arXiv:2509.09030cs.LG2025-09被引 3

让异常检测学会看上下文,不同场景下正常行为不同。

Contextual Learning for Anomaly Detection in Tabular Data

  • 用条件分布建模不同上下文下的正常行为,而非全局统一标准。
  • 在8个数据集上优于传统方法,即使上下文不明显也有效。
  • 适合金融、安全等存在多样行为的表格数据异常检测。

异常检测在网络安全和金融等领域至关重要,尤其面对大规模表格数据时。然而,无监督异常检测(无标签异常)仍具挑战性,因传统深度学习方法建模单一全局分布,假设所有样本行为一致。现实中数据常包含异质上下文(如不同用户、账户或设备),全局罕见事件在特定条件下可能是正常的。本文提出一种上下文学习框架,通过学习条件数据分布 $P( extbf{Y} ackslashmid extbf{C})$ 而非全局联合分布 $P( extbf{X})$,显式建模正常行为随上下文的变化。该框架包含:(1) 上下文条件学习的概率形式化;(2) 基于早期验证损失自动选择有效上下文特征的合理两层优化策略;(3) 通过方差分解与判别学习原理提供理论支持。我们使用新型条件Wasserstein自编码器实现该框架,模型简单但高效。在8个基准数据集上的大量实验表明,上下文学习始终优于全局方法——即使最优上下文不直观——为异质表格数据的异常检测建立了新范式。

原文摘要 · Abstract (English)

Anomaly detection is critical in domains such as cybersecurity and finance, especially when working with large-scale tabular data. Yet, unsupervised anomaly detection-where no labeled anomalies are available-remains challenging because traditional deep learning methods model a single global distribution, assuming all samples follow the same behavior. In contrast, real-world data often contain heterogeneous contexts (e.g., different users, accounts, or devices), where globally rare events may be normal within specific conditions. We introduce a contextual learning framework that explicitly models how normal behavior varies across contexts by learning conditional data distributions $P(\mathbf{Y} \mid \mathbf{C})$ rather than a global joint distribution $P(\mathbf{X})$. The framework encompasses (1) a probabilistic formulation for context-conditioned learning, (2) a principled bilevel optimization strategy for automatically selecting informative context features using early validation loss, and (3) theoretical grounding through variance decomposition and discriminative learning principles. We instantiate this framework using a novel conditional Wasserstein autoencoder as a simple yet effective model for tabular anomaly detection. Extensive experiments across eight benchmark datasets demonstrate that contextual learning consistently outperforms global approaches-even when the optimal context is not intuitively obvious-establishing a new foundation for anomaly detection in heterogeneous tabular data.

异常检测表格数据上下文学习

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。