[Paper Review] RCC-Dual-GAN: An Efficient Approach for Outlier Detection with Few Identified Anomalies

Zhe Li, Chunhua Sun+4 more|arXiv (Cornell University)|Mar 7, 2020

Anomaly Detection Techniques and Applications42 references4 citations

TL;DR

This paper proposes RCC-Dual-GAN, a semi-supervised outlier detection method that leverages few identified anomalies to detect both discrete and group outliers efficiently. By integrating robust continuous clustering (RCC) with a modified GAN architecture (M-GAN), it improves detection accuracy and stability over baseline GANs, especially in low-label regimes, outperforming both unsupervised and supervised baselines on real-world datasets like credit card fraud and network intrusion detection.

ABSTRACT

Outlier detection is an important task in data mining and many technologies have been explored in various applications. However, due to the default assumption that outliers are non-concentrated, unsupervised outlier detection may not correctly detect group anomalies with higher density levels. As for the supervised outlier detection, although high detection rates and optimal parameters can usually be achieved, obtaining sufficient and correct labels is a time-consuming task. To address these issues, we focus on semi-supervised outlier detection with few identified anomalies, in the hope of using limited labels to achieve high detection accuracy. First, we propose a novel detection model Dual-GAN, which can directly utilize the potential information in identified anomalies to detect discrete outliers and partially identified group anomalies simultaneously. And then, considering the instances with similar output values may not all be similar in a complex data structure, we replace the two MO-GAN components in Dual-GAN with the combination of RCC and M-GAN (RCC-Dual-GAN). In addition, to deal with the evaluation of Nash equilibrium and the selection of optimal model, two evaluation indicators are created and introduced into the two models to make the detection process more intelligent. Extensive experiments on both benchmark datasets and two practical tasks demonstrate that our proposed approaches (i.e., Dual-GAN and RCC-Dual-GAN) can significantly improve the accuracy of outlier detection even with only a few identified anomalies. Moreover, compared with the two MO-GAN components in Dual-GAN, the network structure combining RCC and M-GAN has greater stability in various situations.

Motivation & Objective

• To address the limitations of unsupervised outlier detection in detecting dense group anomalies.
• To overcome the high labeling cost of supervised methods by leveraging only a few identified anomalies.
• To develop a one-step semi-supervised method that directly utilizes potential information from identified anomalies without costly neighbor or similarity computations.
• To enhance model stability and detection accuracy in complex data structures through a novel RCC-M-GAN integration.
• To introduce intelligent evaluation metrics (NNR and AP) for Nash equilibrium and model selection during training.

Proposed method

• Proposes Dual-GAN, a one-step semi-supervised model that directly exploits identified anomalies to detect discrete and partially identified group anomalies.
• Replaces the two MO-GAN components in Dual-GAN with a combination of robust continuous clustering (RCC) and M-GAN to improve stability in complex data structures.
• Introduces two evaluation indicators—NNR (Nearest Neighbor Ratio) and AP (Average Precision)—to guide model selection and assess Nash equilibrium during training.
• Uses identified anomalies as reference points to construct a reference distribution, enabling more robust minority class augmentation.
• Employs a dual-discriminator generator framework where one discriminator focuses on normal data and the other on anomalies, improving detection sensitivity.
• Applies the method to real-world tasks such as credit card fraud detection and network intrusion detection using adjusted NSL-KDD and credit card datasets.

Experimental results

Research questions

• RQ1 Can a semi-supervised outlier detection model achieve high accuracy using only a small number of identified anomalies?
• RQ2 How can identified anomalies be effectively leveraged to detect both discrete and group anomalies without explicit similarity or neighbor computation?
• RQ3 Does integrating RCC with M-GAN improve model stability and detection performance compared to standard MO-GAN components?
• RQ4 Can NNR and AP serve as reliable indicators for model selection and Nash equilibrium evaluation in GAN-based outlier detection?
• RQ5 How does the proposed method perform on real-world applications like credit card fraud and network intrusion detection with limited labeled anomalies?

Key findings

• RCC-Dual-GAN achieved the highest detection accuracy on both the Credit-card and NSL-KDD datasets, outperforming both unsupervised and supervised baselines.
• On the Credit-card dataset, RCC-Dual-GAN and Dual-GAN significantly improved detection performance even with only 33 identified frauds (0.1% of total frauds).
• Supervised Sup-GAN performed worse than unsupervised k-NN and LOF, indicating that single GANs struggle to learn multiple anomaly generation mechanisms simultaneously.
• Sup-RCC-GAN yielded suboptimal results, suggesting that supervised fine-tuning with limited identified anomalies may not generalize well when anomaly types are diverse.
• The RCC-Dual-GAN model demonstrated greater stability across different data distributions and anomaly types compared to the original Dual-GAN with MO-GAN components.
• The use of NNR and AP indicators enabled more reliable model selection and improved convergence, enhancing the robustness of the detection process.