A Revealing Large-Scale Evaluation of Unsupervised Anomaly Detection Algorithms
This work addresses the challenge of selecting anomaly detection algorithms for applications like fraud detection and health monitoring, though it is incremental as it focuses on improving evaluation consistency rather than introducing new methods.
The authors tackled the problem of inconsistent evaluation protocols for unsupervised anomaly detection algorithms by defining a coherent protocol and applying it to compare twelve popular methods on five tabular datasets, resulting in an updated performance picture that identifies standout methods and revises misconceptions.
Anomaly detection has many applications ranging from bank-fraud detection and cyber-threat detection to equipment maintenance and health monitoring. However, choosing a suitable algorithm for a given application remains a challenging design decision, often informed by the literature on anomaly detection algorithms. We extensively reviewed twelve of the most popular unsupervised anomaly detection methods. We observed that, so far, they have been compared using inconsistent protocols - the choice of the class of interest or the positive class, the split of training and test data, and the choice of hyperparameters - leading to ambiguous evaluations. This observation led us to define a coherent evaluation protocol which we then used to produce an updated and more precise picture of the relative performance of the twelve methods on five widely used tabular datasets. While our evaluation cannot pinpoint a method that outperforms all the others on all datasets, it identifies those that stand out and revise misconceived knowledge about their relative performances.