# Low-Cost Active Anomaly Detection with Switching Latency
## 3 The DMSC Policy
### The DMSC Policy
The asymptotic sample size \(N_{m}\) required to declare the state of one process is expected to be \(B/D(g||f)\) since the probed process is in an abnormal state with high probability and its corresponding sum-LLRs is a random walk with a positive expected increment \(D(g||f)\). Once the sum-LLRs of the probed process exceeds the threshold \(B\), the decision-maker stops taking observations from this process and declares it as abnormal, which means that this point in time is a stopping time and the first stage terminates. Then choose the updated process \(m^{1}(n)\) to probe and apply the same procedure to the remaining \(M-1\) processes. This repeats until all \(L\) abnormal processes have been declared, at which point, the entire detection procedure terminates. Thus, the entire detection procedure can be divided into \(L\) stages where the observation time of each stage is expected to be \(B/D(g||f)\) and the \(i\)-th stage is from the \((i-1)\)-th stopping time to the \(i\)-th stopping time. It should be noted that at the beginning of the \(i\)-th stage, \(i-1\) processes have been declared as abnormal and at each time of the \(i\)-th stage, \(L-i+1\) unidentified abnormal processes incur cost simultaneously. The cumulative observation cost incurred by the unidentified abnormal processes during the \(i\)-th stage is expected to be \((L-i+1)B/D(g||f)\). Thus, the cumulative cost caused by observations during the detection procedure approaches \(c\cdot\frac{L(L+1)}{2}\cdot\frac{B}{D(g||f)}\). From another perspective, the cumulative observation time of the \(i\)-th declared process is \(iB/D(g||f)\). We also can draw the conclusion that the cumulative observation costs can be approximately expressed as \(c\cdot\frac{L(L+1)}{2}\cdot\frac{B}{D(g||f)}\). Besides, there will inevitably be switching across processes during the initialization process of each stage, which will result in additional delays. In Case I, we use \(c\cdot s\cdot\frac{L(L-1)}{2}\) to approximate the cost caused by the switchings. For Case II, the process with the lowest sum-LLRs \(m^{-1}(n)\) is selected at each given time \(n\) and declared as normal once its sum-LLRs drops below the threshold \(-B\). The asymptotic sample size \(N_{m}\) required to declare the state of one process approaches \(B/D(f||g)\) since the probed process is in a normal state with high probability and its corresponding sum-LLRs is a random walk with a negative expected increment \(-D(f||g)\). The same procedure is then applied to the remaining \(M-1\) processes until all the \(M-L\) normal processes have been declared as normal and then the entire procedure terminates with the remaining \(L\) processes declared as abnormal. Unlike Case I where the number of unidentified abnormal processes decreases as the stage index increases, in each stage of Case II, there are \(L\) abnormal processes occurring costs. Thus, the cumulative cost caused by observations approaches \(c\cdot L(M-L)\frac{B}{D(f||g)}\). Similarly, the switching cost can be expressed as \(c\cdot s\cdot L(M-L)\). Therefore, the decision-maker chooses the strategy that minimizes the asymptotic cumulative cost caused by observations and switchings according to  
\[\phi(n)=m^{1}(n) \tag{10}\]2  
Thus, by formula transformation, the problem space is partitioned into two cases as shown in (8).