Sequential Anomaly Detection Using Nonparametric Density Estimators

Abstract

In this paper, we introduce an online anomaly detection algorithm to detect the anomalies in the observed data with two step approach in an unsupervised framework. In the first step, we estimate the density of the sequentially observed data with a novel kernel based approach. To this end, we partition the observation space and use nonparametric Kernel Density Estimator (KDE) in each region on a partition such that we do not assume any underlying distribution for the data. Then, we compare the estimated density of the data with a threshold to decide whether it is anomalous. We also solve the bandwidth selection problem in kernel based approaches in an efficient way. For this, we assign a set of kernel bandwidth values to each region, and make each estimator to converge to the best bandwidth choice for the corresponding subspaces in time. In our experiments, we show that our algorithm significantly outperforms the anomaly detection algorithms, which are highly used in the literature.