1
$\begingroup$

I read one research paper and they said that they are using a threshold for anomaly detection. The threshold is determined to make some proportion of data of the validation dataset labeled as anomalies. how does this concept make sense

$\endgroup$
1
  • $\begingroup$ This is only half the story, as using a , say, 95% threshold naively will always (!) Label 5% of data as outliers ... Even if the system you monitor is behaving perfectly normal. You should look into false discovery rate (fdr) solutions $\endgroup$ Commented Oct 30, 2023 at 22:19

2 Answers 2

0
$\begingroup$

When your algorithms creates an anomaly detection model, it will create a set of expected values that represent normal value behaviours.You can then use this models to either alert based on the expected values with out a static threshold, or you can overlay this to some graph as a band. Ideally you need a considerable deviation from your expected values to trigger an alarm. Here the thresholds are calculated as error, or deviation from the expected and real values. You can apply a scaled min max threshold to this to have a good inference to the problem.When your data points are large in numbers, you cannot be able to determine the thresholds, here Thresholds may induce false positives but the outcomes are mostly better. You can make find the ideal thresholds by plotting an RC curve with TP and FP rates.

$\endgroup$
0
$\begingroup$

The way to tune the anomaly detection threshold is as follows:

  1. Construct a train set using a large sample of observations without anomalies.
  2. Take a smaller sample of observations containing anomalies (manually labelled) and use it to construct a validation and test set.
  3. Now train your anomaly detection model while tuning the threshold using the validation set and additionally using the test set to evaluate your model.
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.