# gen2Out: Detecting and Ranking Generalized Anomalies

arXiv: https://arxiv.org/abs/2109.02704 · HTML: https://mlsanity.com/paper/2109.02704/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 30 references that are in the map.
- First posted on arXiv 6 Sep 2021.

## Builds on (most cited first, 5 of 5)

- [A review on outlier/anomaly detection in time series data](https://mlsanity.com/paper/2002.04236/) (2020)
- [A Meta-Analysis of the Anomaly Detection Problem](https://mlsanity.com/paper/1503.01158/) (2015)
- [One-Class Support Measure Machines for Group Anomaly Detection](https://mlsanity.com/paper/1303.0309/) (2013)
- [GLAD: Group Anomaly Detection in Social Media Analysis- Extended Abstract](https://mlsanity.com/paper/1410.1940/) (2014)
- [Group Anomaly Detection using Deep Generative Models](https://mlsanity.com/paper/1804.04876/) (2018)

## Built on by (most cited first, 7 of 7)

- [ADBench: Anomaly Detection Benchmark](https://mlsanity.com/paper/2206.09426/) (2022)
- [Unsupervised anomaly detection algorithms on real-world data: how many do we need?](https://mlsanity.com/paper/2305.00735/) (2023)
- [Anomaly Detection with Score Distribution Discrimination](https://mlsanity.com/paper/2306.14403/) (2023)
- [D.MCA: Outlier Detection with Explicit Micro-Cluster Assignments](https://mlsanity.com/paper/2210.08212/) (2022)
- [McCatch: Scalable Microcluster Detection in Dimensional and Nondimensional Datasets](https://mlsanity.com/paper/2403.08027/) (2024)
- [Unleashing the Potential of Unsupervised Deep Outlier Detection through Automated Training Stopping](https://mlsanity.com/paper/2305.16777/) (2023)
- [FRAUDGUESS: Spotting and Explaining New Types of Fraud in Million-Scale Financial Data](https://mlsanity.com/paper/2509.15493/) (2025)

## Abstract (arXiv)

In a cloud of m-dimensional data points, how would we spot, as well as rank, both single-point- as well as group- anomalies? We are the first to generalize anomaly detection in two dimensions: The first dimension is that we handle both point-anomalies, as well as group-anomalies, under a unified view -- we shall refer to them as generalized anomalies. The second dimension is that gen2Out not only detects, but also ranks, anomalies in suspiciousness order. Detection, and ranking, of anomalies has numerous applications: For example, in EEG recordings of an epileptic patient, an anomaly may indicate a seizure; in computer network traffic data, it may signify a power failure, or a DoS/DDoS attack. We start by setting some reasonable axioms; surprisingly, none of the earlier methods pass all the axioms. Our main contribution is the gen2Out algorithm, that has the following desirable properties: (a) Principled and Sound anomaly scoring that obeys the axioms for detectors, (b) Doubly-general in that it detects, as well as ranks generalized anomaly -- both point- and group-anomalies, (c) Scalable, it is fast and scalable, linear on input size. (d) Effective, experiments on real-world epileptic recordings (200GB) demonstrate effectiveness of gen2Out as confirmed by clinicians. Experiments on 27 real-world benchmark datasets show that gen2Out detects ground truth groups, matches or outperforms point-anomaly baseline algorithms on accuracy, with no competition for group-anomalies and requires about 2 minutes for 1 million data points on a stock machine.