A Unified Approach to Anomaly Detection

Anomalous actors are becoming increasingly sophisticated both in methodology and technical ability. Fortunately, the companies impacted by anomalous behaviour are also generating more data and insights on potential anomalous cases than ever before. In this paper, a unified approach to managing the complexity of constructing a useable anomaly detection system is presented. The unified approach is comprised of three algorithms, a Neural Architecture Search (NAS) implementation for autoencoders, an anomaly score threshold optimisation algorithm, and a Gaussian scaling function for anomaly scores. NAS is applied to a data set containing instances of credit card fraud. The NAS algorithm is used to simulate a population of 50 candidate deep learning architectures, with the best performing architecture being selected based on a balanced score, comprised of an average of the Area under the ROC curve, Average Precision and normalised Matthews Correlation Coefficient scores. The threshold optimisation algorithm is used to determine the appropriate threshold between the classes, for the purposes of producing the binary classification outcome of each architecture. The Gaussian scaling algorithm is applied to the raw anomaly scores of the optimal architecture into order to generate useable probability scores. Not only did the proposed unified approach simplify the process of selecting an optimal neural architecture whose output is interpretable by business practitioners and comparable with other probability score producing models, but it also contributes to anomaly detection in a transactional setting by eliminating subjective thresholds when classifying anomalous transactions.