We are working on anomaly detection, where we want to quantify the influence of a subset of attributes (or features) for making a data set anomalous.
Let us consider an illustrative example as follows.
We have an anomalous data set D having N attributes and M instances. Now, we execute some deterministic anomaly detection algorithm to retrieve the anomalous instances from D. Let us consider that this algorithm has retrieved Q (Q
First, thanks for very interesting and important question!
In my opinion, it isn't correct to consider only Q instances - we should take into account both positive (with anomalous) and negative (without anomalous) instances. To calculate influence of some sub-set P1 of features, you can perform cross-validation under this subset and full data set M, using some classification method (e.g., SVM). Relative measure of this sub-set P1 for other sub-set P2 will be relative influence. This measure may be Recall, Precision, F1, etc.
Hi
Useful links:
Conference Paper Creating Novel Features to Anomaly Network Detection Using D...
http://www.cs.cmu.edu/~kaustav/thesis/kaustav_thesis.pdfCheers
You need to make some relative measurement for botb subnet p1 and p2 to get result and compare with others and to perform some calculations
- Badges
- Science topic
- Similar topics
- Computer Science
- Data Mining