Mathematical Modeling of Anomalies in Structured Large-Scale Data

Mathematical modeling of anomalies (also called anomaly detecion) is a subfield of artificial intelligence. The task is to identify observations that somehow differ from the majority of the data or from the expected pattern. In the real world applications, the anomalous observations occur rarely but they could indicate important and dangerous situation such as various types of frauds (bank, computer) or critical conditions of a monitored subject (human, plane, server).

The multiple instance learning (MIL) paradigm allows us to utilize the machine learning much more powerful for specific type of problems with structured data. In contrast with the standard learning algorithms that operate on (labeled) vectors, the MIL operates on (labeled) arbitrarily large sets of vectors. Typical example is to model the behavior of computers in the computer network such that each connection to single target is represented by a set of vectors and each computer is represented by a set of connections. Thus, a hierarchy of vectors signifies one training sample. This paradigm differs considerably from mainstream Machine Learning assumptions; the field of MIL-based modeling can still be considered as largely unexplored. Particularly, the field of MIL-based anomaly detection is in very early stages, although potential practical use of such methods would be clearly extensive. Detecting anomalous behavior of computers in network is just one straightforward example, albeit the one we aim at exploring in depth.