# Low-Cost Active Anomaly Detection with Switching Latency
## 3 The DMSC Policy
### The DMSC Policy  
Consider the problem of detecting \(L\) abnormal processes among \(M\) processes where \(L\) and \(M\) are known. The decision-maker can locate all the anomalies using the method of directly selecting and identifying all \(L\) abnormal processes or the method of excluding all \(M-L\) normal processes. Thus, the proposed DMSC policy partitions the problem space into two cases by comparing \(\frac{2D(g||f)}{L+1}+\triangle(M,L)\) and \(\frac{D(f||g)}{M-L}\), i.e.,  
\[ \begin{split}\text{Case I: }\frac{2D(g||f)}{L+1}+\triangle(M,L) \geq\frac{D(f||g)}{M-L},\\ \text{Case II: }\frac{2D(g||f)}{L+1}+\triangle(M,L)<\frac{D(f||g)}{ M-L},\end{split}  \tag{8}\]  
where the offset can be expressed as  
\[\triangle(M,L)\triangleq\frac{s(2M-3L+1)D(g||f)D(f||g)}{(L+1)(M-L) B}. \tag{9}\]  
In Case I, the DMSC policy aims at identifying the \(L\) abnormal processes sequentially. It should be noticed that in this case, probing the process with the highest sum-LLRs will lead to a rapid collection of sufficient information to declare the state of the process as abnormal since the abnormal processes tend to have higher sum-LLRs among these normal processes and the process with highest sum-LLRs tends not to change after a period of time, which will make the cost incurred by the observations and switchings as small as possible. Let \(\mathcal{A}(n)\) denote the set of processes whose states have been declared as abnormal at time \(n\). The selection rule \(\phi(n)\) is given by  
\[\phi(n)=m^{1}(n) \tag{10}\]  
where \(m^{1}(n)=\arg\max_{m\
otin\mathcal{A}(n)}S_{m}(n)\) is the index of the process with the highest sum-LLRs among all the processes whose states have not been declared at time \(n\). Following [PERSON]'s SPRT [1], the stopping rule and decision rule are given by comparing the sum-LLRs \(S_{m}(n)\) with the threshold at each time \(n\). Thus, the stopping rule \(\tau_{m}\) and decision rule \(\delta_{m}\) can be denoted by  
\[\tau_{m}=\inf\{n:S_{m}(n)\geq B,\}, \tag{11}\]  
and  
\[\delta_{m}=1, \tag{12}\]  
where the threshold \(B\) is determined such that the error constraint \(P_{\varepsilon}^{m}\leq\alpha\) is satisfied and can be expressed as  
\[B\approx\log\frac{1-\alpha}{\alpha} \tag{13}\]  
by simplifying the computation of [PERSON]'s approximation [1]. In this case, the stopping time \(\tau_{end}\) of the entire detection procedure and the final decision rule \(\delta_{end}\) are given by  
\[\tau_{end}=\inf\{n:|\mathcal{A}(n)|=L\}, \tag{14}\] \[\delta_{end}=\mathcal{A}(n), \tag{15}\]  
which means we have completed the searching for the \(L\) abnormal processes. In Case II, the decision-maker chooses the method of excluding \(M-L\) normal processes to locate the \(L\) abnormal processes with lower expected cumulative costs. Let \(\mathcal{B}(n)\) denote the set of processes whose states have been declared as normal at time \(n\). Thus, the selection rule \(\phi(n)\), stopping rule \(\tau_{m}\) and decision rule \(\delta_{m}\) are given by  
\[\phi(n)=m^{-1}(n), \tag{16}\] \[\tau_{m}=\inf\{n:S_{m}(n)\leq-B\},\] (17) \[\delta_{m}=0, \tag{18}\]  
where \(m^{-1}(n)=\arg\min_{m\
otin\mathcal{B}(n)}S_{m}(n)\) is the index of the process with the smallest sum-LLRs among all the processes whose states have not been declared at time \(n\). In this case, the stopping time \(\tau_{end}\) of the entire detection procedure and the final decision rule \(\delta_{end}\) are given by  
\[\phi(n)=m^{1}(n) \tag{10}\]0 \[\phi(n)=m^{1}(n) \tag{10}\]1  
where \(\mathcal{M}=\{1,2,\cdots,M\}\) is the set of all processes. The DMSC policy for anomaly detection problems in the AHT framework is shown in Algorithm 1. For Case I, the process with the highest sum-LLRs \(m^{1}(n)\) is selected at each given time \(n\) and declared as abnormal once its sum-LLRs exceeds the threshold \(B\).