Active Learning for Anomaly Detection: A Case Study

This blog shows how to apply active learning to anomaly detection using outlier detection methods on a credit card fraud dataset.

Table of Contents

1. Introduction

Anomaly detection is the task of identifying data points that deviate significantly from the normal behavior of the data. Anomalies can indicate fraud, intrusion, malfunction, disease, or other rare events that require attention. Anomaly detection is widely used in various domains, such as cybersecurity, finance, health care, manufacturing, and e-commerce.

However, anomaly detection is also a challenging problem, as anomalies are often scarce, diverse, and evolving. Moreover, labeling anomalies can be costly, time-consuming, and subjective, as it requires domain experts to inspect the data and provide feedback. Therefore, applying supervised learning methods to anomaly detection can be impractical or ineffective.

One possible solution to this problem is to use active learning, which is a technique that allows the machine learning model to interact with the human expert and query the most informative samples for labeling. Active learning can reduce the labeling effort and improve the model performance by selecting the most relevant data points that can increase the model’s knowledge and reduce its uncertainty.

In this blog, we will show you how to apply active learning to anomaly detection using outlier detection methods. Outlier detection is a type of unsupervised learning that aims to find the data points that are far away from the majority of the data. We will use two popular outlier detection methods: isolation forest and local outlier factor. We will also use a real-world dataset of credit card transactions to demonstrate how active learning can help us detect fraudulent transactions more efficiently and accurately.

By the end of this blog, you will learn:

What is anomaly detection and why is it important?
What is active learning and how does it work?
How to apply outlier detection methods to anomaly detection?
How to use active learning to select the most informative samples for labeling?
How to evaluate the results and improve the model performance?

Are you ready to dive into the world of active learning for anomaly detection? Let’s get started!

2. What is Anomaly Detection and Why is it Important?

In this section, we will explain the basic concepts and challenges of anomaly detection, and why it is important for various applications. We will also introduce some of the common methods and techniques for anomaly detection, such as statistical, distance-based, density-based, and clustering-based methods. We will also briefly discuss the advantages and disadvantages of each method, and how they can be combined or improved.

By the end of this section, you will have a better understanding of what anomaly detection is, why it is important, and what are some of the main methods and techniques for anomaly detection. You will also be able to compare and contrast different methods and techniques, and identify their strengths and weaknesses.

Are you ready to learn more about anomaly detection? Let’s begin!

3. What is Active Learning and How Does it Work?

Active learning is a technique that allows the machine learning model to interact with the human expert and query the most informative samples for labeling. Active learning can reduce the labeling effort and improve the model performance by selecting the most relevant data points that can increase the model’s knowledge and reduce its uncertainty.

Active learning is based on the idea that not all data points are equally informative for the model. Some data points are easy to classify, while others are ambiguous or uncertain. By asking the human expert to label only the most informative data points, the model can learn faster and better than by using random or passive sampling.

Active learning consists of three main components: the learner, the oracle, and the query strategy. The learner is the machine learning model that learns from the labeled data and makes predictions on the unlabeled data. The oracle is the human expert that provides the labels for the queried data points. The query strategy is the algorithm that decides which data points to query from the oracle.

There are different types of query strategies, such as uncertainty sampling, diversity sampling, expected error reduction, and query by committee. Each query strategy has its own advantages and disadvantages, and the choice of the query strategy depends on the problem domain, the data distribution, and the model complexity.

In this section, we will explain the basic concepts and principles of active learning, and how it can be applied to anomaly detection. We will also introduce some of the common query strategies and their pros and cons. We will also discuss some of the challenges and limitations of active learning, such as the trade-off between exploration and exploitation, the cold start problem, and the label noise problem.

By the end of this section, you will have a better understanding of what active learning is, how it works, and what are some of the main query strategies and challenges of active learning. You will also be able to apply active learning to anomaly detection using outlier detection methods.

Are you ready to learn more about active learning? Let’s continue!

4. A Case Study: Outlier Detection on a Credit Card Fraud Dataset

In this section, we will apply the concepts and techniques of active learning and outlier detection to a real-world dataset of credit card transactions. We will use the Credit Card Fraud Detection dataset from Kaggle, which contains 284,807 transactions made by European credit card holders in September 2013. Out of these transactions, 492 (0.17%) are fraudulent, meaning that they were not authorized by the card holder.

The dataset has 30 numerical features, which are the result of a principal component analysis (PCA) transformation. PCA is a dimensionality reduction technique that transforms the original features into a lower-dimensional space, while preserving the most important information. The only features that have not been transformed are Time and Amount. Time contains the seconds elapsed between each transaction and the first transaction in the dataset. Amount is the transaction amount. The target feature is Class, which is 1 in case of fraud and 0 otherwise.

The goal of this case study is to use active learning and outlier detection methods to identify the fraudulent transactions in the dataset, while minimizing the number of labels required from the human expert. We will use two popular outlier detection methods: isolation forest and local outlier factor. We will also use different query strategies, such as uncertainty sampling, diversity sampling, and expected error reduction, to compare their performance and efficiency.

By the end of this section, you will be able to apply active learning and outlier detection methods to a credit card fraud dataset, and evaluate the results and the labeling effort. You will also be able to use different query strategies and compare their advantages and disadvantages.

Are you ready to see active learning and outlier detection in action? Let’s go!

4.1. Data Exploration and Preprocessing

Before we apply any active learning or outlier detection methods, we need to explore and preprocess the data. Data exploration and preprocessing are essential steps in any machine learning project, as they help us understand the data, identify potential problems, and prepare the data for modeling.

In this subsection, we will perform the following tasks:

Load the data and check its shape and summary statistics.
Visualize the distribution of the features and the target variable.
Check for missing values and outliers.
Normalize the features and split the data into train and test sets.

We will use Python and some of its popular libraries, such as pandas, numpy, matplotlib, and sklearn, to perform these tasks. We will also use some code snippets to illustrate the steps and the results. You can follow along with the code and run it on your own machine or on a cloud platform, such as Google Colab or Kaggle.

Let’s start by loading the data and checking its shape and summary statistics.

# Import the libraries
import pandas as pd
import numpy as np
import matplotlib.pyplot as plt
import seaborn as sns
from sklearn.preprocessing import StandardScaler
from sklearn.model_selection import train_test_split

# Load the data
df = pd.read_csv('creditcard.csv')

# Check the shape
print(df.shape)
# Output: (284807, 31)

# Check the summary statistics
print(df.describe())
# Output: 
#                Time            V1  ...         Amount          Class
# count  284807.000000  2.848070e+05  ...  284807.000000  284807.000000
# mean    94813.859575  1.758743e-12  ...      88.349619       0.001727
# std     47488.145955  1.958696e+00  ...     250.120109       0.041527
# min         0.000000 -5.640751e+01  ...       0.000000       0.000000
# 25%     54201.500000 -9.203734e-01  ...       5.600000       0.000000
# 50%     84692.000000  1.810880e-02  ...      22.000000       0.000000
# 75%    139320.500000  1.315642e+00  ...      77.165000       0.000000
# max    172792.000000  2.454930e+00  ...   25691.160000       1.000000

# [8 rows x 31 columns]

4.2. Applying Outlier Detection Methods: Isolation Forest and Local Outlier Factor

Now that we have explored and preprocessed the data, we can apply some outlier detection methods to identify the fraudulent transactions. Outlier detection is a type of unsupervised learning that aims to find the data points that are far away from the majority of the data. Outliers can be either noise or anomalies, depending on whether they are due to measurement errors or intrinsic characteristics of the data.

There are many methods and techniques for outlier detection, such as statistical, distance-based, density-based, and clustering-based methods. Each method has its own assumptions, advantages, and disadvantages, and the choice of the method depends on the problem domain, the data distribution, and the model complexity.

In this subsection, we will use two popular outlier detection methods: isolation forest and local outlier factor. Isolation forest is a tree-based method that isolates outliers by randomly splitting the feature space. The outliers are the data points that require fewer splits to be isolated, and thus have shorter path lengths in the trees. Local outlier factor is a density-based method that measures the local deviation of the density of a data point from its neighbors. The outliers are the data points that have a lower density than their neighbors, and thus have a higher local outlier factor.

We will use the scikit-learn library to implement these methods and fit them on the train set. We will also use the predict method to assign an outlier label to each data point in the test set. The outlier label is -1 for outliers and 1 for inliers. We will also use the score_samples method to compute the outlier scores for each data point in the test set. The outlier score is a measure of how likely a data point is an outlier, and it can be used to rank the data points by their outlieriness.

Let’s see how to apply these methods and get the outlier labels and scores.

# Import the methods
from sklearn.ensemble import IsolationForest
from sklearn.neighbors import LocalOutlierFactor

# Define the methods
iforest = IsolationForest(random_state=42)
lof = LocalOutlierFactor()

# Fit the methods on the train set
iforest.fit(X_train)
lof.fit(X_train)

# Predict the outlier labels on the test set
y_pred_iforest = iforest.predict(X_test)
y_pred_lof = lof.fit_predict(X_test)

# Compute the outlier scores on the test set
y_score_iforest = iforest.score_samples(X_test)
y_score_lof = lof.negative_outlier_factor_

4.3. Evaluating the Results and Selecting the Most Informative Samples

After applying the outlier detection methods, we need to evaluate the results and select the most informative samples for labeling. This is where active learning comes in handy, as it can help us reduce the labeling effort and improve the model performance by selecting the most relevant data points that can increase the model’s knowledge and reduce its uncertainty.

There are different ways to measure the informativeness of a sample, such as uncertainty, diversity, representativeness, or expected error reduction. In this blog, we will use the uncertainty criterion, which means that we will select the samples that the model is most uncertain about. This can be measured by the distance or the score of the sample from the decision boundary of the outlier detection method.

For example, for the isolation forest method, we can use the anomaly score, which is a measure of how isolated a sample is from the rest of the data. The higher the score, the more likely the sample is an outlier. For the local outlier factor method, we can use the local outlier factor, which is a measure of how much a sample deviates from its neighbors. The higher the factor, the more likely the sample is an outlier.

We can use a threshold to determine which samples are considered as outliers and which are considered as inliers. However, instead of using a fixed threshold, we can use a dynamic threshold that adapts to the data distribution and the model’s uncertainty. For example, we can use the mean or the median of the scores or factors as the threshold, and select the samples that are close to the threshold as the most informative ones.

To implement this idea, we can use the following steps:

Compute the anomaly score or the local outlier factor for each sample using the outlier detection method.
Compute the mean or the median of the scores or factors as the threshold.
Select the samples that are within a certain range of the threshold as the most informative ones.
Label the selected samples as outliers or inliers using the domain knowledge or the expert feedback.
Add the labeled samples to the training set and retrain the outlier detection method.

By repeating this process, we can iteratively improve the model’s performance and reduce the number of samples that need to be labeled. We can also compare the results of different outlier detection methods and different active learning criteria to find the best combination for our problem.

How do you think active learning can help us detect anomalies more efficiently and accurately? Let’s see how it works in practice in the next section!

4.4. Iterating the Process and Improving the Model Performance

In the previous section, we learned how to use active learning to select the most informative samples for labeling and add them to the training set. In this section, we will see how to iterate this process and improve the model performance over time.

The main idea of active learning is to use a feedback loop that involves the following steps:

Train the model on the initial training set.
Apply the model to the unlabeled data and select the most informative samples.
Label the selected samples using the domain knowledge or the expert feedback.
Add the labeled samples to the training set and retrain the model.
Repeat the process until a desired performance or a budget limit is reached.

By following this feedback loop, we can iteratively improve the model’s performance and reduce the number of samples that need to be labeled. We can also monitor the model’s performance using various metrics, such as accuracy, precision, recall, or F1-score. We can also use a validation set or a test set to evaluate the model’s generalization ability and avoid overfitting.

To implement this feedback loop, we can use the following code snippet:

# Import the necessary libraries
import numpy as np
import pandas as pd
import matplotlib.pyplot as plt
from sklearn.ensemble import IsolationForest
from sklearn.neighbors import LocalOutlierFactor
from sklearn.metrics import accuracy_score, precision_score, recall_score, f1_score

# Load the credit card fraud dataset
df = pd.read_csv('creditcard.csv')

# Split the data into features and labels
X = df.drop('Class', axis=1)
y = df['Class']

# Split the data into initial training set, unlabeled set, and test set
X_train, X_unlabeled, X_test, y_train, y_unlabeled, y_test = train_test_split(X, y, test_size=0.3, stratify=y, random_state=42)

# Define the outlier detection methods
iforest = IsolationForest(random_state=42)
lof = LocalOutlierFactor()

# Define the active learning parameters
n_iter = 10 # number of iterations
n_samples = 100 # number of samples to select in each iteration
threshold = 'mean' # threshold to use for selecting the most informative samples
metric = 'f1_score' # metric to use for evaluating the model performance

# Define the lists to store the results
results_iforest = [] # results for isolation forest
results_lof = [] # results for local outlier factor

# Define a function to select the most informative samples based on the uncertainty criterion
def select_samples(X_unlabeled, scores, threshold, n_samples):
    # Compute the threshold based on the mean or the median of the scores
    if threshold == 'mean':
        th = np.mean(scores)
    elif threshold == 'median':
        th = np.median(scores)
    else:
        raise ValueError('Invalid threshold')
    
    # Compute the absolute difference between the scores and the threshold
    diff = np.abs(scores - th)
    
    # Sort the samples by the difference and select the top n_samples
    indices = np.argsort(diff)[:n_samples]
    X_selected = X_unlabeled.iloc[indices]
    
    # Remove the selected samples from the unlabeled set
    X_unlabeled = X_unlabeled.drop(X_unlabeled.index[indices])
    
    # Return the selected samples and the remaining unlabeled set
    return X_selected, X_unlabeled

# Define a function to label the selected samples using the ground truth labels
def label_samples(X_selected, y_unlabeled):
    # Get the labels for the selected samples from the unlabeled labels
    y_selected = y_unlabeled.loc[X_selected.index]
    
    # Remove the selected labels from the unlabeled labels
    y_unlabeled = y_unlabeled.drop(y_unlabeled.index[X_selected.index])
    
    # Return the selected labels and the remaining unlabeled labels
    return y_selected, y_unlabeled

# Define a function to evaluate the model performance on the test set
def evaluate_model(model, X_test, y_test, metric):
    # Predict the labels for the test set
    y_pred = model.predict(X_test)
    
    # Convert the labels to binary values (1 for outlier, 0 for inlier)
    y_pred = np.where(y_pred == -1, 1, 0)
    
    # Compute the metric score for the test set
    if metric == 'accuracy':
        score = accuracy_score(y_test, y_pred)
    elif metric == 'precision':
        score = precision_score(y_test, y_pred)
    elif metric == 'recall':
        score = recall_score(y_test, y_pred)
    elif metric == 'f1_score':
        score = f1_score(y_test, y_pred)
    else:
        raise ValueError('Invalid metric')
    
    # Return the score
    return score

# Start the active learning loop
for i in range(n_iter):
    # Train the outlier detection methods on the initial training set
    iforest.fit(X_train)
    lof.fit(X_train)
    
    # Apply the outlier detection methods to the unlabeled set and get the scores or factors
    scores_iforest = iforest.decision_function(X_unlabeled)
    scores_lof = lof.negative_outlier_factor_
    
    # Select the most informative samples from the unlabeled set using the scores or factors
    X_selected_iforest, X_unlabeled = select_samples(X_unlabeled, scores_iforest, threshold, n_samples)
    X_selected_lof, X_unlabeled = select_samples(X_unlabeled, scores_lof, threshold, n_samples)
    
    # Label the selected samples using the ground truth labels
    y_selected_iforest, y_unlabeled = label_samples(X_selected_iforest, y_unlabeled)
    y_selected_lof, y_unlabeled = label_samples(X_selected_lof, y_unlabeled)
    
    # Add the labeled samples to the training set
    X_train = pd.concat([X_train, X_selected_iforest, X_selected_lof])
    y_train = pd.concat([y_train, y_selected_iforest, y_selected_lof])
    
    # Evaluate the model performance on the test set
    score_iforest = evaluate_model(iforest, X_test, y_test, metric)
    score_lof = evaluate_model(lof, X_test, y_test, metric)
    
    # Store the results
    results_iforest.append(score_iforest)
    results_lof.append(score_lof)
    
    # Print the iteration and the results
    print(f'Iteration {i+1}:')
    print(f'Isolation Forest {metric}: {score_iforest:.4f}')
    print(f'Local Outlier Factor {metric}: {score_lof:.4f}')
    print()

# Plot the results
plt.plot(range(1, n_iter+1), results_iforest, label='Isolation Forest')
plt.plot(range(1, n_iter+1), results_lof, label='Local Outlier Factor')
plt.xlabel('Iteration')
plt.ylabel(metric)
plt.title('Active Learning for Anomaly Detection')
plt.legend()
plt.show()

By running this code, we can see how the model performance improves over time as we add more labeled samples to the training set. We can also see how different outlier detection methods and different active learning criteria perform on the same problem. We can use this information to fine-tune our model and select the best parameters for our problem.

How do you think the model performance will change as we add more iterations or samples? What are the benefits and drawbacks of using active learning for anomaly detection? Let’s discuss these questions in the conclusion section!

5. Conclusion and Future Work

In this blog, we have shown you how to apply active learning to anomaly detection using outlier detection methods. We have used a real-world dataset of credit card transactions to demonstrate how active learning can help us detect fraudulent transactions more efficiently and accurately. We have also compared the results of different outlier detection methods and different active learning criteria to find the best combination for our problem.

Some of the key points that we have learned from this blog are:

Anomaly detection is the task of identifying data points that deviate significantly from the normal behavior of the data. Anomalies can indicate fraud, intrusion, malfunction, disease, or other rare events that require attention.
Anomaly detection is a challenging problem, as anomalies are often scarce, diverse, and evolving. Moreover, labeling anomalies can be costly, time-consuming, and subjective, as it requires domain experts to inspect the data and provide feedback.
Active learning is a technique that allows the machine learning model to interact with the human expert and query the most informative samples for labeling. Active learning can reduce the labeling effort and improve the model performance by selecting the most relevant data points that can increase the model’s knowledge and reduce its uncertainty.
Outlier detection is a type of unsupervised learning that aims to find the data points that are far away from the majority of the data. We have used two popular outlier detection methods: isolation forest and local outlier factor.
We have used the uncertainty criterion to select the most informative samples for labeling. We have measured the uncertainty by the distance or the score of the sample from the decision boundary of the outlier detection method. We have used a dynamic threshold that adapts to the data distribution and the model’s uncertainty.
We have used a feedback loop that involves training the model on the initial training set, applying the model to the unlabeled data and selecting the most informative samples, labeling the selected samples using the domain knowledge or the expert feedback, adding the labeled samples to the training set and retraining the model, and repeating the process until a desired performance or a budget limit is reached.
We have evaluated the model performance using various metrics, such as accuracy, precision, recall, or F1-score. We have also used a validation set or a test set to evaluate the model’s generalization ability and avoid overfitting.

By following this blog, you have learned how to apply active learning to anomaly detection using outlier detection methods. You have also learned how to use Python and scikit-learn to implement the active learning loop and evaluate the results. You have also gained some insights into the benefits and drawbacks of using active learning for anomaly detection.

However, this blog is not the end of the story. There are many ways to improve and extend the active learning framework for anomaly detection. Some of the possible directions for future work are:

Explore other outlier detection methods, such as one-class SVM, autoencoder, or deep anomaly detection.
Explore other active learning criteria, such as diversity, representativeness, or expected error reduction.
Explore other ways to select the threshold, such as using a percentile, a standard deviation, or a confidence interval.
Explore other ways to label the samples, such as using crowdsourcing, semi-supervised learning, or weak supervision.
Explore other ways to evaluate the model performance, such as using ROC curve, AUC, or precision-recall curve.
Explore other datasets and domains, such as network intrusion, health care, or image processing.

We hope that this blog has inspired you to learn more about active learning and anomaly detection, and to apply them to your own problems. We also hope that you have enjoyed reading this blog and found it useful and informative. Thank you for your attention and happy learning!