Composite Anomaly Detection via Hierarchical Dynamic Search

Anomaly detection among a large number of processes arises in many applications ranging from dynamic spectrum access to \textcolor{NewColor}{cybersecurity}. In such problems one can often obtain noisy observations aggregated from a chosen subset of processes \textcolor{NewColor}{that} {conforms} to a tree structure. The distribution of these observation\textcolor{NewColor}{s}, based on which the presence of anomalies is detected, may be only partially known. This gives rise to the need for a search strategy designed to account for both the sample complexity and the detection accuracy, as well as cope with statistical models that are known only up to some missing parameters. In this work we propose \textcolor{NewColor}{a} sequential search strategy using two variations of the \acl{gllr} \textcolor{NewColor}{statistic}. Our proposed \ac{hds} strategy is shown to be order-optimal with respect to the size of the search space and asymptotically optimal with respect to the detection accuracy. An explicit upper bound on the error probability of \ac{hds} is established for the finite sample regime. Extensive experiments are conducted, demonstrating the \textcolor{NewColor}{performance} gains of \ac{hds} over existing methods.