Selective Anomaly Ensemble

Less is More: Building Selective Anomaly Ensemble

Abstract

Ensemble techniques for classification and clustering have long proven effective, yet anomaly ensembles have been barely studied. In this work, we tap into this gap and propose a new ensemble approach for anomaly mining, with application to event detection in temporal graphs. Our method aims to combine results from heterogeneous detectors with varying outputs, and leverage the evidence from multiple sources to yield better performance. However, trusting all the results may deteriorate the overall ensemble accuracy, as some detectors may fall short and provide inaccurate results depending on the nature of the data in hand. This suggests that being selective in which results to combine is vital in building effective ensembles—hence “less is more”.

We propose SELECT; an ensemble approach for anomaly mining that employs novel techniques to automatically and systematically select the results to assemble in a fully unsupervised fashion. We apply our method to event detection in temporal graphs, where SELECT successfully utilizes five base detectors and seven consensus methods under a unified ensemble framework. We provide extensive quantitative evaluation of our approach on five realworld datasets (four with ground truth), including Enron email communications, New York Times news corpus, and World Cup 2014 Twitter news feed. Thanks to its selection mechanism, SELECT yields superior performance compared to individual detectors alone, the full ensemble (naively combining all results), an existing diversity-based ensemble, and an unsupervised learning approach for weighted rank aggregation.

We share our code and datasets here.

Selective anomaly ensemble codes can be downloaded from here.

Please cite: (if you are using this work)

@inproceedings{DBLP:conf/sdm/Akoglu15,
author = {Shebuti Rayana and Leman Akoglu},
title = {Less is More: Building Selective Anomaly Ensembles with Application to Event Detection in Temporal Graphs},
booktitle = {Proceeding of SIAM International Conference on Data Mining, {SDM’15}},
year = {2015},
}

Datasets:

1. Enron
2. MIT Reality Mining
3. Twitter – 2014 (Domestic Security & Terrorism related DHS keywords filtered)
4. Twitter – 2014 (WorldCup)
5. Twitter – 2009 (Domestic Security & Terrorism related DHS keywords filtered)

These datasets can be downloaded from here.