# Unsupervised Learning of Distributional Properties can Supplement Human Labeling and Increase Active Learning Efficiency in Anomaly Detection

arXiv: https://arxiv.org/abs/2307.08782 · HTML: https://mlsanity.com/paper/2307.08782/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 4 of its 48 references that are in the map.
- First posted on arXiv 13 Jul 2023.

## Builds on (most cited first, 4 of 4)

- [Generalized Out-of-Distribution Detection: A Survey](https://mlsanity.com/paper/2110.11334/) (2021)
- [Consistency-based Semi-supervised Active Learning: Towards Minimizing Labeling Cost](https://mlsanity.com/paper/1910.07153/) (2019)
- [Learning Active Learning from Data](https://mlsanity.com/paper/1703.03365/) (2017)
- [Implementing Active Learning in Cybersecurity: Detecting Anomalies in Redacted Emails](https://mlsanity.com/paper/2303.00870/) (2023)

## Abstract (arXiv)

Exfiltration of data via email is a serious cybersecurity threat for many organizations. Detecting data exfiltration (anomaly) patterns typically requires labeling, most often done by a human annotator, to reduce the high number of false alarms. Active Learning (AL) is a promising approach for labeling data efficiently, but it needs to choose an efficient order in which cases are to be labeled, and there are uncertainties as to what scoring procedure should be used to prioritize cases for labeling, especially when detecting rare cases of interest is crucial. We propose an adaptive AL sampling strategy that leverages the underlying prior data distribution, as well as model uncertainty, to produce batches of cases to be labeled that contain instances of rare anomalies. We show that (1) the classifier benefits from a batch of representative and informative instances of both normal and anomalous examples, (2) unsupervised anomaly detection plays a useful role in building the classifier in the early stages of training when relatively little labeling has been done thus far. Our approach to AL for anomaly detection outperformed existing AL approaches on three highly unbalanced UCI benchmarks and on one real-world redacted email data set.