Expert-Based Fusion Algorithm of an Ensemble of Anomaly Detection Algorithms - Technologies and Applications of Artificial Intelligence - page 116

from a multitude of sensors is used to yield an optimal estimate of a specified
state vector pertaining to the observed system, whereas sensor administration
is the design of communication and control mechanisms for the ecient use of
distributed sensors with regard to power, performance, reliability, etc. In this
paper we deal with a special case of information fusion which is decision fusion
[5]. In information fusion the goal is to fuse complex noisy information provided
by multi-sources or multi sensors, of distributed networks, to produce a single
unified information model (e.g., vision systems, sonar, robotic platform, weather
prediction [4]). However, in our case of decision fusion, we aim to integrate the
multiple decisions we receive from the ADAs into a single decision that will be
more accurate than the decision of each ADA itself. Each of the ADAs provides
a decision in a binary form or in a score form. The special characteristics of our
decision fusion problem make most of the available information fusion methods
irrelevant.
Next we provide some background on the way an ensemble of methods of the
same type can be used to improve the eciency and correctness of the decision
making as we suggest by the term fusion. The first use of such an ensemble was
in the classification domain. Building an ensemble of single classifiers to gain
an improved effectiveness has a rich tradition and sound theoretical background
[6-8]. The idea of using an ensemble can also be found in the clustering domain.
[6, 9]. Next, in the domain of anomaly detection or also known as outlier detection
algorithms, most of the efforts have been invested in the development of new
methods for outlier detection. Only very few preliminary studies have attempted
to use the notion of ensemble in order to compose a group of outlier detection
algorithms in order to create a meta outlier that will perform better [10-13].
Going back to ensemble in classification, the main insight from using ensemble
in the classification domain is that for an ensemble to outperform each of the
individual classifier requires that they are (i) accurate (i.e., at least better than
random); (ii) diverse (i.e., making different errors with new instances). These
conditions are necessary and sucient. When these conditions are satisfied the
majority voting rule of the ensemble also may be correct [6]. In conclusion,
the rule of thumb in constructing a meaningful ensemble is to choose members
that make uncorrelated errors. We have followed this principle in composing our
ensemble of outlier detection algorithms/ADAs.
Some information fusion methods are based on weighting techniques of varying
degrees of complexity [4]. For example, Berger [14] discusses a majority voting
technique based on a probabilistic representation of information. In our work we
also consider a weighting method that is basically based on expertise associated
with the multiple ADAs.
3 Fusion Structure
In this paper we assume that there is a set of N ADAs whereby each monitors
the same system, aiming to detect an outlier event or data. Each individual ADA
performs based on different methods. According to Chandola [15] three types of
anomaly detection algorithms exist, which were defined by him as follows: