An analyst applies an anomaly detection algorithm to a data set and finds a set of anomalies. Being curious, the analyst then applies the anomaly detection algorithm to the set of anomalies.

Question

(a) Discuss the behavior of each of the anomaly detection techniques de-
scribed in this chapter. (If possible, try this for real data sets and
algorithms.)
(b) What do you think the behavior of an anomaly detection algorithm
should be when applied to a set of anomalous objects?

Answer 1

In some cases, such as the statistically-based anomaly detection techniques,

it would not be valid to apply the technique a second time, since the assump-
tions would no longer hold. This could also be true for other model-based

approaches. The behavior of the proximity- and density-based approaches
would depend on the particular techniques. Interestingly, the approaches
that use absolute thresholds of distance or density would likely classify the
set of anomalies as anomalies, at least if the original parameters were kept.
The relative approaches would likely classify most of the anomalies as normal
and some as anomalies.
Whether an object is anomalous depends on the the entire group of objects,
and thus, it is probably unreasonable to expect that an anomaly detection
technique will identify a set of anomalies as such in the absence of the original
data set.