# Categorical anomaly detection in heterogeneous data using minimum description length clustering

arXiv: https://arxiv.org/abs/2006.07916 · HTML: https://mlsanity.com/paper/2006.07916/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Jun 2020.

## Built on by (most cited first, 4 of 4)

- [From One Attack Domain to Another: Contrastive Transfer Learning with Siamese Networks for APT Detection](https://mlsanity.com/paper/2511.20500/) (2025)
- [Ranking-Enhanced Anomaly Detection Using Active Learning-Assisted Attention Adversarial Dual AutoEncoders](https://mlsanity.com/paper/2511.20480/) (2025)
- [Attackers Strike Back? Not Anymore -- An Ensemble of RL Defenders Awakens for APT Detection](https://mlsanity.com/paper/2508.19072/) (2025)
- [Refining Decision Boundaries In Anomaly Detection Using Similarity Search Within the Feature Space](https://mlsanity.com/paper/2602.02925/) (2026)

## Abstract (arXiv)

Fast and effective unsupervised anomaly detection algorithms have been proposed for categorical data based on the minimum description length (MDL) principle. However, they can be ineffective when detecting anomalies in heterogeneous datasets representing a mixture of different sources, such as security scenarios in which system and user processes have distinct behavior patterns. We propose a meta-algorithm for enhancing any MDL-based anomaly detection model to deal with heterogeneous data by fitting a mixture model to the data, via a variant of k-means clustering. Our experimental results show that using a discrete mixture model provides competitive performance relative to two previous anomaly detection algorithms, while mixtures of more sophisticated models yield further gains, on both synthetic datasets and realistic datasets from a security scenario.