Scribd
Upload
18 views24 pages

Machine Learning - 1

This document discusses machine learning for anomaly detection. It covers motivation, algorithms, and examples for anomaly detection using Gaussian distributions to model normal behavior and identify anomalies. Key aspects covered include choosing features, building evaluation methods, and the differences between anomaly detection and supervised learning.

Uploaded by

Mohit Rai
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
18 views24 pages

Machine Learning - 1

This document discusses machine learning for anomaly detection. It covers motivation, algorithms, and examples for anomaly detection using Gaussian distributions to model normal behavior and identify anomalies. Key aspects covered include choosing features, building evaluation methods, and the differences between anomaly detection and supervised learning.

Uploaded by

Mohit Rai
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 24

Machine Learning

Anomaly Detection

Machine Learning
Motivation
Example

( )
Aircraft Engine Features Data Set :
○ Heat generated
○ Vibration intensity New Engine:
○ -----

𝑥
X
X X XX X
X X X XX
XX X
X X X
X X XX X X
X X X
X
𝑥
Density Estimation

Data Set :
Is anomalous?

𝑥
X
X X XX X Model
X X X XX
X
X
X X X Anomalous
X XX X X
X
X X X OK
𝑥
Anomaly Detection :Example

Fraud Detection
○ Features of user ’s activities
○ Model from the data
○ Identify unusual users by checking which have
Manufacturing
Monitoring computers in a data center
○ Features of machine
○ Memory use.
○ Number of disk accesses/second.
○ CPU load.
○ CPU load/network traffic.
Gaussian Distribution
Gaussian (Normal) Distribution

Say, , if is distributed Gaussian with mean


and variance
○

( )

𝜇
Gaussian Distributions Example

Check
www.desmos.com
Algorithm
Anomaly Detection : Basic Example

Anomalous if
( )

Assume , , and
,
○ Not anomalous

,
○ Anomalous

The example works when each record has one feature.


What if there are more than one features?
Algorithm
Training Set
1. Choose features that you think might be indicative of
anomalous examples.
2. Fit parameters and
()
○
()
○

3. Give new example , compute :

4. If , Anomalous
Building an Anomaly Detection System
Importance of Evaluation

When building a learning algorithm (choosing features


etc.), making decisions is much easier if we have way of
evaluating our learning algorithm.
Assume we have some labelled data, of anomalous and
non-anomalous examples. ( , if normal, if
anomalous)
Training set (assume normal examples
/ not anomalous)
Cross validation set

Test set
Air Craft Engine Motivating Example

10,000 good (normal) engines


20 flawed (anomalous) engines
Distribution
○ Training Set 6,000 good engines
○ CV 2,000 good engines ( ), 10 flawed engines ( )
○ Test 2,000 good engines ( ), 10 flawed engines ( )
Algorithm Evaluation

Fit model on training set


On a cross validation/test example , predict

Possible evaluation metrics


○ True positive, false positive, false negative, true negative
○ Precision/Recall
○ F1 - Score
Anomaly Detection vs. Supervised
Learning

Question
○ If we have labelled data (as discussed previously), why don’t we
use supervised learning algorithms?
Anomaly Detection vs. Supervised
Learning

Anomaly Detection Supervised Learning


○ Very small no of positive ○ Large no of positive and
examples ( ) negative examples
○ Large no of negative ○ Enough positive examples for
examples ( ) algorithm to learn what
○ Future anomalies might look positive examples look like.
completely different than ○ Future positive examples
what we have seen. likely to be similar to ones in
training set
Anomaly Detection vs. Supervised
Learning

Anomaly Detection Supervised Learning


○ Fraud detection ○ Email spam classification
○ Manufacturing fault ○ Weather prediction
○ Monitoring machines in a data ○ Cancer classification
centre
Choosing the Right Features to Use

Non-Gaussian Features

log(𝑥)
Introducing New Features

Monitoring computers in a data centre


○ Choose features that might take unusually large or small values
in the event of an anomaly
○ Memory use of computer
○ Number of disk accesses/sec
○ CPU load
○ Network traffic
How an anomalous data might look like?
○ Consider CPU load and network traffic
○ CPU load/Network traffic
○ (CPU load)2/Network traffic
Quiz
Acknowledgements
Acknowledgements
Material presented in these slides is obtained from
Prof. Andrew Ng course on Machine Learning

You might also like