# Entity Embedding-based Anomaly Detection for Heterogeneous Categorical Events

arXiv: https://arxiv.org/abs/1608.07502 · HTML: https://mlsanity.com/paper/1608.07502/

## Key facts

- Cited by 12 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 26 Aug 2016.

## Built on by (most cited first, 12 of 12)

- [UADB: Unsupervised Anomaly Detection Booster](https://mlsanity.com/paper/2306.01997/) (2023)
- [Cluster Aware Graph Anomaly Detection](https://mlsanity.com/paper/2409.09770/) (2024)
- [Framing Algorithmic Recourse for Anomaly Detection](https://mlsanity.com/paper/2206.14384/) (2022)
- [Unsupervised Anomaly Detection for Auditing Data and Impact of Categorical Encodings](https://mlsanity.com/paper/2210.14056/) (2022)
- [Abnormal Event Detection via Hypergraph Contrastive Learning](https://mlsanity.com/paper/2304.01226/) (2023)
- [PhoGAD: Graph-based Anomaly Behavior Detection with Persistent Homology Optimization](https://mlsanity.com/paper/2401.10547/) (2024)
- [Targeted collapse regularized autoencoder for anomaly detection: black hole at the center](https://mlsanity.com/paper/2306.12627/) (2023)
- [Scrutinizing Shipment Records To Thwart Illegal Timber Trade](https://mlsanity.com/paper/2208.00493/) (2022)
- [EventADL: Open-Box Anomaly Detection and Localization Framework for Events in Cloud-Based Service Systems](https://mlsanity.com/paper/2605.00936/) (2026)
- [Detecting Anomalies Through Contrast in Heterogeneous Data](https://mlsanity.com/paper/2104.01156/) (2021)
- [A method for incremental discovery of financial event types based on anomaly detection](https://mlsanity.com/paper/2302.08205/) (2023)
- [Anomalous Change Point Detection Using Probabilistic Predictive Coding](https://mlsanity.com/paper/2405.15727/) (2024)

## Abstract (arXiv)

Anomaly detection plays an important role in modern data-driven security applications, such as detecting suspicious access to a socket from a process. In many cases, such events can be described as a collection of categorical values that are considered as entities of different types, which we call heterogeneous categorical events. Due to the lack of intrinsic distance measures among entities, and the exponentially large event space, most existing work relies heavily on heuristics to calculate abnormal scores for events. Different from previous work, we propose a principled and unified probabilistic model APE (Anomaly detection via Probabilistic pairwise interaction and Entity embedding) that directly models the likelihood of events. In this model, we embed entities into a common latent space using their observed co-occurrence in different events. More specifically, we first model the compatibility of each pair of entities according to their embeddings. Then we utilize the weighted pairwise interactions of different entity types to define the event probability. Using Noise-Contrastive Estimation with "context-dependent" noise distribution, our model can be learned efficiently regardless of the large event space. Experimental results on real enterprise surveillance data show that our methods can accurately detect abnormal events compared to other state-of-the-art abnormal detection techniques.