Subspace selection for anomaly detection: An information theory approach

We present a novel subspace selection algorithm for anomaly detection. Our method is based on the observation that it is easier to detect anomalies in subspaces comprise of highly correlative attributes. More specifically, it uses the Rokhlin metric [22] to evaluate the smallest information distance in the case of two attributes, and an extension of the Rokhlin distance in cases where more than two attributes are involved. In order to determine the set of subspaces to use, we apply a variation of the well known agglomerative clustering algorithm with the extended Rokhlin metric as the underlying distance function. An extensive evaluation that we conducted demonstrates that in most cases: (1) Our method outperforms state-of-the-art subspace selection algorithms for anomaly detection. (2) Our method yields significantly fewer subspaces (on average) than the other approaches, and (3) Our method does not require any tuning of parameters.