting outliers in a set of data.
4. The method of claim 1 , further comprising:
applying, to the training instances and the test instances, a normalization or a scaling technique based on one or more of:
a minimum maximum scaling technique;
an L1-norm or a least absolute deviations method;
an L2-norm or a least squares method; and
any normalization or scaling technique.
5. The method of claim 4 , wherein applying the normalization or the scaling technique further comprises applying the normalization or the scaling technique to one or more of:
a feature vector, wherein the feature vector describes a set of numeric features associated with an object or a testing instance;
values of time series variables at a first point in time, wherein the set of training instances and the set of testing instances include the time series variables at multiple points in time; and
each time series variable.
6. The method of claim 1 , wherein prior to computing the first similarity score for each testing instance, the method further comprises:
reducing a total number of the training instances based on one or more of:
a downsampling technique;
removing redundant training instances; and
a technique that reduces the total number of the training instances.
7. A computer system for facilitating characterization of a time series of data associated with a physical system, the computer system comprising:
a processor; and
a storage device storing instructions that when executed by the processor cause the processor to perform a method, the method comprising:
determining, by the computer system, a set of training instances, wherein a training instance represents a single class of data associated with a physical system and within a predefined range;
computing a first similarity score for each testing instance in a set of testing instances, wherein the first similarity score is based on a similarity function which takes as input a respective testing instance and the set of training instances;
determining a first boundary threshold based on an ordering of the first similarity score for each testing instance;
classifying a first testing instance as an anomaly responsive to determining that the first testing instance falls outside the first boundary threshold;
computing a second similarity score for each training instance, wherein the second similarity score is based on a second similarity function which takes as input a respective training instance and each of a remainder of the set of training instances;
determining a second boundary threshold based on an ordering of the second similarity score for each training instance; and
classifying a second testing instance as an anomaly responsive to determining that the second testing instance falls outside the second boundary threshold,
thereby enhancing data mining and outlier detection in the single class of data using unlabeled training instances.
8. The computer system of claim 7 , wherein the similarity function is based on one or more of:
a radial basis function;
a linear kernel function;
a polynomial function of a predetermined degree;
a similarity function which meets specific characteristics of the training instances and the testing instances; and
any similarity function.
9. The computer system of claim 7 , wherein prior to computing the first similarity score for each testing instance, the method further comprises:
pre-processing the set of training instances by:
determining one or more potential anomalies in the set of training instances; and
removing the one or more potential anomalies based on a method for detecting outliers in a set of data.
10. The computer system of claim 7 , wherein the method further comprises:
applying, to the training instances and the test instances, a normalization or a scaling technique based on one or more of:
a minimum maximum scaling technique;
an L1-norm or a least absolute deviations method;
an L2-norm or a least squares method; and
any normalization or scaling technique.
11. The computer system of claim 10 , wherein applying the normalization or the scaling technique further comprises applying the normalization or the scaling technique to one or more of:
a feature vector, wherein the feature vector describes a set of numeric features associated with an object or a testing instance;
values of time series variables at a first point in time, wherein the set of training instances and the set of testing instances include the time series variables at multiple points in time; and
each time series variable.
12. The computer system of claim 7 , wherein prior to computing the first similarity score for each testing instance, the method further comprises:
reducing a total number of the training instances based on one or more of:
a downsampling technique;
removing redundant training instances; and
a technique that reduces the total number of the training instances.
13. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method, the method comprising:
determining, by the computer system, a set of training instances, wherein a training instance represents a single class of data associated with a physical system and within a predefined range;
computing a first similarity score for each testing instance in a set of testing instances, wherein the first similarity score is based on a similarity function which takes as input a respective testing instance and the set of training instances;
determining a first boundary threshold based on an ordering of the first similarity score for each testing instance;
classifying a first testing instance as an anomaly responsive to determining that the first testing instance falls outside the first boundary threshold;
computing a second similarity score for each training instance, wherein the second similarity score is based on a second similarity function which takes as input a respective training instance and each of a remainder of the set of training instances;
determining a second boundary threshold based on an ordering of the second similarity score for each training instance; and
classifying a second testing instance as an anomaly responsive to determining that the second testing instance falls outside the second boundary threshold,
thereby enhancing data mining and outlier detection in the single class of data using unlabeled training instances.
14. The storage medium of claim 13 , wherein the similarity function is based on one or more of:
a radial basis function;
a linear kernel function;
a polynomial function of a predetermined degree;
a similarity function which meets specific characteristics of the training instances and the testing instances; and
any similarity function.
15. The storage medium of claim 13 , wherein prior to computing the first similarity score for each testing instance, the method further comprises one or more of:
pre-processing the set of training instances by:
determining one or more potential anomalies in the set of training instances; and
removing the one or more potential anomalies based on a method for detecting outliers in a set of data; and
reducing a total number of the training instances based on one or more of:
a downsampling technique;
removing redundant training instances; and
a technique that reduces the total number of the training instances.
16. The storage medium of claim 13 , wherein the method further comprises:
applying, to the training instances and the test instances, a normalization or a scaling technique based on one or more of:
a minimum maximum scaling technique;
an L1-norm or a least absolute deviations method;
an L2-norm or a least squares method; and
any normalization or scaling technique.
17. The storage medium of claim 16 , wherein applying the normalization or the scaling technique further comprises applying the normalization or the scaling technique to one or more of:
a feature vector, wherein the feature vector describes a set of numeric features associated with an object or a testing instance;
values of time series variables at a first point in time, wherein the set of training instances and the set of testing instances include the time series variables at multiple points in time; and
each time series variable.