Discusión de resultados en relación al marco teórico

Anomaly detection refers to finding specific data points, or observations, located within datasets with characteristics not present elsewhere in the data. Specific non-characteristic

observations are called anomalies, outliers, novel events, noise, exceptions, etc. depending on the specific application domain [10], [36], [45]. Within this text we will refer to anomalies and outliers interchangeably and we utilize the outlier definition established by Grubbs [46]: “An outlying observation, or “outlier,” is one that appears to deviate markedly from other members of the sample in which it occurs.”

Anomalies within dataset can be attributed to one of two possible sources. An outlying point may be an extreme, albeit normal, value of the system under study. Given a dataset is large enough, analysts expect to see extreme valued observations as most systems worthy of study exhibit variability in measures of interest to researchers. For example, a far-northern city experiencing a day of unusual warmth during the winter months. While this may be a rare

occurrence, given a long enough period of study, we would expect to find periods with

temperatures sufficiently different than the mean as to indicate an outlier. Alternately, an outlier may be attributed to some systemic failure of the experimental process or transcription error. For example, a temperature sensor failing in a vehicle engine, or a transcription error while recording data. We consider intrusion detection, or attempted intrusions, as a systemic failure of the

system. While anomalous observations must be attributable to one of the previously discussed sources, domain expertise is required to determine to which source the anomaly should be assigned [46].

Observations identified as outliers exhibit two properties. First, anomalous observations are rare occurrences within the data. This property is somewhat obvious, given a sufficient number of the same type of anomalous observations exist within a dataset, when taken collectively these ‘anomalies’ would form a normal pattern within the data, and thus not be anomalies. Second, anomalous points are distinct and sufficiently different from other observations in the data with respect to the features used to describe the collection of observations [36], [47]. If a potential anomalous point, described by features in the data is indistinguishable from the other points in the data, then this point is merely a normal point.

There are two primary anomaly taxonomies, local and global. Local anomalies can be

subdivided into contextual (conditional), and collective anomalies. Global anomalies can be

found by observing the entirety of the available dataset, whereas local anomalies require evaluation of points in relation to neighboring points [47]. The classification of anomalies into their appropriate taxonomy is data dependent. Global (point) anomalies can occur in any dataset, however local anomalies require that data contained with the set be somewhat related. Point anomalies can easily be considered contextual anomalies if the points are analyzed with respect

to additional features within the data. Point anomalies can also be considered collective anomalies if considered within a collection of related data [36].

An anomaly may be characterized as a global (also known as point) anomaly if the

individual observation is sufficiently different than the rest of the data. Global anomalies are the simplest and the vast majority of research on anomaly detection is devoted to identification of point anomalies [36], [47]. An example of a global anomaly is shown in Figure 1.

Figure 1. Global (Point) Anomaly

The data points contained with the two dashed ellipses indicate the existence of two discrete

clusters of observations. In the Figure 1 example, the data points are described by Feature 1 and

Feature 2. The data point encircled by the solid black line is an example of a global (point)

anomaly, as its location in the feature-space is far separated from the two clusters, and, there exists only one observation in the local neighborhood.

A contextual anomaly differs from a point anomaly in that a contextual anomaly is only anomalous in some contexts, but not in others. The contextual component of the anomaly is the structure of the data in the neighborhood of the anomalous point, what makes the point an outlier is the behavior of that point in relation to that of its local context [36], [47]. Figure 2 depicts a

notional plot of Feature 1 and Feature 2.

Figure 2. Contextual Anomaly

Observe the groupings of like-points contained within the dashed circles. Note that a circle point is located adjacent to the dash point grouping, highlighted by a solid circle, this circular-point is a contextual anomaly due to its location adjacent to the dashed-point grouping. The anomalous

point is only anomalous conditioned on the type of neighboring points. If the anomalous point

was located within the circular-points region, this point would no longer be anomalous. Also consider the figure if the dashed-points were removed from the plot as shown in Figure 3.

Figure 3. Contextual to Global Anomaly

In this case, the contextual anomalous point would still be considered an anomaly, however, now we would categorize this point as a global (point) anomaly as the context of the removed dashed- points is missing.

A collective anomaly is a set of data points that is anomalous in relation to the entirety of the dataset. Each individual point within a collective anomaly may be normal in relation to the dataset, however the proximity of these points to one another in relation to the behavior of the data across the set results in a collective anomaly [36], [47]. Figure 4 depicts a notional plot of

Figure 4. Collective Anomaly

The area encircled by the dashed-ellipse is an example of a collective anomaly. Observe the

periodic nature of the temperature across the time axis, there are regular occurring local

maximums and minimums. This normal pattern is not observed for the cycle identified within the dashed-ellipse. This is an example of a collective anomaly. Please note that the temperatures in this anomalous region fall with the normal range across the entirety of the dataset, what makes these points anomalous is their collective contribution in distorting the normal periodic nature of the temperature-time plot. Figure 5 depicts an example of a global, contextual and collective

Figure 5. Collective, Global, and Global Anomaly

Observe the anomalous region of the figure highlighted by the dashed-ellipse. Now we have

temperature values that fall greatly ouside the range of the temperature measures elsewhere in in

the data indicating a global (point) anomaly. Addiditonally, we observe two local minimums seperated by a local maximum in rapid succession, with all other local minimums occuring in regular periodic intervals. Figure 5 depicts a notional case where we are able to justify the anomalous points as being of all three anomaly taxonomies.

The selection of an appropriate detection methodology is dependent on the type of anomalies expected to be found in the data [36]. Ideally, we would like to apply an anomaly detection methodology with the capability to detect all classes of anomalies (point, contextual, and collective) with equal capability. In practice however, the capability of anomaly detection methods to find outliers is dependent on the class of anomalies present in the data. Analysts must carefully consider the nature of the expected anomalies prior to selection of an anomaly detection

mythology. Another important consideration to the choice of an anomaly detection method is the availability and type of data.