Kernel-based nonparametric anomaly detection

An anomaly detection problem is investigated, in which there are totally n sequences, with s anomalous sequences to be detected. Each normal sequence contains m independent and identically distributed (i.i.d.) samples drawn from a distribution p, whereas each anomalous sequence contains m i.i.d. samples drawn from a distribution q that is distinct from p. The distributions p and q are assumed to be unknown a priori. The scenario with a reference sequence generated by p is studied. Distribution-free tests are constructed using maximum mean discrepancy (MMD) as the metric, which is based on mean embeddings of distributions into a reproducing kernel Hilbert space (RKHS). It is shown that as the number n of sequences goes to infinity, if the value of s is known, then the number m of samples in each sequence should be of order O(log n) or larger in order for the developed tests to consistently detect s anomalous sequences. If the value of s is unknown, then m should be of order strictly larger than O(log n). The computational complexity of all developed tests is shown to be polynomial. Numerical results demonstrate that these new tests outperform (or perform as well as) tests based on other competitive traditional statistical approaches and kernel-based approaches under various cases.