用因果推断思想检测异常，提升准确率和可解释性。
Real-Time Anomaly Detection with Synthetic Anomaly Monitoring (SAM)
- 将每个特征视为控制单元，构建因果框架识别异常
- 在5个数据集上优于Isolation Forest、LOF等经典模型
- 适合需要实时、可解释异常检测的金融与安全场景
异常检测对于金融、网络安全、网络监控等领域中识别罕见且关键事件至关重要。本文提出合成异常监控（SAM），首次将因果推断中的合成控制方法引入异常检测，通过将每个特征视为控制单元建模正常行为，将异常定义为该因果框架下的偏离。我们在五个不同数据集（包括信用卡欺诈、HTTP Dataset CSIC 2010、KDD Cup 1999等）上对比了SAM与多个基准模型（孤立森林、局部离群因子、k近邻、一类支持向量机）的表现。结果表明，SAM在所有数据集上均展现出稳健的性能，凸显其在动态复杂环境中实现实时异常检测的强大潜力。
原文摘要 · Abstract (English)
Anomaly detection is essential for identifying rare and significant events across diverse domains such as finance, cybersecurity, and network monitoring. This paper presents Synthetic Anomaly Monitoring (SAM), an innovative approach that applies synthetic control methods from causal inference to improve both the accuracy and interpretability of anomaly detection processes. By modeling normal behavior through the treatment of each feature as a control unit, SAM identifies anomalies as deviations within this causal framework. We conducted extensive experiments comparing SAM with established benchmark models, including Isolation Forest, Local Outlier Factor (LOF), k-Nearest Neighbors (kNN), and One-Class Support Vector Machine (SVM), across five diverse datasets, including Credit Card Fraud, HTTP Dataset CSIC 2010, and KDD Cup 1999, among others. Our results demonstrate that SAM consistently delivers robust performance, highlighting its potential as a powerful tool for real-time anomaly detection in dynamic and complex environments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。