Abstract:In anomaly detection, the degree of irregularity is often summarized as a real-valued anomaly score. We address the problem of attributing such anomaly scores to input features for interpreting the results of anomaly detection. We particularly investigate the use of the Shapley value for attributing anomaly scores of semi-supervised detection methods. We propose a characteristic function specifically designed for attributing anomaly scores. The idea is to approximate the absence of some features by locally minimizing the anomaly score with regard to the to-be-absent features. We examine the applicability of the proposed characteristic function and other general approaches for interpreting anomaly scores on multiple datasets and multiple anomaly detection methods. The results indicate the potential utility of the attribution methods including the proposed one.
What problem does this paper attempt to address?
### What problem does this paper attempt to solve?
This paper aims to solve the problem of how to attribute the anomaly scores in anomaly detection results to input features. Specifically, the author focuses on how to use Shapley values to reasonably allocate anomaly scores to each input feature when explaining anomaly detection results. The key to this problem lies in designing a characteristic function suitable for the characteristics of anomaly scores to ensure the effectiveness and accuracy of the attribution method.
#### Background and Motivation
1. **Anomaly Detection and Localization**
- Anomaly detection is an important task in machine learning and data mining, aiming to identify outliers in data.
- The goal of anomaly localization (or root - cause analysis) is to determine which features are most responsible for the irregularity of outliers.
- In many application scenarios, understanding why a specific instance is considered an anomaly is of great value for decision - making.
2. **Limitations of Existing Methods**
- Existing Shapley value attribution methods usually adopt general characteristic function definitions, which may not fully consider the unique properties of anomaly scores, thus limiting the practicality of the attribution method.
3. **Research Objectives**
- Propose a characteristic function definition specifically for anomaly scores to improve the interpretability of anomaly detection results.
- Verify the applicability and potential advantages of the proposed method on multiple datasets and anomaly detection methods through experiments.
#### Main Contributions
- **Propose a New Characteristic Function**: The author proposes a new characteristic function definition, which approximates the absence of certain features by locally minimizing the anomaly score. The specific formula is as follows:
\[
v(S; x) := e(x^*(S; x)), \quad \text{where} \quad x^*(S; x) := \arg\min_{y \in M_x \subset X, y_S = x_S} e(y)
\]
where \(M_x\) is a certain compact neighborhood of \(x\), \(S\) is a feature subset, and \(e(y)\) is an anomaly score function.
- **Practical Simplification Methods**: To reduce the computational complexity, the author also proposes several practical simplification methods, such as introducing a regularization term:
\[
\hat{v}(S; x) := e(\hat{x}^*(S; x)), \quad \text{where} \quad \hat{x}^*(S; x) := \arg\min_{y \in X, y_S = x_S} \ell_{S,x}(y)
\]
where
\[
\ell_{S,x}(y) := e(y) + \gamma \sum_{i \in S^c} \frac{\text{dist}(y_i, x_i)}{|S^c|}
\]
Here, \(\gamma\) is a hyperparameter that controls the degree to which feature values deviate from the original values.
- **Experimental Verification**: Through experiments on multiple datasets and anomaly detection methods, the effectiveness of the proposed method is verified and compared with other existing methods.
In conclusion, the main goal of this paper is to improve the accuracy and practicality of anomaly detection result interpretation by improving the characteristic function definition of Shapley values.