Reliable Anomaly Detection with Explanation and Feedback

Loading...
Thumbnail Image
Degree type
Doctor of Philosophy (PhD)
Graduate group
Computer and Information Science
Discipline
Computer Sciences
Subject
Anomaly Detection
Funder
Grant number
License
Copyright date
2025
Distributor
Related resources
Author
Ji, Xiayan
Contributor
Abstract

Anomalies, though rare, can lead to significant economic losses and critical system failures. While detection is essential, much of the existing research focuses solely on identifying anomalies—often overlooking performance guarantees, interpretability, and long-term adaptability. This thesis addresses these gaps by introducing three core building blocks: detection, explanation, and feedback. First, we present PAC-Wrap, a detection module that augments existing anomaly detectors with two-sided statistical guarantees on both the false positive rate (FPR) and the false negative rate (FNR). Second, we introduce AR-Pro, an explanation module that generates counterfactual explanations and suggests potential rectifications in a domain-agnostic manner. Third, we develop a feedback module that incorporates human input to incrementally update anomaly detection models, helping maintain tight performance guarantees as data and usage evolve. These components are modular and generalize across domains, supporting flexible integration in diverse application settings. To evaluate the approach, we conducted three real-world case studies. The first addresses social isolation and loneliness (SI/L) among older adults—a condition associated with serious health risks. We developed and deployed \emph{iCareLoop}, a cyber-physical sensing system that monitors daily activity patterns in senior communities across the U.S. and Japan. Built on top of iCareLoop, SMILE integrates detection and explanation via AR-Pro to identify SI/L risk and generate personalized intervention strategies. The second case study focuses on forensic analysis in hierarchical social networks, such as corporate fraud or extremist networks, where labeled data is limited and the stakes are high. We formulate this as a graph anomaly detection problem and apply PAC-Wrap to ensure reliable detection outcomes. The third case study targets potentially malicious Bash command-line activity in the cybersecurity domain. In this high-risk, low-label setting, we apply PAC-Wrap to a textual anomaly detector to enforce statistical guarantees under evolving threat conditions. In summary, this thesis presents a generalizable anomaly detection system that integrates reliability, interpretability, and adaptability through three modular building blocks. We validate this approach across applications in healthcare, social networks, and cybersecurity, demonstrating its effectiveness in high-stakes, real-world environments.

Advisor
Lee, Insup
Sokolsky, Oleg
Date of degree
2025
Date Range for Data Collection (Start Date)
Date Range for Data Collection (End Date)
Digital Object Identifier
Series name and number
Volume number
Issue number
Publisher
Publisher DOI
Journal Issue
Comments
Recommended citation