Anomaly detection involves identifying rare data instances (anomalies) that come from a different class or distribution than the majority (which are simply called “normal” instances). Given a training set of only normal data, the semi-supervised anomaly detection task is to identify anomalies in the future. Good solutions to this task have applications in fraud and intrusion detection. The unsupervised anomaly detection task is different: Given unlabeled, mostly-normal data, identify the anomalies among them. Many real-world machine learning tasks, including many fraud and intrusion detection tasks, are unsupervised because it is impractical (or impossible) to verify all of the training data. We recently presented FRaC, a new approach for semi-supervised anomaly detection. FRaC is based on using normal instances to build an ensemble of feature models, and then identifying instances that disagree with those models as anomalous. In this paper, we investigate the behavior of FRaC experimentally and explain why FRaC is so successful. We also show that FRaC is a superior approach for the unsupervised as well as the semi-supervised anomaly detection task, compared to well-known state-of-the-art anomaly detection methods, LOF and one-class support vector machines, and to an existing feature-modeling approach.

中文翻译：

---

FRaC：半监督和无监督异常检测的特征建模方法。

异常检测涉及识别来自与大多数（简称为“正常”实例）不同的类别或分布的稀有数据实例（异常）。给定一个只有正常数据的训练集，半监督异常检测任务是在未来识别异常。此任务的良好解决方案可应用于欺诈和入侵检测。在无监督异常检测任务不同：给定未标记的、大部分是正常的数据，识别其中的异常。许多现实世界的机器学习任务，包括许多欺诈和入侵检测任务，都是无人监督的，因为验证所有训练数据是不切实际的（或不可能的）。我们最近提出了 FRaC，一种用于半监督异常检测的新方法。FRaC 基于使用正常实例来构建特征模型的集合，然后将与这些模型不一致的实例识别为异常。在本文中，我们通过实验研究了 FRaC 的行为，并解释了 FRaC 为何如此成功。我们还表明，与众所周知的最先进的异常检测方法相比，FRaC 是无监督和半监督异常检测任务的优越方法，