Anomaly Detection

build a model for the probability of x—p(x)
a small threshold— $\epsilon$

---

Gaussian(Normal) Distribution

x~N($\mu,\sigma^2$)
p(x; $\mu,\sigma^2$)

---

Parameter estimation

if $x^{(i)}$~$N(\mu,\sigma^2)$
then $\mu=\frac{1}{m}\sum_{i=1}^m x^{(i)}$
$\sigma^2=\frac{1}{m}\sum_{i=1}^m (x^{(i)}-\mu)^2$

---

Density Estimation

$p(x)=\prod_{j=1}^n p(x_j;\mu_j,\sigma_j^2)$

---

Anomaly Detection Algorithm

---

---

Evaluation

It doesn’t matter if there are actually some anomalous ones in training set.

The alternative one is not recommended.

We can choose $\epsilon$,features and so on by examming F1 score.

---

---

Non-gaussian features

Try to do some transformation to our x until it looks more like Gaussian.

---

• Choose Feature
  

• Create Features
  

---

Multivariate Gaussian Distribution

Problem:

To solve it:

Then we got:

So here’s algorithm for Anomaly detection with multivariate Gaussian

---

The difference between the two models

This new model, using a multivariate Gaussian distribution, corresponds exactly to the old model, if the covariance matrix sigma, has only 0 elements off the diagonals, and in pictures that corresponds to having Gaussian distributions, where the contours of this distribution function are axis aligned. So you aren’t allowed to model the correlations between the diffrent features.

So in that sense the original model is actually a special case of this multivariate Gaussian model.