Low-Cost Active Anomaly Detection with Switching Latency

Fengfan Qin,Hui Feng,Tao Yang,Bo Hu

doi:10.3390/app11072976

Abstract

Consider the problem of detecting anomalies among multiple stochastic processes. Each anomaly incurs a cost per unit time until it is identified. Due to the resource constraints, the decision-maker can select one process to probe and obtain a noisy observation. Each observation and switching across processes accompany a certain time delay. Our objective is to find a sequential inference strategy that minimizes the expected cumulative cost incurred by all the anomalies during the entire detection procedure under the error constraints. We develop a deterministic policy to solve the problem within the framework of the active hypothesis testing model. We prove that the proposed algorithm is asymptotic optimal in terms of minimizing the expected cumulative costs when the ratio of the single-switching delay to the single-observation delay is much smaller than the declaration threshold and is order-optimal when the ratio is comparable to the threshold. Not only is the proposed policy optimal in the asymptotic regime, but numerical simulations also demonstrate its excellent performance in the finite regime.

Highlights

Consider the problem of detecting a fixed number of anomalies among multiple processes
Each process may be in a normal or an abnormal state, and the state of each process does not change during the detection procedure
The expected cumulative cost incurred by all the abnormal processes during the entire detection procedure is given by

Summary

Introduction

Consider the problem of detecting a fixed number of anomalies among multiple processes. Each process may be in a normal or an abnormal state (note that the processes in an abnormal state are the anomalies, and our basic goal is to find out all the abnormal processes), and the state of each process does not change during the detection procedure. Once the state of the abnormal process is identified, the corresponding abnormal process stops incurring costs. Since abnormal processes are identified at different times, the duration of each abnormal process continuing incurring costs is different. We take the cumulative cost incurred by all the abnormal processes during the entire detection procedure as a measurement. Our objective is to find an active inference strategy, consisting of a selection rule governing which process to probe at each time, a stopping rule on when to terminate the detection procedure, and a decision rule on the final detection outcome, that minimizes the expected cumulative cost under reliability constraints

Objectives

Results

Discussion

Conclusion