We propose a novel unsupervised anomaly detection algorithm that can work for sequential data from any complex distribution in a truly online framework with mathematically proven strong performance guarantees. First, a partitioning tree is constructed to generate a doubly exponentially large hierarchical class of observation space partitions, and every partition region trains an online kernel density estimator (KDE) with its own unique dynamical bandwidth. At each time, the proposed algorithm optimally combines the class estimators to sequentially produce the final density estimation. We mathematically prove that the proposed algorithm learns the optimal partition with kernel bandwidths that are optimized in both region-specific and time-varying manner. The estimated density is then compared with a data-adaptive threshold to detect anomalies. Overall, the computational complexity is only linear in both the tree depth and data length. In our experiments, we observe significant improvements in anomaly detection accuracy compared with the state-of-the-art techniques.

中文翻译：

---

使用带宽优化的分层核密度估计器进行在线异常检测

我们提出了一种新颖的无监督异常检测算法，该算法可以在真正的在线框架中处理来自任何复杂分布的顺序数据，并具有数学证明的强大性能保证。首先，构建一个分区树来生成一个双指数级大的观测空间分区层次类，每个分区区域都训练一个具有自己独特动态带宽的在线内核密度估计器（KDE）。每次，所提出的算法都会优化组合类估计器以依次产生最终的密度估计。我们在数学上证明了所提出的算法学习具有以特定区域和时变方式优化的内核带宽的最佳分区。然后将估计的密度与数据自适应阈值进行比较以检测异常。总体而言，计算复杂度仅在树深度和数据长度方面呈线性。在我们的实验中，与最先进的技术相比，我们观察到异常检测准确性的显着提高。