Training data sets intended for unsupervised anomaly detection, typically presumed to be anomaly-free, often contain anomalies (or contamination), a challenge that significantly undermines model performance. Most robust unsupervised anomaly detection models rely on contamination ratio information to tackle contamination. However, in reality, the contamination ratio may be inaccurate. We investigate the impact of inaccurate contamination ratio information in robust unsupervised anomaly detection. We verify whether they are resilient to misinformed contamination ratios. It appears that there is a lack of discussion in the literature regarding the impact of incorrect contamination ratio information on unsupervised anomaly detection, despite its critical importance. Our investigation on 8 benchmark data sets reveals that such models are not adversely affected by exposure to misinformation. In fact, they can exhibit improved performance when provided with such inaccurate contamination ratios.

Training data sets for unsupervised anomaly detection, expected to be anomaly-free, often contain anomalies (i.e., contamination) which can significantly degrade model performance. Most contamination-robust anomaly detection methods do not generalize across different architectures and rely on contamination ratio information which may not be available. In this paper, we propose a novel self-contained preprocessing anomaly detection approach focusing on data cleaning, i.e., identification and treatment of contamination within a training data set for a more effective unsupervised anomaly detection, all without relying on contamination ratio. Our approach is based on dynamic analysis of the cosine similarity between each data point and its reconstruction during training of an auto-encoder, anticipating low density in most anomaly regions within the dynamic space. This approach enhances data quality through hard cleaning: by removing all identified anomalous candidates from training data. Data cleaning allows generalization across various architectures as the improvements made at the data level benefit any anomaly detection model. This process yields up to 100% of contamination reduction, resulting average improvements of 11.2% in F1 score and 7.3% in accuracy across 8 models and 10 benchmark data sets.

Deep auto-encoders (AEs) are widely employed deep learning methods in the field of anomaly detection, especially detection of security malicious activities. Cybersecurity analysts face challenges in managing a large volume of alerts, often constrained by limited processing resources. In response, various strategies, including false positive reduction, human-in-the-loop and alert prioritization, are employed. This paper explores the integration of uncertainty quantification (UQ) methods into alert prioritization for anomaly detection using an ensemble of AEs. UQ models recognize doubtful classification decisions, aiding analysts in treating the most certain alerts first (as a more certain alert is more likely to be accurate). Our study reveals a nuanced issue where applying UQ to an ensemble of AEs can lead to skewed distributions of large reconstruction errors, falsely indicating large standard deviation uncertainties on certain classification decisions. Contrary to intuition, AEs suggest that large reconstruction errors could indicate small uncertainties. To address this, we propose an extension for obtaining a calibrated standard deviation uncertainty distribution, mitigating erroneous alert prioritization. Evaluation on 6 benchmark intrusion detection datasets demonstrates that our proposed calibration approach enhances UQ methods' ability to prioritize alerts with a favorable trade-off in other invaluable performance metrics.

We use the following anomaly detection benchmark data sets: KDD is an intrusion detection benchmark data set containing simulated military-like traffics data, but reported to have duplicated samples [38].NSL is a revisited version of the KDD data set [38].IDS is a simulated data set containing normal traffics and several types of attacks from a complex network [36].KITSUNE is an attack data set captured from either an IP-based surveillance system or a network of IoT devices, containing different types of attacks [21].CICIOT is a real-time data containing 33 attacks that are executed in an IoT network of 105 devices [23].CIFAR is a data set is designed for image classification tasks [15]. To make it an AD data set, we consider the whole CIFAR-10 as the in-distribution data set and test on CIFAR-100, which contains different classes.

This paper highlights the contribution of utilizing ensemble deep learning with auto-encoders (AEs) for out-of-distribution data detection. The key innovation is treating ensemble UQ as a regression problem, mapping uncertainty distribution to a single model, reducing computational demands. This approach aligns well with the ensemble of AEs’ uncertainty distribution, making it valuable for resource-constrained systems and rapid decision-making in computational intelligence.