{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/temporal-anomaly-detection-calibrating-the","title":"Temporal anomaly detection: calibrating the surprise","arxiv_id":"1705.10085","date":"2017-05-29","proceeding":null,"authors":["Eyal Gutflaish","Aryeh Kontorovich","Sivan Sabato","Ofer Biller","Oded Sofer"],"abstract":"We propose a hybrid approach to temporal anomaly detection in access data of\nusers to databases --- or more generally, any kind of subject-object\nco-occurrence data. We consider a high-dimensional setting that also requires\nfast computation at test time. Our methodology identifies anomalies based on a\nsingle stationary model, instead of requiring a full temporal one, which would\nbe prohibitive in this setting. We learn a low-rank stationary model from the\ntraining data, and then fit a regression model for predicting the expected\nlikelihood score of normal access patterns in the future. The disparity between\nthe predicted likelihood score and the observed one is used to assess the\n`surprise' at test time. This approach enables calibration of the anomaly\nscore, so that time-varying normal behavior patterns are not considered\nanomalous. We provide a detailed description of the algorithm, including a\nconvergence analysis, and report encouraging empirical results. One of the data\nsets that we tested, TDA, is new for the public domain. It consists of two\nmonths' worth of database access records from a live system. Our code is\npublicly available at https://github.com/eyalgut/TLR_anomaly_detection.git. The\nTDA data set is available at\nhttps://www.kaggle.com/eyalgut/binary-traffic-matrices.","url_abs":"http://arxiv.org/abs/1705.10085v2","url_pdf":"http://arxiv.org/pdf/1705.10085v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"temporal-anomaly-detection-calibrating-the","repo_url":"https://github.com/eyalgut/TLR_anomaly_detection","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"none","reach":null}],"tasks":[{"task_slug":"anomaly-detection","task_name":"Anomaly Detection"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":null,"mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}