Source-linked AI summary
Deep Learning for Anomaly Detection: A Review
Guansong Pang, Chunhua Shen, Longbing Cao, Anton van den Hengel
TL;DR
Anomaly detection faces rare, heterogeneous events, limited labels, low recall, and interpretability challenges. This paper surveys deep anomaly detection through a taxonomy and systematic review of methods, assumptions, objectives, and capabilities. It concludes by identifying future opportunities while documenting method-specific limitations and challenge-targeting properties.
Problem
Anomaly detection involves rare, heterogeneous events and faces largely unsolved challenges including low recall, limited labeled anomaly data, and interpretability.
Method
The paper systematically reviews deep anomaly detection using three conceptual frameworks and a hierarchical taxonomy of 11 modeling perspectives.
Results
The review describes how deep methods address challenges through learned representations, end-to-end anomaly-score learning, weak supervision, priors, and related modeling strategies.
Takeaways & Limitations
Deep anomaly detection offers a structured way to study challenge-targeting methods and motivates future opportunities for addressing persistent detection difficulties.
Takeaways & Limitations
Autoencoders can memorize training noise, while GAN-based detectors may be unstable and are limited to semi-supervised settings.
Abstract
from arXiv · showhide
Anomaly detection, a.k.a. outlier detection or novelty detection, has been a lasting yet active research area in various research communities for several decades. There are still some unique problem complexities and challenges that require advanced approaches. In recent years, deep learning enabled anomaly detection, i.e., deep anomaly detection, has emerged as a critical direction. This paper surveys the research of deep anomaly detection with a comprehensive taxonomy, covering advancements in three high-level categories and 11 fine-grained categories of the methods. We review their key intuitions, objective functions, underlying assumptions, advantages and disadvantages, and discuss how they address the aforementioned challenges. We further discuss a set of possible future opportunities and new perspectives on addressing the challenges.
1 INTRODUCTION
The paper addresses largely unsolved anomaly-detection challenges by systematically reviewing deep methods and their capabilities. It contributes a taxonomy, comprehensive review, and discussion of future opportunities.
- The review examines major largely unsolved anomaly-detection challenges before assessing how current deep methods address them.
- Existing reviews primarily cover conventional methods, while related deep-learning work offers only selective, high-level category outlines.
- The paper organizes deep anomaly detection into three frameworks and 11 modeling perspectives.
- It reviews assumptions, objective functions, intuitions, advantages, disadvantages, and challenge-targeting capabilities across relevant studies.
- The paper also discusses future opportunities and provides source codes and datasets.
2 ANOMALY DETECTION: PROBLEM COMPLEXITIES AND CHALLENGES
Anomaly detection concerns rare, heterogeneous, uncertain events that create distinctive challenges beyond ordinary analytical tasks. The review emphasizes low recall, complex data, data-efficient learning, and interpretability as largely unsolved concerns.
- Anomaly detection targets minority, unpredictable, and rare events, producing problem complexities distinct from regular analytical tasks.
- Unknownness, heterogeneous anomaly classes, rarity, and diverse anomaly types complicate detection and labeling.
- CH1 concerns low recall because rare and heterogeneous anomalies cause false positives and missed sophisticated anomalies.
- CH3 concerns data-efficient learning because labeled anomaly data are costly, while unsupervised methods lack prior knowledge of true anomalies.
- Obtaining anomaly explanations and balancing interpretability with effectiveness remain largely unsolved, especially for complex models.
3 ADDRESSING THE CHALLENGES WITH DEEP ANOMALY DETECTION
Deep anomaly detection uses neural networks to learn representations or anomaly scores and organizes methods into three conceptual paradigms. The taxonomy distinguishes how deep learning and anomaly detection are coupled.
- Deep learning builds expressive representations through compositions of linear and nonlinear functions in computational graphs.
- Deep anomaly detection learns either a feature mapping into a lower-dimensional representation space or an anomaly-score function.
- The review classifies methods into Deep Learning for Feature Extraction, Learning Feature Representations of Normality, and End-to-end Anomaly Score Learning.
- In feature extraction, deep learning and anomaly detection are separated, whereas representation-learning methods make the modules dependent.
4 DEEP LEARNING FOR FEATURE EXTRACTION
Deep feature extraction maps complex, high-dimensional data into lower-dimensional representations before applying an independent anomaly scorer. Compared with linear reduction, deep models can capture richer semantic and nonlinear relations, but this separation can produce suboptimal scores.
- Framework: Feature extraction projects high-dimensional or nonlinearly separable data into a lower-dimensional space, while anomaly scoring remains independent.The mapping ϕ transforms X ∈ R^D to Z ∈ R^K, typically with D≫K, and f then scores instances in Z.
- Capabilities: Deep learning extracts more semantic-rich features and nonlinear feature relations than popular dimension-reduction methods such as PCA and random projection.
- Methods: Pre-trained models including AlexNet, VGG, and ResNet provide low-dimensional features for anomaly detection in complex image and video data.The unmasking framework uses iteratively trained classifiers on video-frame windows and relies on feature quality; VGG pre-trained on ILSVRC is reported effective for expressive appearance features.
- Methods: Deep feature extraction can be implemented with pre-trained models or explicitly trained extractors, followed by downstream anomaly detectors such as one-class SVMs.Examples include autoencoders trained for appearance and motion representations, with separate one-class SVMs applied to the learned features.
- Advantages: This approach offers readily available models and detectors, stronger dimensionality reduction than linear methods, and straightforward implementation.
- Limitations: Disjoint feature extraction and anomaly scoring can yield suboptimal anomaly scores and may fail to preserve information needed for detection.
5 LEARNING FEATURE REPRESENTATIONS OF NORMALITY
These methods couple feature learning with anomaly scoring rather than fully separating the two modules. They comprise generic feature learning and anomaly-measure-dependent feature learning.
- Framework: Feature learning and anomaly scoring are coupled in these methods instead of being fully decoupled.
- Categories: The methods divide into generic feature learning and anomaly measure-dependent feature learning.
5.1 Generic Normality Feature Learning
Generic normality feature learning uses deep objectives to capture data regularities that support anomaly scoring, including reconstruction, generation, prediction, and self-supervised classification. Its benefits depend on assumptions about normality and can be limited when training data contain anomalies or when objectives are not detection-specific.
- Framework: Generic feature learning optimizes a surrogate objective rather than an anomaly-detection objective, while the learned representation and scorer produce anomaly scores.ϕ maps data to Z, ψ performs a surrogate task enforcing underlying regularities, ℓ is its loss, and f computes score s.
- Methods: The category includes data reconstruction, generative modeling, predictability modeling, and self-supervised classification.Predictability modeling and self-supervised classification both use self-supervised learning but rely on different assumptions, advantages, and flaws.
- Data Reconstruction: Autoencoders learn low-dimensional representations that reconstruct normal data well, using reconstruction error as an anomaly signal.The encoder maps inputs to a bottleneck representation and the decoder recovers the data using a reconstruction loss.
- Data Reconstruction: Autoencoder variants add sparsity, denoising, contractive, or variational regularization to obtain richer, more robust, or better-structured representations.These variants respectively encourage sparse activations, robustness to small variations, local robustness through a Jacobian penalty, or regularization through a latent prior.
- Data Reconstruction: Autoencoders are straightforward, generic across data types, and adaptable through architectures such as CNN-AE, LSTM-AE, Conv-LSTM-AE, and GCN-AE.
- Data Reconstruction: Reconstruction representations can be biased by infrequent regularities or anomalous training data, and their compression objective is not optimized for irregularities.
- Data Reconstruction: Autoencoders can handle high-dimensional and non-independent data, but training noise may be memorized, causing overfitting and small anomaly reconstruction errors.The review notes RPCA-inspired training as a possible route to more robust detection models.
- Generative Modeling: GAN-based methods learn a latent space for normality and use residuals between real and generated instances as anomaly scores.Their central assumption is that normal instances are generated better than anomalies from the learned latent space.
5.2 Anomaly Measure-dependent Feature Learning
Anomaly measure-dependent feature learning optimizes representations for a particular anomaly measure rather than applying that measure only after generic feature extraction. The reviewed approaches tailor representations to distance-, one-class-classification-, and clustering-based measures, with benefits and limitations that depend on each measure.
- The framework incorporates an existing anomaly measure into the feature-learning objective to optimize representations specifically for that measure.This differs from generic feature learning, which computes anomaly scores heuristically after obtaining representations.
- Distance-based Measure: Distance-based objectives can use pseudo-labeled anomalies, margins, random mappings, proximity prediction, or boosting to improve representation learning and robustness.One approach enforces an anomaly-versus-normal random-neighbor distance gap of at least m; another compares optimized and randomly projected representations.
- Distance-based Measure: Distance-based methods are theoretically grounded, effective in low-dimensional spaces for high-dimensional data, and specifically tailored to their anomaly measures.Their disadvantages include extensive computation and dependence on the inherent weaknesses of distance-based measures.
- Distance-based Measure: Distance-based methods learn low-dimensional representations tailored to distance measures, addressing distance-based detection’s curse of dimensionality.Their assumptions place anomalies far from closest neighbors and normal instances in dense neighborhoods.
- One-class Classification-based Measure: One-class-classification methods jointly learn representations and one-class descriptions, while labeled normal and abnormal data can support detection of both known anomalies and novel anomaly classes.These methods also avoid manually selecting traditional one-class models’ kernel functions.
- Clustering-based Measure: Clustering-based methods can improve detection in discriminative low-dimensional representations, but contaminated training data may bias clustering and anomaly scores.Semi-supervised normal-only training or additional constraints are required to reduce contamination effects in the unsupervised setting.
6 END-TO-END ANOMALY SCORE LEARNING
End-to-end anomaly score learning directly learns scalar anomaly scores, often jointly with feature representations, rather than applying heuristic measures afterward. The section covers ranking, prior-driven, softmax likelihood, and one-class classification models, along with their benefits, assumptions, and limitations.
- Framework: End-to-end models directly learn scalar anomaly scores with neural networks and novel loss functions, without relying on existing anomaly measures.They learn the scoring function τ(·; Θ): X ↦ R.
- 6.1 Ranking Models: Ranking models use ordinal or relative abnormality information to optimize anomaly scores, including under weak or coarse supervision.Multiple-instance learning can compare the highest-scoring segments in positive and negative video bags while enforcing smoothness and sparsity.
- 6.2 Prior-driven Models: Prior-driven models optimize scores against a chosen prior and can provide interpretable Z-score confidence intervals for individual anomalies.Their effectiveness depends on selecting a prior that fits the underlying distribution.
- 6.3 Softmax Likelihood Models: Softmax likelihood models incorporate specific abnormal interactions so anomaly scores are faithfully optimized for the interactions being captured.The likelihood formulation models the probability of an instance through a parameterized softmax function.
- 6.4 End-to-end One-class Classification: Adversarial one-class models jointly optimize a classifier and generated reference instances, but GAN instability and poor resemblance to unknown anomalies constrain performance.These models generate distorted or fringe instances to support one-class discrimination and expressive normality representations.
7 ALGORITHMS AND DATASETS
The review summarizes representative algorithms and highlights limitations in comparing their empirical performance across diverse datasets. It also assembles real-world datasets with genuine anomalies to support more challenging evaluations.
- Algorithms: Diverse datasets make universal meta-analysis of the reviewed methods’ empirical performance difficult.The review instead summarizes observations about model design.
- Algorithms: Most representative methods operate in unsupervised or semi-supervised modes, while data augmentation, dropout, and pre-training remain under-explored.
- Datasets: 21 publicly available real-world datasets with real anomalies span multiple application domains and data types.The collection emphasizes large-scale and/or high-dimensional complex datasets as challenging testbeds for deep anomaly detection.
8 CONCLUSIONS AND FUTURE OPPORTUNITIES
The review identifies future opportunities spanning supervision, representation learning, anomaly types, multimodal data, interpretability, and emerging settings. It also emphasizes the need for informative anomaly-specific signals and robust evaluation conditions.
- Supervision: Deep anomaly detection should explore informative supervisory signals beyond generic objectives and traditional anomaly-measure constraints.Generic objectives are not optimized specifically for anomaly detection, while anomaly-measure constraints can inherit implicit assumptions.
- Supervision: Weakly supervised and few-shot methods can leverage limited labeled anomaly examples to improve anomaly-informed representations and detection recall.The review highlights partially, inexactly, or inaccurately labeled data and data-efficient learning of known anomaly classes.
- Representation learning: Unsupervised and self-supervised pre-training requires clean or contamination-robust unlabeled data, including during fine-tuning.Anomalies and datasets vary significantly across domains, so robustness to anomaly contamination is important.
- Problem settings: Future work should extend deep methods beyond point anomalies and single-source data toward conditional, group, and multimodal anomaly detection.The review identifies conditional/group anomalies and multimodal anomaly detection as significantly less explored or largely unexplored.
- Interpretability: Interpretability and actionability are needed to understand model decisions, mitigate potential bias or risk, and enable decision-making actions.
- Novel applications and settings: OOD detection and curiosity learning are emerging settings for extending deep anomaly detection methods.OOD detection addresses instances far from the training distribution, while curiosity learning uses novelty or rarity to define bonus rewards in sparse-reward reinforcement learning.
A LINKS TO OPEN-SOURCE ALGORITHMS
The review provides access links for open-source deep anomaly detection algorithms. The linked collection covers 23 algorithms.
- Table 4 provides links to access open-source anomaly detection algorithms.
- The open-source collection contains 23 algorithms.
- The links are presented as a resource accompanying the review’s algorithm survey.