PSI - Issue 38

A. Cugniere et al. / Procedia Structural Integrity 38 (2022) 168–181 A. Cugniere, O. Tusch and A. Mösenbacher / Structural Integrity Procedia 00 (2021) 000 – 000

170

3

In a statistical sense though, there are different definitions of an anomaly (also called outliers) [2]. In figure 1 for example, where points from a dummy dataset with two features (x, y) are represented, there is a clear separation between the data, with two significant, well separated clusters (c1, c2) and a third sparse, smaller, isolated cluster (c3 + c4) that can be seen as a global anomaly. On the scale of the third cluster though, point c4 can be regarded as a local anomaly with regard to cluster c3, which can be seen in this case as normal data.

Fig. 1. Global vs. Local anomalies

Here is important to distinguish between what is considered to be “normal” data (data that reflect the correct functioning of a system and shouldn’t be considered anomalies) and anomalies (data that reflect a malfunctioning of a system). In some cases, the amount of anomalies can outnumber the amount of normal data. For this reason, depending on whether global or local anomalies are to be found, different anomaly detection algorithms will be preferred. The type of training data available is also a critical factor in choosing the right algorithm. There are three modes of anomaly detections (supervised, semi-supervised & unsupervised learning) depending on whether: • the training data contains both normal data and anomalies (supervised learning) • the training data contains only normal data (semi-supervised) • no training data is available at all (unsupervised). Figure 2 sums up the different algorithms available for each mode: