Real-time detection of anomalies in streaming data is receiving increasing attention as it allows us to raise alerts, predict faults, and detect intrusions or threats across industries. Yet, little attention has been given to compare the effectiveness and efficiency of anomaly detectors for streaming data (i.e., of online algorithms). In this paper, we present a qualitative, synthetic overview of major online detectors from different algorithmic families (i.e., distance, density, tree or projection-based) and highlight their main ideas for constructing, updating and testing detection models. Then, we provide a thorough analysis of the results of a quantitative experimental evaluation of online detection algorithms along with their offline counterparts. The behavior of the detectors is correlated with the characteristics of different datasets (i.e., meta-features), thereby providing a meta-level analysis of their performance. Our study addresses several missing insights from the literature such as (a) how reliable are detectors against a random classifier and what dataset characteristics make them perform randomly; (b) to what extent online detectors approximate the performance of offline counterparts; (c) which sketch strategy and update primitives of detectors are best to detect anomalies visible only within a feature subspace of a dataset; (d) what are the tradeoffs between the effectiveness and the efficiency of detectors belonging to different algorithmic families; (e) which specific characteristics of datasets yield an online algorithm to outperform all others.
翻译:对流数据(即在线算法)异常现象的实时检测越来越受到越来越多的关注,因为它使我们能够提高警示,预测故障,并发现跨行业的入侵或威胁。然而,很少注意比较数据流数据(即在线算法)异常探测器的效能和效率。在本文中,我们对不同算法家庭(即距离、密度、树或投影型)的主要在线探测器进行定性和合成概览,并突出其构建、更新和测试检测模型的主要想法。然后,我们对在线检测算法及其离线对应方对在线检测算法进行定量实验性评估的结果进行透彻的分析。探测器的行为与不同数据集(即元性算法)的特点相关,从而提供对其性能的元级分析。我们的研究涉及从文献中缺失的一些洞见,例如:(a) 随机分类器探测器的可靠性如何,数据集的特征是随机的;(b) 在线探测器在多大程度上接近离线对应方的性能;(c) 哪些草图战略以及原始探测器的特性与不同的数据(即:可视的系统性能测算算法,哪些是不同的系统,哪些是可视的系统,哪些是不同结果的次等的。