Sparse Representation of Multivariate Extremes with Applications to Anomaly Ranking
This work addresses anomaly detection in high-dimensional settings for fields like cybersecurity or finance, offering a novel approach by applying multivariate EVT for the first time in this domain.
The paper tackles the problem of ranking anomalies in high-dimensional data by proposing a new algorithm based on multivariate Extreme Value Theory, which achieves linear scaling with dimension and near-linear scaling with data size, enabling large-scale applications.
Extremes play a special role in Anomaly Detection. Beyond inference and simulation purposes, probabilistic tools borrowed from Extreme Value Theory (EVT), such as the angular measure, can also be used to design novel statistical learning methods for Anomaly Detection/ranking. This paper proposes a new algorithm based on multivariate EVT to learn how to rank observations in a high dimensional space with respect to their degree of 'abnormality'. The procedure relies on an original dimension-reduction technique in the extreme domain that possibly produces a sparse representation of multivariate extremes and allows to gain insight into the dependence structure thereof, escaping the curse of dimensionality. The representation output by the unsupervised methodology we propose here can be combined with any Anomaly Detection technique tailored to non-extreme data. As it performs linearly with the dimension and almost linearly in the data (in O(dn log n)), it fits to large scale problems. The approach in this paper is novel in that EVT has never been used in its multivariate version in the field of Anomaly Detection. Illustrative experimental results provide strong empirical evidence of the relevance of our approach.