4. KDE

• identification of rare items

• -> which raise suspicion by differeing significantly form the majority of the data…

• individuzal data instance

• that can be considered as anomalous with respect to rest of the data

• collection of related instances is anomalous with respect to the entire data set

• data instance is anomalouzs in specific context

• but not otherwise

• aggregate features over time

• i.e. sliding window

• threshold

• choose some distribution and fit distributino to data

• use kernel density estimation

• arbitrary

• yields only binary yes / no answer

  • would rather like probabilitsticc result

• how/which to choose?

• often not good fit.,..

• PDF:

  • continuous representation of probabilty variable distribution

  • integral equals 1

  • individual probability equals 0

  • all non-negative

• PF:

  • individual probabilites still 0

    • P(x) = 0

  • Integral between two points is smaller equal 1

• CDF:

  • cumulate probabiltiy from right to left until we reach 1…

  • -> integral P(z<=x) = integral from - infinity to x ; <= 1

• non parametric

  • we do not explicitly specify which probablity distribution to use

• density estimation

  • but we still use a probablity distributino (instead of naiver approach such as “remembering” normal)

• draw n univariate (no vectors) samples (independently and identically)

• use some kernel function and sum over these kernesl verschoben by the sample values normalized by the number of samples

• to smoothen them

• -> large bandwidth -> high degree of smoothing -> potential underfitting

• -> small bandwidth -> low degree of smoothing -> jagged -> overfitting

with bandwidth

without bandwidth

• split train data into n parts

• use n-1 for training and 1 for validation

• change the one for validation each epoch

• we have list of hyperparameters h

• we have our cross validation splits

1. for all hyperparameters

   1. for all cross validation splits

      1. fit model on data without current validation split

      2. eval on split

2. return h where average validation score is best

-> do cross validation for each hyperparameter

-> return the h where we receive the average best validation score (across the different cross validation runs)

• O(h*k)

• -> for all h parameters, run k validaiton runs…

• we put the value in our estimator

• if it lies below a threshold C

• => it is an anomaly…

• plot it on logarithmic scale (natural logarithm ln)

• -> as usually threshold is very small…