Collaborative Research: Elements: A Self-tuning Anomaly Detection Service

发现和理解数据中的异常行为在许多应用中非常重要。存在大量的异常检测算法，并且可能难以确定哪种算法最适合于特定域。 一旦选择了算法，用户必须手动调整许多参数以使算法表现良好;这需要深入了解机器学习过程，并了解不同算法之间的权衡，以选择性能最佳的方法。 为了解决这些困难，该团队开发了一个软件包，可以在数据集上测试一系列无监督异常检测技术，探索识别最佳拟合的选项，并以比手动调整更高的准确度对异常进行分类。该项目将在数据集上自动测试一系列无监督异常技术，从组合检测结果中提取知识，以可靠地区分异常和正常数据，并使用该知识作为标签来训练异常分类器;目标是以比通过彻底手动调整可实现的更高的准确度对异常进行分类。该方法可以应用于各种数据类型和域。由此产生的网络基础设施提供了免调优的异常检测功能，同时使其易于纳入特定领域的要求。它使科学家和工程师几乎没有异常检测技术的经验，以指导领域的专业知识异常检测过程。 对无监督异常检测包的评估将使用数据集以及与来自马萨诸塞州总医院/哈佛医学院、网络安全研究和Signify（原飞利浦照明）的合作者的合作关系，以确保在整个开发过程中验证该包的实用性和可用性。该奖项由高级网络基础设施办公室颁发，并得到计算机和信息科学与工程理事会下属的NSF信息和智能系统部门的共同支持。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Finding and understanding anomalous behavior in data is important in many applications. A large number of anomaly detection algorithms exist, and it can be difficult to determine which algorithm is best suited to a particular domain. And once an algorithm is selected, users must tune many parameters manually to get the algorithm to perform well; this requires in-depth knowledge of the machine learning process and an understanding of the trade-offs among different algorithms to select the best performing approach. To address these difficulties, this team develops a package that can test a range of unsupervised anomaly detection techniques on a dataset, explore options to identify best-fit, and classify anomalies with higher accuracy than manual tuning.The project will automatically test a range of unsupervised anomaly techniques on a data set, extract knowledge from the combined detection results to reliably distinguish between anomalies and normal data, and use this knowledge as labels to train an anomaly classifier; the goal is to classify anomalies with an accuracy higher than what is achievable by thorough manual tuning. The approach can be applied across of a range of data types and domains. The resulting cyberinfrastructure provides tuning-free anomaly detection capabilities while making it easy to incorporate domain-specific requirements. It enables scientists and engineers having little experience with anomaly detection techniques to steer the anomaly detection process with domain expertise. Evaluation of the unsupervised anomaly detection package will use data sets and partnerships with collaborators from the Massachusetts General Hospital/Harvard Medical School, Cyber Security research, and Signify (formerly Philips Lighting) to ensure that the utility and usability of the package is verified throughout the development process. This award by the Office of Advanced Cyberinfrastructure is jointly supported by the NSF Division of Information and Intelligent Systems within the Directorate for Computer and Information Science and Engineering.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.