Hashing for Structure-based Anomaly Detection

TL;DR

Given a dataset $X = G \cup A$ where genuine data lie near low-dimensional structures, the paper tackles detecting samples that do not conform to any structure by learning multiple models and embedding the data into a high-dimensional Preference Space. It introduces RuzHash-iForest, an isolation-based detector that uses a novel RuzHash Locality Sensitive Hashing scheme to approximate the Ruzicka distance in the Preference Space, avoiding explicit high-dimensional distance computations. The approach couples Preference Embedding with an ensemble of RuzHash-iTrees and achieves competitive ROC AUC with substantially lower computational cost than PI-Forest, demonstrated on synthetic and AdelaideRMF datasets. The work provides public code and outlines future directions such as exploring additional distance measures and their corresponding LSH schemes for structure-based anomaly detection.

Abstract

We focus on the problem of identifying samples in a set that do not conform to structured patterns represented by low-dimensional manifolds. An effective way to solve this problem is to embed data in a high dimensional space, called Preference Space, where anomalies can be identified as the most isolated points. In this work, we employ Locality Sensitive Hashing to avoid explicit computation of distances in high dimensions and thus improve Anomaly Detection efficiency. Specifically, we present an isolation-based anomaly detection technique designed to work in the Preference Space which achieves state-of-the-art performance at a lower computational cost. Code is publicly available at https://github.com/ineveLoppiliF/Hashing-for-Structure-based-Anomaly-Detection.

Figures (5)

• Figure 1: RuzHash-iForest detects anomalies in $X$ that do not conform to structures. (a) Genuine points $G$, in green, described by two lines of parameters $\boldsymbol{\theta}_1$ and $\boldsymbol{\theta}_2$, and anomalies $A$ in red. (b) Data are mapped to a high-dimensional Preference Space where anomalies result in isolated points (visualized via MDS Kruskal64a). (c) Anomaly score $\alpha(\cdot)$ (color coded) is computed via RuzHash-iForest.
• Figure 2: On the left, split performed by RuzHash. In the middle, nodes aggregation where the groups has been color coded. On the right, resulting tree with branching factor $b = 2$.
• Figure 3: Example of binarization.
• Figure 4: Correlation between Ruzicka and RuzHash.
• Figure 5: (a) Average ROC AUCs. (b) Average test times. (c) Relation between best average ROC AUC and corresponding test time.