Anomaly detection under a nonlinear system cost objective function

Andrey Gurevich, Kobi Cohen, Qing Zhao

Abstract: We consider the problem of anomaly detection among K heterogeneous processes. At each given time, a single observation (or a fixed batch of observations) is collected from a chosen process. The observations from each chosen process follow two different distributions, depending on whether the process is normal or abnormal. Each anomalous process incurs a cost until its anomaly is identified and fixed, and the cost is nonlinear (specifically, polynomial with degree d) with the duration of the anomalous state. The objective is a sequential search strategy that minimizes the total expected cost incurred by all the processes during the detection process under reliability constraints. We propose a search algorithm that consists of exploration, exploitation, and sequential testing phases. We analyze the approximation ratio and the regret of the algorithm for d ≥ 1, and establish its asymptotic optimality for d =1.