Anomaly Detection

This chapter presents an extension of conformal prediction for anomaly detection applications. It includes the presentation and discussion of the Conformal Anomaly Detector (CAD) and the computationally more efficient Inductive Conformal Anomaly Detector (ICAD), which are general algorithms for unsupervised or semi-supervised and offline or online anomaly detection. One of the key properties of CAD and ICAD is that the rate of detected anomalies is well-calibrated in the online setting under the randomness assumption. Similar to conformal prediction, the choice of Non-Conformity Measure (NCM) is of central importance for the classification performance of CAD and ICAD. A novel NCM for examples that are represented as sets of points is presented. One of the key properties of this NCM, which is known as the Directed Hausdorff k-Nearest Neighbour (DH-kNN) NCM, is that the p-value for an incomplete test example monotonically decreases as more data points are observed. An instance of CAD based on DH-kNN NCM, known as the Sequential Hausdorff Nearest Neighbour Conformal Anomaly Detector (SHNN-CAD), is presented and discussed for sequential anomaly detection applications. We also investigate classification performance results for the unsupervised online SHNN-CAD on a public dataset of labelled trajectories.