Variance Norms for Kernelized Anomaly Detection
<|reference_start|>Variance Norms for Kernelized Anomaly Detection: We present a unified theory for Mahalanobis-type anomaly detection on Banach spaces, using ideas from Cameron-Martin theory applied to non-Gaussian measures. This approach leads to a basis-free, data-driven notion of anomaly distance through the so-called variance norm of a probability measure, which can be consistently estimated using empirical measures. Our framework generalizes the classical $\mathbb{R}^d$, functional $(L^2[0,1])^d$, and kernelized settings, including the general case of non-injective covariance operator. We prove that the variance norm depends solely on the inner product in a given Hilbert space, and hence that the kernelized Mahalanobis distance can naturally be recovered by working on reproducing kernel Hilbert spaces.   Using the variance norm, we introduce the notion of a kernelized nearest-neighbour Mahalanobis distance for semi-supervised anomaly detection. In an empirical study on 12 real-world datasets, we demonstrate that the kernelized nearest-neighbour Mahalanobis distance outperforms the traditional kernelized Mahalanobis distance for multivariate time series anomaly detection, using state-of-the-art time series kernels such as the signature, global alignment, and Volterra reservoir kernels. Moreover, we provide an initial theoretical justification of nearest-neighbour Mahalanobis distances by developing concentration inequalities in the finite-dimensional Gaussian case.<|reference_end|>
@article{cass2024variance,
    title={Variance Norms for Kernelized Anomaly Detection},
    author={Thomas Cass, Lukas Gonon, Nikita Zozoulenko},
    journal={arXiv preprint arXiv:2407.11873},
    year={2024},
    archivePrefix={arXiv},
    eprint={2407.11873},
    primaryClass={stat.ML cs.LG math.PR}
}