Deep End-to-end Unsupervised Anomaly Detection 
Authors: Li Tangqing
Wang Zheng
Liu Siying
Daniel Lin Wen-Yan
Venue:  (2020)

Abstract: This paper proposes a novel method to detect anomalies in large datasets under a fully unsupervised setting. The key idea behind our algorithm is to learn the representation underlying normal data. To this end, we leverage the latest clustering
technique suitable for handling high dimensional data. This hypothesis provides a reliable starting point for normal data selection. We train an autoencoder from the normal data subset, and iterate between hypothesizing normal candidate subset
based on clustering and representation learning. The reconstruction error from the learned autoencoder serves as a scoring function to assess the normality of the data. Experimental results on several public benchmark datasets show that the proposed method outperforms state-of-the-art unsupervised techniques and is comparable to semi-supervised techniques in most cases.

Under review as a conference paper at ICLR 2020
DEEP END-TO-END UNSUPERVISED ANOMALY DE- TECTION
Anonymous authors Paper under double-blind review
ABSTRACT
This paper proposes a novel method to detect anomalies large datasets under fully unsupervised setting. The key idea behind algorithm is to learn the representation underlying normal data. To this end, we leverage the latest clustering technique suitable for handling high dimensional data. This hypothesis provides a reliable starting point for normal data selection. We train an autoencoder from the normal data subset, and iterate between hypothesizing normal candidate subset based on clustering and representation learning. The reconstruction error from the learned autoencoder serves as a scoring function to assess the normality of the data. Experimental results on several public benchmark datasets show that the proposed method outperforms state-of ofee-of-the- ofr unsupervised techniques and is comparable semi-supervised techniques in most cases.
INTRODUCTION
Anomaly detection refers to the identification of patterns that do not conform expected normal behavior (Chandola et al. (2009)). ) It is a critical task diverse application domains such as fraud detection (Phua et al. (2010)). intrusion detection (Lazarevic et al. (2003)) and surveillance video profiling (Xiang & Gongl 2008); ; Saligrama et al. (2010)) While the concept of an anomaly is intu- itively easy for humans understand, is hard to define mathematically. Fundamentally, anomaly is something with insufficient similarity to the rest of the data. This similarity can be computed on the basis of some feature difference. However, what makes an ideal feature representation for the data depends on what constitutes an anomaly. This forces anomaly detection into chicken-or-egg problem in which there are pair of problems, neither of which can be solved before the other.
To date, number of works have attempted this problem by training an autoencoder to create low- dimensional representations for anomaly detection (Chalapathy et al. (2018) Zhai et al. (2016); Zong et al. (2018)) ). The anomalies are rejected and the autoencoder retrained (Mishne & Cohen (201)) 7); Wang et al. (2017)). While this gives reasonable results, it is fundamentally dependent on how well the first iteration solves the problem.
We propose a solution which anomalies can be defined using approximately correct features. This is achieved through an observation. Given a feature, anomalies approximately correspond to instances of high variance distributions. Such instances can be identified using a distribution ceaettion-cuuteiing (Lin al. 2018)) framework. This hypothesis provides reliable starting point for normal data selection. We train an autoencoder from the normal data subset, and iterate between hypothesizing normal candidate subset and representation learning. The reconstruction error serves
scoring function to assess the normality of the data. The proposed framework does not rely on any training labels. Instead, iteratively distills out anomalous data and improves the learned representation of normal data by incorporating clustering techniques into the process.
We extensively assess the broad applicability the proposed model on network intrusion, image and video data. Empirical results show that the proposed method outperforms the existing state-of-art approaches in terms of both accuracy and robustness the percentage of anomalous data.
RELATED WORKS
Existing anomaly detection methods be grouped into three categories.

---

Under review as a conference paper at ICLR 2020
Reconstruction-based method These methods assume that anomalies incompressible and thus cannot be effectively reconstructed from -in-dimenioonal projections. Classical methods like Principle Component Analysis(PCA) (LTJolliffe (1986)) and Robust-PCA (Candès et al. (201T))
motivated by this assumption. In recent works, different forms of deep autoencoder are proposed to analyze the reconstruction enror. Xia et al. (Xia al. (2015) show that by introducing regularizing term to convolutional autoencoder, the anomalies tend to produce a bigger reconstruction error. Variational Autoencoder (VAE) (An & Cho (2015)) (215)) and Generative Adversarial Networks (GANs) (Schlegl et al. (2019)) have also been introduced to perform reconstruction- based anomaly detection. These methods demonstrate promising results when the anomaly ratio fairly low. Although the reconstruction of anomalous samples, based on a reconstruction scheme optimized for normal data, tends to generate a higher error, a significant amount of anomalous samples could mislead the autoencoders to learn the correlations in the anomalous data instead.
Density estimation and clustering Motivated by the assumption that anomalies occur less fre- quently, these algorithms treat anomalies as low-density regions in some feature space. Clustering analysis, such as Rob (JooSeuk Kim Scott (2008), is often used for density estimation and anomaly detection. Unfortunately, due to the curse of dimensionality, these methods are less applicable to analysing high-dimensional data, where density estimation a challenge in itself.
A two-step approach is normally adopted to counter this issue, where dimensionality reduction is conducted first, followed by clustering analysis as a separate step. One drawback of this approach is that dimensionality reduction is trained without the guidance from the subsequent clustering analysis; hence the key information for clustering analysis could be lost during dimensionality reduction. Recent works jointly leamn dimensionality reduction and clustering components based on deep autoencoder (Zhai et al. (2016); Zong et al. (2018)). Notably, DAGMM (Zong et al. (2018) utilizes autoencoder to generate low-dimensional representation and its reconstruction eлror, which is further fed into an estimation network based on Gaussian Mixture GGMM) However, its autoencoder was trained on the whole dataset, is vulnerable high percentage of anomalous samples and may learn wrong correlations. In contrast, our proposed method addresses this issue by first finding a normal candidate subset to train an autoencoder and then iterating between representation learning and refinement of the normal candidate.
One-class classification One-class SVM (Erfani et al.; Chalapathy et al. (0118) is also widely used, Under this framework, a discriminative boundary surrounding the normal instances is learned by algorithms. However, when dimensionality goes higher, such techniques often suffer from suboptimal performance due to the curse of dimensionality. OCNN (Chalapathy et al. (2018)) attempted to circumvent this problem by using an autoencoder for dimensionality reduction. However, OCNN requires training data with relatively low anomaly ratio, in order to obtain an optimized NN model to differentiate anomalies from single-class normal data.
PROBLEM FORMULATION
l...., N. E R be the set of input data points that contains a certain percentage of anomaly. The goal of anomaly detection is to learn a scoring function h(x), h : I& + R, to classify samples x, based on some threshold X:
0, if h(x:) < A
y/4 1,
if ((x,) 2 X
(1)
where y, are the labels. y; = 0 indicates x; is normal and y; = indicates anomalous.
An overview of the proposed end-to-end anomaly detection system is presented in Fig. The major component of this system is an autoencoder that learns low-dimensional representation of the input data that are often of high dimensions, to enable simplified modeling of the underlying distribution of the data. Under fully unsupervised setting, the only information we are given is the set of input data X, without any label information. As an initialization, we leverage the latest clustering technique for high- high-dimensional data (Lin et al. (2018)) to provide soft supervisory signals.
Since input data is unlabelled, derive "training" set Strain, where Strain following:
X based on the
Strain C(X,Po)
2

---

Under review as a conference paper at ICLR 2020
Re-model normal data
X
Resudert candidate
Nurrral
Nannal
Clascrisg
Z
Distribution Clustering
Figure I: Flow-chart of the proposed end-to-end anomaly detection system.
where represents a selection process based on clustering output, and Po represents the percentage of anomaly, it controls which are the clusters be accepted into the "training" set. In experiments, we compute the threshold as the (100 - po percentile of cluster variance, and accept clusters with variance smaller than this threshold. The assumption here is that clusters with large variance likely to contain anomalous members.
3.1 SCORING FUNCTION LEARNING
The autoencoder network provides two sources of features: (1) a now-dimensional representation of the original input data; and (2) the reconstruction error by comparing the input with its decoded counter-part part. Using the training set Strain {si, S J. the autoencoder learns the encoding
SSM
function fen:
ze = (s; O )n Vs E Strain:
Ze E R Ra
(3)
where Den are the learned parameters for the encoder. are known as the bottle-neck features of dimension ktn.
Similarly, for the decoding part, we have:
[aei Ode),
(4)
where Ode are the learned parameters for decoding. x' are the reconstructed features.
Upon training, have learned autoencoder with optimized parameters {Gen: Qde) We run the entire input set X. forward through the encoder network and produce a set of new features Z (Z), 22," .NN) ), by concatenating the bottle-neck feature with the reconstruction emror:
Kan Zr]
z
IR Aen
where the reconstruction error z, measured in terms cosine similarity between x and its decoded counter-part:
x x
2, d(xxx')
cos
x' 1l)
x
Note that now of much lower dimension than the input data X. Hence, traditional clustering techniques such as Gaussian Mixture Model would suffice for subsequent training set selection. To ensure the initial training set can capture most of the normal samples, we adopt more conservative cluster variance threshold.
With the new encoding scheme, the entire input set X now represented as We can "re-label" the training set X by using Z proxy. Similar the initial training set selection, select members that belong to low-variance clusters in Z. The process Training set selection + Autoencoder training ++ New feature computation is performed iteratively. The training is updated as follows:
z C(Z'. .p).
(7)
S1+1
Stain {x Vzz Z )
(8)
3

---

Under review as a conference paper at ICLR 2020
where the superseript here refers the tt iteration.
Finally, the training process terminates when there is no change in the set selected normal samples between two successive iterations. After the last iteration, & tF, obtain the autoencoder parameters { Otr J. and use it to construct the scoring function: en de
h(x) = d(x, x') d(x, Sac Ox)); O)))
where x' is the result of going through the autoencoder.
process according to the trained
3.2 ALGORITHM
The proposed framework is summarized in Algorithml] 1 We obtain an initial split of the data into normal and abnormal subsets through clustering (i.e. GMM for KDDCUP data and Distribution Clustering (Lin et al. (2018) for image and video data). Selected outputs for CIFAR-I0 and MNIST datasets using Distribution Clustering are presented Fig. in the appendix. We observe that as cluster variance increases, the samples' appearance become more anomalous.
Algorithm Deep end-to-end Unsupervised Anomaly Detection
Input: X [x = 1, 2..., N: set normal and anomalous input examples. number of epochs required for re-evaluation of the membership of the entire input set X. and p: thresholds for initial and subsequent training set selection, respectively
Output: Reconstruction-bast
anomaly score function hxx) and trained autoencoder {ÓtH f 1: procedure GET CCCCISIONSOOOEEX,,,
de
2: Strain + C(X,Po)
> Run clustering, select instances from low-variance clusters
3:
== {l: Vx,= E Strain)
L is the set of indices of selected normal training samples
4:
a :=
5:
while setdiff(L ald ..) do for each epoch do
6:
7:
if (Curren! Epoch + 11) mod r) == 0 then & Re-evaluate normality every epochs
8:
Z. + fen (X, θen)
>> Bottle-neck features
9:
X' fde Ze, θde)
10:
Z, +- d(X.X X')
b Reconstruction error
11:
Z [Z: Zr]
12:
S Strann + C(Z,p) p)
> Get new training set according to threshold
13:
L L
14:
L Strain
> Update set of indices for training samples
else
16:
Train fens fae on Strain to obtain {0en, O
17:
end for
18:
end while
fir Oens
OF =
Output h(x)
according finalized autoencoder (O'p OtF base on Eq. en
21: end procedure
Convergence Assuming a p% anomaly ratio, our algorithm starts with a tight cut-off, accepting clusters with variances below (100 )a)th percentile as an initial training set, where Po > p. This ensures the initial training set as pure as possible. Our assumption is that given partial normal data, the autoencoder would be able to learn representation and generalize well on the "unseen" normal data that was discarded, and progressively recover them as iterations go on. Empirically, we plotted the AUROC, AUPRC and F-score for 20 iterations for the KDDCUP experiment, presented in Fig of the appendix. It demonstrates the convergence as iteration progresses. The same behavior was observed throughout our experiments other datasets.
4

---

Under review as a conference paper at ICLR 2020
4 EXPERIMENTS
4.1 BASELINE METHODS
On the topic of anomaly detection, there exist different terminologies concerning the nature of supervision: (a) Algorithm uses label information of the normal class for training (label information could be used in part, or all of the stages of an algorithm); (b) No training labels are given, algorithm treats the entire dataset with both normal and anomalous classes as input. For the purpose of this paper, we term type (a) semi-supervised and type (b) unsupervised. We evaluate our proposed algorithm against the following state-of-the-art methods:
OC-NN (semi-supervised) One-class neural networks (OC-NN) (Chalapathy et al. (2018) contains 2 major components: a deep autoencoder and werdrd convolutional network. The deep encoder is trained on normal data for representation learning. The trained encoder, with its parameters frozen, is subsequently used as the input layers of ferw-forward network with extra hidden layer. Variants of OC-NN employ different activation functions (i.e. linear, sigmoid, relu) in the hidden layer. We report the best score attained among all possible activation functions in our experiments.
OC-SVM (unsupervised) One-class support vector machine (OC-SVM) (Erfani al.) is kernel- based method for anomaly detection. The algorithm searches for best-performing hyper-parameters y (kernel coefficient) and (upper bound of the fraction of training errors and lower bound of the fraction of support vectors) to obtain the optimal AUROC (Buitinck et al. (2013)).
DAGMM (unsupervised) Deep autoencoding Gaussian mixture model (DAGMM) (Zong al. (2018) ). comprised of one compression net and one estimation net, is method based on representation learning. The compression network provides low-dimensional representations of input samples and the reconstruction error features. They are fed into the estimation network, which functions as a Gaussian Mixture Model, to predict the mixture membership for each sample. We modify the original DAGMM algorithm by adding a small value to the diagonal elements of the covariance matrix. The model achieves better results than the reported score from the original work.
Deep anomaly detection using geometric transformations (semi-supervised) This method (Golan & Yanivy (2018)) employs a deep neural model to identify
samples of image data, given only the examples from the normal class. A series of geometric transformations are applied to the normal class to create multi-class dataset. A deep neural net, trained using this dataset, is then employed discriminate the transformations applied. Subsequently, given an unseen instance, the model applies each transformation on it and assigns membership scores. The final normality score determined based on the combined lig-liielihood softmax response vectors.
4.2 DATASETS
We employ five benchmark datasets, namely, KDDCUP, MNIST, CIFAR- 10, Cat and UCF- Crime, evaluate our proposed method, together with other methods described above.
The KDDCUP network intrusion dataset (Lichman et al. 2013)) contains samples of 41 dimensions. Similar to (Zong et al. (2018), categorical features are prepared by applying one-hot encoding. 20% of the "normal" samples form the minority group, while the rest 80% are treated as "attackers". As "normal" samples are the minorities, they are treated as anomalies
KDDCUP:
The MNIST dataset (LeCun & Cortes (2100) consists of 60,000 gray-scale 28 x 28 images of handwritten digits from to 9. We formulate an anomaly detection task as per described in (Chalapathy et al. (2018) and (Zhou & Paffenroth (2017). where 4,859 images of digit 4 are randomly sampled as normal instances and 265 images are evenly sampled from all other categories anomalies.
MNIST:
The CatVsDog dataset consists of dogs and cats images of varying sizes, which are extracted from the ASIRRA dataset (Elson et al. (2007)) following the settings specified in (Golan & El-Yaniy (2018). 12,500 images of dogs and 2,500 images of cats are sampled to form an anomaly detection task. The cat images treated as anomalies.
CatVsDog:
5

---

Under review as a conference paper at ICLR 2020
The UCF-Crime dataset (Sultani et al. (2018) contains 1,900 long and untrimmed videos captured from CCTV cameras. It covers 13 real-world anomalies, including incidents like fighting, burglary, abuse and etc. In both of the training and testing sets, videos
UCF-Crime:
of different length and anomalies happens at various temporal locations. Some the videos may have multiple anomalies. In the experiment,
randomly select reasonably long videos with at least 1000 frames and anomaly ratio less than 0.35 across categories.
Table 1: Summary statistics of datasets.
Dataset
Normal Class
Input Dimension
# Instances
Anomaly Ratio (%)
KDDeup
attack
1 x 120
494,021
MNIST
digit 4
28 28
5,105
CIFAR-10
airplane (category
32x32
5,500
CatVsDog
dog
128 x28 varying
15,000
UCF-Crime
non-crime scenes
dep. on video
< 35
4.3 EVALUATIONS
We adopt Area Under the curve of the Receiver Operating Characteristic (AUROC) as the main evaluation metric measure the discrimination power of different models. AUROC is standard method to assess the effectiveness of a classifier (Fawcett (2006)). It can be interpreted as the probability that anomalous instance is assigned to higher anomaly score than normal instance (Davis & Goadrich (2006)). In this section, we compare the performance of our method against other baseline methods.
KDDCUP: Network Intrusion Data In this experiment, we divide the KDDCUP dataset following the setting in (Zong et al. (2018)). 50% the data reserved for testing by random sampling. From the remaining 50% of the data reserved for training, take all samples from the normal class and mix them with different percentages of samples from the anomaly class to form the training set. Parameters for this experiment (see Algorithm 1 set to: Po 35%, p 30%,
10.
Table 2 and reports the AUROC and AUPRC of OC-SVM, DAGMM and our model on the KDDCUP dataset after 200 epochs, with anomaly ratio in training set being 5%, 10% and 20%, respectively. It can be observed that the increase in ratio of anomalous data undermines the detection performance of OC-SVM and DAGMM more severely, while our method remains robust such changes.
Table AUROC of different models with different anomaly ratio based on KDDCUP dataset (in %). Our proposed method is much more immune to increase in anomaly ratio.
Anomaly Ratio (%)
OC-SVM
DAGMM
Ours
5
96.8 + 0.5
96.6
98.2 + 1.0
10
89.7 + 0.1
28.6
98.4 0.8
20
61.6 0.1
2.0
93.5 1
Table 3: AUPRC of different models with different anomaly ratio based on KDDCUP dataset (in %).
Our proposed method is much more immune to increase in anomaly ratio.
Anomaly Ratio (%)
OC-SVM
DAGMM
Ours
5
77.8 1 0.1
75.4
94.5 1 0.1
10
68.1 0.1
53.4
93.9
20
45.4 0.0
40.7 2.8
90.3 0.5
Figure shows the Receiver Operating Characteristic (ROC) curves of different models when the anomaly ratio the training data 20%. our unsupervised setting where no prior knowledge of normal class is known, our method is clearly more robust contaminated training data.

---

Under review as a conference paper at ICLR 2020
1.0
0.8
True Positive Rate
0.6
0.4
0.2
Our model, auc=0.934
DAGMM, auc=0.795
OC-SVM, auc=0.616
0.0
0.0
0.2
0.4
0.6
0.8
1.0
False Positive Rate
Figure 2:
ROC comparison of proposed model, DAGMM, and OC-SVM. Results obtained based on the KDDCUP dataset, with 20% anomaly ratio.
Table 4: AUROC in %. Highest score among all methods and highest score among all unsupervised methods highlighted. On complex datasets such CIFAR-10 and CstVoDog, our proposed method has higher performance gain among all unsupervised methods. The last column presents results obtained using distribution clustering alone.
OC-NN
OC-SVM (unsupervised) (unsupervised)
DAGMM
Geom. Transform. (semi-supervised)
Ours (unsupervised)
Distrib. Clust.
Dataset
(semi-supervised)
70.5 2.1 82.4 + 1.8 (raw)
MNIST
70.0
90.2
50.3
98.2
63.3
CIFAR-10
63.8
69.7
49.0
73.3
73.6 + 0.6
CatVsDog
50.8
56.2
43.4
88.3
74.0 + 2.5
56.1
Image Data table we compare the AUROC scores obtained from OC-NN, OC-SVM, DAGMM, Geometric Transformation and our model, based on multiple image datasets. It should be noted that Geometric Transformation approach trains on data from the normal class only (hence classified semi-supervised), Our method, on the other hand, does not require label information.
Results in Table demonstrate an outstanding performance our method over other unsupervised approaches. In addition, on CIFAR-10, the performance of our proposed algorithm is comparable to that of Geometric Transformation, a semi- semiisupprviiedd method. In the last column of Table we report results obtained using distribution clustering alone. The combination of distribution clustering and autoencoder significantly improves the discrimination against anomalies. Details of the parameters used in the experiments reported in the appendix.
We make several key observations based on the attained results in Table 4 Unlike all other methods that tend to perform better on simpler datasets (e.g. MNIST), the advantage of our method becomes more evident on datasets with higher complexity. Notably, our method outperforms other unsupervised approaches CIFAR-10 and CatVsDog. The shortfall of our method on MNIST dataset could be due to the adoption of NetVLad Lad feature extractor (4096-d feature vectors), which may not be an ideal choice of feature representation since the images pre-aligned and hence of low dimensionality. We repeat the same experiment using raw image features from MNIST, It shows improved AUROC score, suggesting that raw feature is better representation.
We also observe that while our method is able to produce results comparable to semi-supervised approaches, the gap is wider CatV dataset as compared to CIFAR-10. We attribute this the high noise level in the CatVsDog dataset. For example, some images consist of both dog and cats. Moreover, training normal data (with augementation through geometric transformation) gives

---

Under review as a conference paper at ICLR 2020
Geometric Transform natural advantage. According (Elson al. (2007) ASIRRA dataset, from which the CatV is extracted, is deemed extremely challenging for computers. Sample images of the dataset are presented in the appendix.
We apply the proposed approach on UCF-Crime dataset (Sultani et al. (2018)). with features extracted using C3D (Tran et al. (2015) descriptor. default C3D settings, every frames aggregated to generate feature vector. As method is unsupervised, it needs sufficient amount of feature vectors for training. We select videos with least 65 vectors (1040 frames).
Video Data
In (Sultani et al. (2018), although the AUROC score of each video category is not reported, the achieved by adopting semi-supervised method of multiple instance learning (MIL). The AUROC scores randomly selected video categories, using our method and DAGMM, are reported in Table The parameters used in training, well individual video-level scores are detailed in the appendix.
AUROC averaged across the entire testing set of UCF-Crime dataset is 75.4%.
good correspondence between the ground truth and our anomaly scores can be observed Figure 3 where frames with anomalous events under the orange lines assigned to higher anomaly scores. can be observed that our method significantly out-performs DAGMM. Moreover, our method is able produce AUROC higher than 75.4% for some action categories. Despite under fully unsupervised setting, our method is as effective in detecting anomalies from video data as its semi-supervised competitor, demonstrating its strength in handling complex and high diiedsiimnnnnl data.
è oonomal score nnnoalous
a enomall score anomalous
0.8
0.8
anomaily score
enoora score
0.6
0.6
0.4
0.4
|1
'
0.2
0.2
200
400
600
800
1000
200
400
600
800
1000
frame
video frame
(a) Burglary018 anomaly Score with our method
(b) Fighting033 anomaly score with our method
1.0
anomaly Soore
10
anomaty ScOra
anomalouss evart
anomelous ever!
0.8
0.8
snomaly scoe
0.6
0.8
0.4
200
400
800
800
1000
200
400
800
800
1000
video frame
video frame
(c) Burglary018 anomaly score with DAGMM
(d) Fighting033 anomaly score with DAGMM
Figure Anomaly scores (normalized) plotted against ground truth (flagged by orange lines). Compared to DAGMM, our method shows much better correspondence to the ground truth.
Run Time Excluding feature extraction and clustering process, single NVIDIA Tesla P100 GPU, our method takes minutes 20 seconds on average to complete the CIFAR-10 experiment described above (consisting of 5,500 instances). This timing is averaged over runs.
8

---

Under review as a conference paper at ICLR 2020
4.4 ABLATION STUDY
Initialization To examine the effect of adopting distribution clustering as the initialization method for high-dimensional data, a variety of other mainstream clustering methods, including K-means, HDBSCAN (McInnes et al. (2017)) and Gaussian Mixture Model (GMM) are used to replace the distribution clustering component the initial normal subset selection. We compare results on the CIFAR-10 task.
For K-means and GMM, prior information on the number of clusters/components is set 20, which is consistent with the setting of the GMM employed in the proposed model. For HDBSCAN, the 5, that follows the setting as distribution clustering. Table 6
minimum size of a cluster reports the AUROC scores obtained from CIFAR-10 10 anomaly detection task with different clustering techniques. The results demonstrate that using distribution clustering initialisation provides better supervisory signals and leads to favourable performance.
Table 5: AUROC in % of detecting crime scene as anomalies in surveillance videos.
Table 6: Comparison on initialisation method on CIFAR-10.
Crime scene # Video selected Ours DAGMM
Clustering method
AUROC
Arrest
70.6
52.2
K-means
60.3
Arson
67.8
60.1
HDBSCAN
61.2
Burglary
79.2
67.4
GMM
50.0
Fighting
3
77.1
57.0
Distribution Clustering
73.6
To further understand the effectiveness of distribution clustering, we tabulated the AUROC achieved using distribution clustering alone, for the experiments on image data (refer to right-most column of Table 4). Surprisingly, this result is even better than those of DAGMM and OC-NN on the challenging CatVsDog dataset.
DISCUSSION AND CONCLUSION
This paper presents end-to-end method for anomaly detection under fully unsupervised setting. The key insight of our algorithm is to model normal data. We leverage distribution clustering technique to make educated guess the normal data subset. By incorporating clustering to provide supervisory signals, we iterate between hypothesizing normal candidate subset and representation learning. This framework iteratively distills out anomalous data and improves the learned representation of normal data. Extensive experiments on benchmark datasets demonstrate our proposed method outperforms existing unsupervised approaches and is comparable to cumi-super solutions in most cases.
Limitations and future work: Using only an autoencoder, our current method may be insufficient to handle highly complex patterns and hence falls short on difficult dataset such as CatVsDog. For future work, we seek to explore more sophisticated generative frameworks for representation learning.

---

Under review as a conference paper at ICLR 2020
REFERENCES
Jinwon An and Sungzoon Cho. Variational autoencoder based anomaly detection using reconstruction probability. Technical report, 2015.
Lars Buitinck, Gilles Louppe, Mathieu Blondel, Fabian Pedregosa, Andreas Mueller, Olivier Grisel, Vlad Niculae, Peter Prettenhofer, Alexandre Gramfort, Jaques Grobler, Robert Layton, Jake VanderPlas, Arnaud Joly, Brian Holt, and Gaël Varoquaux. API design for machine learning software: experiences from the scikit-learn project. In ECML PKDD Workshop: Languages for Data Mining and Machine Learning, pp. 108-122, 2013.
Emmanuel J. Candès, Xiaodong Li, Yi Ma, and John Wright. Robust principal component analysis?
J. ACM, 58(3), June 2011.
Raghavendra Chalapathy, Aditya Krishna Menon, and Sanjay Chawla. Anomaly detection using 2018.
one-class neural networks. arXiv preprint
Varun Chandola, Arindam Banerjee, and Vipin Kumar. Anomaly detection: survey, ACM computing surveys (CSUR),
2009.
Jesse Davis and Mark Goadrich. Proceedings of the 23rd international conference on Machine learning, pp. 233-240. ACM, 2006.
The relationship between precision-recall and roc curves. In
Jeremy Elson, John JD Douceur, Jon Howell, and Jared Saul. Asirra: captcha that exploits interest-aligned manual image categorization. 2007.
Sarah M Erfani, Sutharshan Rajasegarar, Shanika Karunasekera, and Christopher Leckie. High- dimensional and large-scale anomaly detection using a linear one-class svm with deep learning. Pattern Recognition, 58:121-134.
Tom Fawcett. An introduction to roc analysis. Pattern recognition letters, 27(8):861-874 2006.
Izhak Golan and Ran El- Yaniv. Deep anomaly detection using geometric transformations. arXiv preprint 1711177805.10917, 2018.
I.T.Jlliffe. Principle component analysis and factor analysis. In Principal Component Analysis, pp. 115-128, 1986.
JooSeuk Kim and C. Scott. Robust kernel density estimation. In 2008 IEEE International Conference on Acoustics, Speech and Signal Processing, pp. -3384, March 2008
Aleksandar Lazarevic, Levent Ertoz, Vipin Kumar, Aysel Ozgur, and Jaideep Srivastava. A compar- ative study of anomaly detection schemes network intrusion detection. In Proceedings of the 2003 SIAM International Conference on Data Mining, pp. 25-36. SIAM, 2003.
Yann LeCun and Corinna Cortes. MNIST handwritten digit database. 2010. URL http: //yann
lecun. cwm www/exdb http//xxbb/beeeeee mni st./
Moshe Lichman al. Uci machine learning repository, 2013.
Wen-Yan Lin, Siying Liu, Jian-Huang Lai, and Yasuyuki Matsushita. Dimensionality's blessing: Clustering images by underlying distribution. In Proceedings of IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 5784-5793, 2018.
Leland McInnes, John Healy, and Steve Astels. hdbscan: Hierarchical density based clustering. J. Open Source Software, 2(11)205, 2017.
G. Mishne and I. Cohen. Iterative diffusion- based anomaly detection. In 2017 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1682-1686, March 2017. doi: 10.1 10.110//CASSSP221777999444
Clifton Phua, Vincent Lee, Kate Smith, and Ross Gayler. A comprehensive survey of data mining- based fraud detection research. arXiv preprint arXiv: 100.66/ 2010.
10

---

Under review as a conference paper at ICLR 2020
Venkatesh Saligrama, Janusz Konrad, and Phere-Mare Jodoin. Video anomaly identification. 1EEE Signal Processing Magazine, 27(5):18-33 --,8 2010.
Thomas Schlegl, Philipp Seebek, Sebastian M. Waldstein, Georg Langs, and Ursula Schmidt-Erfurth. f-anogan: Fast unsupervised anomaly detection with generative adversarial networks. Medical Image Analysis, 54, 01 2019. doi: 1e110166..meii.22000
Waqas Sultani, Chen Chen, and Mubarak Shah. Real-world anomaly detection in surveillance videos. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp-
1179-6488, 2018.
Du Tran, Lubomir Bourdev, Rob Fergus, Lorenzo Torresani, and Manohar Paluri. Learning spa- tiotemporal features with 3d convolutional networks. In Proceedings of the IEEE international conference computer vision, pp. 4489 4489-4497, 2015.
Y. Wang, B. Xue, L. Wang, H. L., Lee, C. Yu, M. Song, S. Li, and C. Chang. Iterative anomaly detection. In 2017 IEEE International Geoscience and Remote Sensing Symposium (IGARSS), pp. 586-589, July 2017. doi:
Yan Xia, Xudong Cao, Fang Wen, Gang Hua, and Jian Sun. Learning discriminative reconstructions for unsupervised outlier removal. In The IEEE International Conference Computer Vision (ICCV), December 2015.
Tao Xiang and Shaogang Gong. Video behavior profiling for anomaly detection. IEEE transactions on pattern analysis and machine intelligence, 30(5):893-908 2008
Shuangfei Zhai, Yu Cheng, Weining Lu, and Zhongfei Zhang. Deep structured energy based models for anomaly detection. In Proceedings of the 33rd International Conference on International Conference on Machine Learning Volume 48, ICMI:16, pp. 1100-1109. JMLR.org, 2016.
Chong Zhou and Randy C Paffenroth. Anomaly detection with robust deep autoencoders. In Proceedings of the 23rd ACM SIGKDD International Conference Knowledge Discovery and Data Mining, pp. 665 674. ACM, 2017.
Bo Zong, Qiankun Song, Martin Renqiang Min, Wei Cheng, Cristian Lumezanu, Dae ki Cho, and Haifeng Chen. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In Proceedings of International Conference on Learning Representations (ICLR), 2018.

---

Under review as a conference paper at ICLR 2020
A INITIALIZATION
Selected outputs for CIFAR-I0 and MNIST datasets using Distribution Clustering are shown in Fig. We observe that as cluster variance increases, the samples' appearance become more anomalous.
4
4
4
4
4
4
4
4
4
9
4
4
9
(a) Clustering result of CIFAR-10 ("air- planes" class forms the normal group): cluster 5, 10. 15, 20, 25, 30, 35, 40, 45, 50, with increasing cluster variance.
Clustering result of MNIST (digit
*4" forms the normal group): cluster
10, 15. 20, 25, 30, 35, 40, 45, 50 with increasing cluster variance.
Figure Results from Distribution Clustering.
B CONVENGENCE
To investigate the convergence behavior, plotted the AUROC, AUPRC and F-score for 20 iterations for the KDDCUP experiment in Fig. in the appendix, where the ground truth anomaly ratio is 20%. It demonstrates the convergence iteration progresses. The same behavior was observed throughout our experiments.
0.9
0.8
0.7
Scores
0.6
0.4
0.3
AUROC
0.2
0
10
15
20
Iterations
Figure 5: F1, AUROC, AUPRC scores for 20 iterations. Results obtained from experiments KDDCUP (Lichman et al. 2013 dataset with 20% anomaly ratio.
12

---

Under review as a conference paper at ICLR 2020
C RESULT BREAKDOWN OF UCF CRIME
Video with less than 65 segments or anomaly ratio higher than 0.35 are not taken into consideration.
Results obtained after running 5 rounds of experiments. (take average and standard deviation)
Table Breakdown of Area Under the curve of the Receiver Operating Characteristic (AUROC) in % of detecting crime scene as anomalies in surveillance videos.
Video
Crime scene # Segment Anomaly Ratio AUROC (%) Average AUROC (%)
Arson010
Arson
197
0.11
72.5 = 1.4
Arson022
Arson
540
0.06
72.0 2.2
67.8
Arson035
Arson
89
0.21
60.0 5.6
Arrest001
Arrest
148
0.13
75.0
70.6
Arrest007
Arrest
196
0.23
66.1 2.8
Burglary005
Burglary
483
0.21
83.0 1.4
Burglary017
Burglary
132
0.21
70.0 + 1.0
79.2
Burglary018
Burglary
70
0.3
85.2 = 1.4
Burglary079
Burglary
928
0.20
78.7 1.2
Fighting018
Fighting
86
0.25
81.0 + 0.4
Fighting033
Fighting
69
0.25
86.9 5.2
77.1
Fighting042
Fighting
139
0.28
63.4 2.4
D NETWORK PARAMETERS
Table repprts the settings and parameters for each experiments.
Note: for video with small number of segments, the value of is set to be larger because anomalous samples take larger proportion given the small number of total segments.
Note:
Relu is adopted as the activation function except for static data where tanh is used instead.
E PARAMETER OF DISTRIBUTION CLUSTERING
Please refer to the original work on distribution clustering Lin et al. (2018) for more information on parameters. Table Trppors the parameters used for distribution clustering.
F SAMPLE CDoG DATA
Figure and presents some example images of dogs and cats from ASIRRA dataset.
13

---

Under review as a conference paper at ICLR 2020
Table Parameters used for experiments.
Dataset
Encoder layers
Epoch Mini-batch size learning rate (%)
r
KDDCup
[60, 30, 10]
200
1024
0.001
30
10
Mnist
[1028, 512, 128, 60, 10]
500
1024
0.0005
20
5
Mnist (raw pixel)
[512, 256, 128, 60, 10]
300
128
0.001
10
10
Cifar-10
[1028, 512, 128, 60, 10]
500
1024
0.001
5
CatVsDog
[1028, 512, 128, 60, 30]
500
500
0.001
25
5
Arson010
[1028, 512, 128, 60, 10]
200
128
0.0001
30
10
Arson022
[1028, 512, 128, 60, 10]
200
128
0.0001
20
5
Arson035
[1028, 512, 128, 60, 10]
200
0.0001
30
10
Arrest001
[1028, 512, 128, 60, 10]
200
128
0.0001
30
10
Arrest007
[1028, 512, 128, 60, 10]
250
128
0.0001
30
10
Burglary005
[1028, 512, 128, 60, 10]
200
200
0.0001
20
5
Burglary017
[1028, 512, 128, 60, 10]
200
0.0001
30
10
Burglary018
[1028, 512, 128, 60, 10]
200
32
0.0001
30
10
Burglary079
[1028, 512, 128, 60, 10]
200
128
0.0001
20
5
Fighting018
[1028, 512, 128, 60, 10]
200
64
0.0001
30
10
Fighting033
[1028, 512, 128, 60, 10]
200
0.0001
30
10
Fighting042
[1028, 512, 128, 60, 10]
200
64
0.0001
30
10
Table 9; Parameters used for distribution clustering.
Dataset
thres min clus max dist
MNIST
0.1
7
1.4
Cifar-10
0.06
5
1.4
CatVsDog
0.06
5
1.4
video experiments
0.05
4
1.5
14

---

Under review as a conference paper at ICLR 2020
Dorian
PetSafe Pro
The Caring Containment Professionals
Figure 6: example cat images from ASIRRA.
parEhaee SeRtE BLESS NUCEO
No Photo Available
BULL
1-26-07
My name is "SANDY"
Figure example dog images from ASIRRA
15


Reviews:
[{"review_id": "SJx1fc7aKr", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper proposed an unsupervised anomaly detection method for the scenarios where the training data not only includes normal data but also a lot of anomaly data. The basic idea of this paper is to iteratively refine the normal data subset, selected from the whole training data set. Specifically, the paper first train an auto-encoder (AE) and determine which are the normal data samples according to the reconstruction errors. Then, using the normal data to retrain the AE again, and re-select the normal samples. Repeat the above two steps until convergence. \n\nOverall, the novelty of this paper is in doubt. Detecting anomaly by reconstruction error of AE has been explored thoroughly, and this paper only extends it to iteratively select the normal samples. The extension seems to be very straightforward. \n\nAlso, the refining process is also problematic. It will highly depend on the initial selection, and the error will be propagated to subsequent detections. How to determine which data samples are anomalous is a key to the success of the model, but the proposed method based on the variance assumption is too intuitive and not convincing.\n\nIn addition, the experimental results on the very simple MNIST task is very poor, putting the effectiveness of the proposed model in doubt.\n", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "SJlQMrZjtS", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In the article, the authors solve the problem of anomaly detection using a fully unsupervised approach. They try to deal with the main challenge of anomaly detection: a lack of certainty on what defines normal data and anomaly one. For this purpose, the authors iteratively use: 1) autoencoders to learn the representation of the data; 2) applying in the latent space clustering to get a new training set and retrain autoencoders. The experimental results show that the author’s method performed better results than such a baseline model as one-class SVM and one-class NN. \n \nThe proposed algorithm looks robust and well-motivated, but the text of the article and the experiments can be improved. As the proposed approach is a heuristic, the experiments should be done more persuasively, including more metrics used and more alternative algorithms considered. \n\nThe key comments are the following:\n1. The formatting of the article needs to be improved e.g.:\n2. there is no comma between rows in the equation (1) ;\n<<to be accepted into the “training” set, .>> - there is an extra comma;\n3. round brackets in the equation (6) should be bigger;\n4. Table 3 is bigger than the page sizes.\n5. The quality of the pictures should be improved:\n- Increase the captions font size in Figure 2;\n- The captions and the legends in Figure 3 are practically not visible;\n6.  Is the DAGMM method SOTA in anomaly detection with deep autoencoder? There are many other methods with similar ideas. We expect that we should provide a comparison with other methods: \nhttps://arxiv.org/pdf/1809.02728.pdf - IGMM-GAN\nhttps://papers.nips.cc/paper/7915-generative-probabilistic-novelty-detection-with-adversarial-autoencoders.pdf - GPND AE\n6. Also, DAGMM works badly according to the experiments in the article with max AUROC in Table 1 only 50.3 (so it seems that it is no better than the coin-flipping)\n7. Why was the only selected digit for analysis 4? Usual for comparison anomaly detection on MNIST dataset apply the following procedure: for each figure in dataset consider corresponded class as anomaly data, and the rest of the digits are used as normal data, e.g.:\nhttps://arxiv.org/pdf/1802.06222.pdf\nhttps://arxiv.org/pdf/1906.11632.pdf \n8.  Class imbalances can affect the value of the AUROC metric. Possibly, the other metrics like AUPRC, F1-scores will better reflect the work of the algorithms for comparison. Also, AUROC is not representative when it comes to the selection of the threshold for anomaly detection. Precision and Recall can help to get more insights.\n9. In Table 3, the result of applying the proposed algorithm presented with standard deviation, but other methods are represented by one metric value. Why? The explanation is required.", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I carefully checked the derivations and theory.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly."}, "extra_text": {}}, {"review_id": "B1g4zUaotB", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this paper the authors propose a framework for anomaly detection. The method is based on autoencoders and reconstruction error, but instead of training the autoencoder using all the data-points, the method iteratively uses some form of clustering to determine the points which presumably belong to the normal set, and uses them for training the autoencoder. This helps make the method robust when the portion of anomalous data-points is high.\n\nThe paper is well-written and clear and the proposed architecture is novel to my knowledge. Nevertheless, I have the following concerns about the paper. Given clarifications in the author response, I would be willing to increase the score. \n\n- In terms of novelty, separating the dataset into normal + outliers/noise is not novel (Zhou 2017 cited in the paper). The novel part here is perhaps using variance and clustering for making the separation. However, using variance is not well motivated and it is referred to Figure 4, in which the argument is not clear. Similarly, why the reconstruction error is included in the latent representation (eq 5) is not clear. \n\n- Given the similarity of the idea to Zhou 2017, the comparison seems important (if the code is available), and also proper discussion of such similar works is required, which currently is not presented.\n\n- How is the performance affected by very low ratio of anomalies? This can be shown by including %2,%3 of anomalies in Table 2. \n\n- The sensitivity of the results to the choice of hyper-parameters: p0, p, and r is not clear, and how these parameters are chosen is not discussed. It would be interesting to see how the performance is affected by different choices of the hyper-parameters.", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_checking_correctness_of_derivations_and_theory": "N/A", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper."}, "extra_text": {}}]

Author rebuttal:

Meta-review: The authors propose an approach for anomaly detection in the setting where the training data includes both normal and anomalous data.  Their approach is a fairly straightforward extension of existing ideas, in which they iterate between clustering the data into normal vs. anomalous and learning an autoencoder representation of normal data that is then used to score normality of new data.  The results are promising, but the experiments are fairly limited.  The authors argue that their experimental settings follow those of prior work, but I think that for such an incremental contribution, more empirical work should be done, regardless of the limitations of particular prior work.
Decision: Reject