Explaining Anomalies in Groups with Characterizing Subspace Rules

Anomaly detection has numerous applications and has been studied vastly. We consider a complementary problem that has a much sparser literature: anomaly description. Interpretation of anomalies is crucial for practitioners for sense-making, troubleshooting, and planning actions. To this end, we present a new approach called x-PACS (for eXplaining Patterns of Anomalies with Characterizing Subspaces), which "reverse-engineers" the known anomalies by identifying (1) the groups (or patterns) that they form, and (2) the characterizing subspace and feature rules that separate each anomalous pattern from normal instances. Explaining anomalies in groups not only saves analyst time and gives insight into various types of anomalies, but also draws attention to potentially critical, repeating anomalies. In developing x-PACS, we first construct a desiderata for the anomaly description problem. From a descriptive data mining perspective, our method exhibits five desired properties in our desiderata. Namely, it can unearth anomalous patterns (i) of multiple different types, (ii) hidden in arbitrary subspaces of a high dimensional space, (iii) interpretable by the analysts, (iv) different from normal patterns of the data, and finally (v) succinct, providing the shortest data description. Furthermore, x-PACS is highly parallelizable and scales linearly in terms of data size. No existing work on anomaly description satisfies all of these properties simultaneously. While not our primary goal, the anomalous patterns we find serve as interpretable "signatures" and can be used for detection. We show the effectiveness of x-PACS in explanation as well as detection on real-world datasets as compared to state-of-the-art.