Rare Yet Popular: Evidence and Implications from Labeled Datasets for Network Anomaly Detection
Anomaly detection research works generally propose algorithms or end-to-end systems that are designed to automatically discover outliers in a dataset or a stream. While literature abounds concerning algorithms or the definition of metrics for better evaluation, the quality of the ground truth against which they are evaluated is seldom questioned. In this paper, we present a systematic analysis of available public (and additionally our private) ground truth for anomaly detection in the context of network environments, where data is intrinsically temporal, multivariate and, in particular, exhibits spatial properties, which, to the best of our knowledge, we are the first to explore. Our analysis reveals that, while anomalies are, by definition, temporally rare events, their spatial characterization clearly shows some type of anomalies are significantly more popular than others. We find that simple clustering can reduce the need for human labeling by a factor of 2x-10x, that we are first to quantitatively analyze in the wild.
Code (0)
등록된 구현이 없습니다.
Tasks
Anomaly DetectionSimilar Papers 제목 키워드 기반
GUIDED MCMC FOR SPARSE BAYESIAN MODELS TO DETECT RARE EVENTS IN IMAGES SANS LABELED DATA
Detection of rare events in images is a challenging task because of two main problems, the first problem is the lack of labeled data for rare category class and the second problem is a highly imbalanced data problem. Tra…
image-classificationImage ClassificationUnsupervised Image ClassificationZero-Shot LearningSTENCIL: Submodular Mutual Information Based Weak Supervision for Cold-Start Active Learning
As supervised fine-tuning of pre-trained models within NLP applications increases in popularity, larger corpora of annotated data are required, especially with increasing parameter counts in large language models. Active…
Active Learningtext-classificationText ClassificationFEVER Breaker's Run of Team NbAuzDrLqg
We describe our submission for the Breaker phase of the second Fact Extraction and VERification (FEVER) Shared Task. Our adversarial data can be explained by two perspectives. First, we aimed at testing model{'}s ability…
Think Before You Link: Rarity, Reasoning, and Retrieval in Multilingual Entity Linking
Multimodal entity linking grounds entity mentions in text and images to knowledge-base entries. These systems degrade on rare entities, but prior work measures rarity primarily through popularity-based metrics such as pa…
Entity LinkingFormalizing and falsifying causal pathways of rare events
Building on recent formalizations of root cause analysis for rare events (``outliers'') in structural equation models, we propose a formal definition of a causal pathway and discuss its testable implications. We identify…