# Confusion Matrix and AUC in univariate Anomaly Detection

In the code I upon a csv file which only has one column. The data in there in not that important just normal numbers.

# Pandas - data handling
import pandas as pd

# Numpy for mathematical operations
import numpy as np
import pandas as pd

# Scikit learn for the DBSCAN algorithm
from sklearn.cluster import KMeans

# Matplotlib - plots
import matplotlib.pyplot as plt

import seaborn as sns

# Add manually an anomaly value
for i in range(0, 50):
all_data = all_data.append({all_data.column.max() + np.random.randint(1000, 2000) }, ignore_index=True)

clf = KMeans(n_clusters=2, init='k-means++', max_iter=300, n_init=10, random_state=1)

clf.fit(all_data.column.values.reshape(-1, 1))

all_data_prd = clf.predict(all_data.column.values.reshape(-1, 1))
all_data_prd

plt.scatter(all_data_prd, all_data.valueData_value, c=all_data_prd)



My question is if it is possible to have a confusion matrix and roc curve in this case when I only have once column.

To this column I have added some anomalies.

The goal:

1. Add these anomalies that are way way bigger than the maximum value of the column and then check how many out of the 50 added anomalies, how many the K-Means finds
2. Add these anomalies that are not that much bigger than the maximum value of the column then check how many out of the 50 added anomalies are found. At the end I want a Confusion matric and a ROC graph to see how good they perform.
• It looks to me like there are lots of problems with this approach: (1) I doubt k-means is a good approach for one-dimension data, there are certainly better ways to detect anomalies (2) confusion matrix and ROC are evaluation measures for classification, so it's not going to work directly with the output of k-means. (3) since you know what is regular data and anomalies, why not using supervised classification? (4) Finally if the goal is just to find the threshold which is optimal to separate regular cases vs anomalies, you might not even need ML. – Erwan Mar 6 '20 at 13:05
• @Erwan, thank you for the very detailed comment. I had some questions would appreciate if you could give me a feedback, if not still thank you. 1. What other methods/algorithms or approaches would you suggest for this case ? 3. What difference would supervised classification make in this case and which exact method you had in mind ? 4.what could I use then ? – E199504 Mar 6 '20 at 19:39

The idea is simply to evaluate the performance for every possible threshold, i.e. count the number of True/False Positive/Negative for every value. Let's say you take the set $$S$$ of all the distinct values in your column. For every value $$t \in S$$ you calculate the confusion matrix (i.e. how many TP/FP/TN/FN) obtained by predicting every value $$x$$ as positive if if $$x>t$$, negative otherwise.