From Explanation to Action: An End-to-End Human-in-the-loop Framework for Anomaly Reasoning and Management
This addresses the need for human-in-the-loop anomaly management in high-stakes applications like finance, though it is incremental by building on existing detection methods.
The paper tackles the problem of integrating human expertise into anomaly detection systems by introducing ALARM, an end-to-end framework that supports detection, explanation, and interactive rule design, demonstrated through case studies with fraud analysts in finance.
Anomalies are often indicators of malfunction or inefficiency in various systems such as manufacturing, healthcare, finance, surveillance, to name a few. While the literature is abundant in effective detection algorithms due to this practical relevance, autonomous anomaly detection is rarely used in real-world scenarios. Especially in high-stakes applications, a human-in-the-loop is often involved in processes beyond detection such as verification and troubleshooting. In this work, we introduce ALARM (for Analyst-in-the-Loop Anomaly Reasoning and Management); an end-to-end framework that supports the anomaly mining cycle comprehensively, from detection to action. Besides unsupervised detection of emerging anomalies, it offers anomaly explanations and an interactive GUI for human-in-the-loop processes -- visual exploration, sense-making, and ultimately action-taking via designing new detection rules -- that help close ``the loop'' as the new rules complement rule-based supervised detection, typical of many deployed systems in practice. We demonstrate \method's efficacy through a series of case studies with fraud analysts from the financial industry.