A New Prior for Bayesian Anomaly Detection

Summary

Objectives: Bayesian anomaly detection computes posterior probabilities of anomalous events by combining prior beliefs and evidence from data. However, the specification of prior probabilities can be challenging. This paper describes a Bayesian prior in the context of disease outbreak detection. The goal is to provide a meaningful, easy-to-use prior that yields a posterior probability of an outbreak that performs at least as well as a standard frequentist approach. If this goal is achieved, the resulting posterior could be usefully incorporated into a decision analysis about how to act in light of a possible disease outbreak.

Methods: This paper describes a Bayesian method for anomaly detection that combines learning from data with a semi-informative prior probability over patterns of anomalous events. A univariate version of the algorithm is presented here for ease of illustration of the essential ideas. The paper describes the algorithm in the context of disease-outbreak detection, but it is general and can be used in other anomaly detection applications. For this application, the semi-informative prior specifies that an increased count over baseline is expected for the variable being monitored, such as the number of respiratory chief complaints per day at a given emergency department. The semi-informative prior is derived based on the baseline prior, which is estimated from using historical data.

Results: The evaluation reported here used semi-synthetic data to evaluate the detection performance of the proposed Bayesian method and a control chart method, which is a standard frequentist algorithm that is closest to the Bayesian method in terms of the type of data it uses. The disease-outbreak detection performance of the Bayesian method was statistically significantly better than that of the control chart method when proper baseline periods were used to estimate the baseline behavior to avoid seasonal effects. When using longer baseline periods, the Bayesian method performed as well as the control chart method. The time complexity of the Bayesian algorithm is linear in the number of the observed events being monitored, due to a novel, closed-form derivation that is introduced in the paper.

Conclusions: This paper introduces a novel prior probability for Bayesian outbreak detection that is expressive, easy-to-apply, computationally efficient, and performs as well or better than a standard frequentist method.

Keywords

Anomaly detection - biosurveillance - Bayesian methods - prior probability distributions - efficient inference

• References

• 1 Wong W-K. Data mining for early disease outbreak detection. Doctoral Dissertation. Carnegie Mellon University; Pittsburgh: 2004
• 2 Hauskrecht M, Valko M, Kveton B, Visweswaran S, Cooper GF. editors. Evidence-based anomaly detection in clinical domains. In: Proceedings of the Fall Symposium of the American Medical Informatics Association; 2007 pp 319-332.
• 3 Fawcett T, Provost F. Adaptive fraud detection. Data Mining and Knowledge Discovery 1997; 1 (03) 291-316.
• 4 Denning D. An intrusion-detection model. IEEE Transactions on Software Engineering. 1987; 13 (02) 222-232.
• 5 Shewhart WA. Economic control of quality of manufactured product. New York: D. Van Nostrand Company; 1931 (A 1981 reprint is available from the American Society for Quality Control.).
• 6 Page ES. Continuous inspection schemes. Biometrika 1954; 41: 100-115.
• 7 Roberts SW. Control chart tests based on geometric moving averages. Technometrics 1959; 1: 239-250.
• 8 Gelman A, Carlin JB, Stern HS, Rubin DB. Bayesian data analysis. London: Chapman & Hall; 1995
• 9 Hardy GF. Insurance record. 1889 8. (Reprinted in Transactions of Actuaries, 1920.).
• 10 Whitworth WA. Exercise in choice and chance. 1897 (Reprinted by Hafner, New York, 1965.).
• 11 Tuyl F, Gerlach R, Mengersen K. Posterior predictive arguments in favor of the Bayes-Laplace prior as the consensus prior for binomial and multinomial parameters. Bayesian Analysis 2009; 4 (01) 151-158.
• 12 Altun Y, Smola A. Unifying divergence minimization and statistical inference via convex duality. In: Proceedings of the 19th Annual Conference on Learning Theory. 2006. pp 139-153.
• 13 Barndorff-Nielsen O. Information and Exponential families in statistical theory. New York: Wiley; 1978
• 14 Song L, Zhang X, Smola A, Gretton A, Scholkopf B. Tailoring density estimation via reproducing kernel moment matching. In: Proceedings of the 25th International Conference on Machine Learning 2008; 307: 992-999.
• 15 Gelman A, Carlin JB, Stern HS, Rubin DB. Appendix A: Standard probability distributions. Bayesian data analysis. London: Chapman & Hall; 1995. p 481.
• 16 Clayton DG, Kaldor J. Empirical Bayes estimates of age-standardized relative risks for use in disease mapping. Biometrics 1987; 43: 671-681.
• 17 Mollie A. Bayesian and empirical Bayes approaches to disease mapping. In: Lawson ABea, editor. Disease Mapping and Risk Assessment for Public Health. Chichester: Wiley; 1999
• 18 Neill DB, Moore AW, Cooper GF. A Bayesian spatial scan statistic. Advances in Neural Information Processing Systems 2006; 18: 1003-1010.
• 19 Burkom HS, Elbert Y, Feldman A, Lin J. Role of data aggregation in biosurveillance detection strategies with applications from ESSENCE. MMWR Morbility and Mortality Weekly Report 2004; Sep 24 (53 Suppl): 67-73.
• 20 Hogan WR, Cooper GF, Wallstrom GL, Wagner MM, Depinay J-M. The Bayesian aerosol release detector: An algorithm for detecting and characterizing outbreaks caused by an atmospheric release of Bacillus anthracis. Statistics in Medicine 2007; 26: 5225-5252.
• 21 Weisstein EW. “Incomplete Beta Function.” From MathWorld – A Wolfram Web Resource. 2003 Available from: http://mathworld.wolfram.com IncompleteBetaFunction.html.
• 22 Casella G, Berger LR. Statistical Inference (second edition). Australia; Pacific Grove, CA: Thomson Learning; 2002
• 23 Hogan WR, Cooper GF, Wagner MM. A Bayesian anthrax aerosol release detector. RODS Technical Report 2004
• 24 Fawcett T, Provost F. Activity monitoring: Noticing interesting changes in behavior. In: Proceedings of the Fifth International Conference on Knowledge Discovery and Data Mining 1999. pp 53-62.
• 25 Kaufmann A, Meltzer M, Schmid G. The economic impact of a bioterrorist attack: Are prevention and postattack intervention programs justifiable?. Emerging Infectious Diseases 1997; 3 (02) 83-94.
• 26 Wagner MM, Tsui FC, Espino JU, Dato VM, Sittig DF, Caruana RA. et al. The emerging science of very early detection of disease outbreaks. Journal of Public Health Management Practice 2001; 7 (06) 51-59.
• 27 Edwards W, Miles RF, von Winterfeldt D. editors. Advances in Decision Analysis. Cambridge University Press; 2007
• 28 Jiang X. A Bayesian network model for spatio- temporal event surveillance. Doctoral Dissertation. University of Pittsburgh; Pittsburgh: 2008
• 29 Hutwagner LC, Thompson W, Seeman GM. The bioterrorism preparedness and response early aberration reporting system (EARS). Journal of Urban Health 2003; 80 2, Supplement 1 i89-i96.
• 30 Serfling RE. Methods for current statistical analysis of excess pneumonia-influenza deaths. Public Health Reports 1963; 78: 494-506.
• 31 Reis BY, Mandl KD. Time series modeling for syndromic surveillance. BMC Medical Informatics and Decision Making 2003 3 (2).
• 32 Goldenberg A, Shmueli G, Caruana RA. Early statistical detection of anthrax outbreaks by tracking over-the-counter medication sales. In: Proceedings of National Academy of Sciences 2002; 99 (08) 5237-5240.
• 33 Zhang J, Tsui FC, Wagner MM, Hogan WR. Detection of outbreaks from time series data using wave-let transform. AMIA Annual Symposium Proceedings. 2003 pp 748-752.
• 34 West M, Harrison J. Bayesian forecasting and dynamic models. New York: Springer-Verlag; 1989
• 35 LeStrat Y, Carrat F. Monitoring epidemiologic surveillance data using hidden Markov models. Statistics in Medicine 1999; 18: 3463-3478.
• 36 Nobre FF, Monteiro ABS, Telles PR, Williamson GD. Dynamic linear models and SARIMA: a comparison of their forecasting performance in epidemiology. Statistics in Medicine 2001; 20: 3051-3069.
• 37 Rath T, Carreras M, Sebastiani P. Automated detection of influenza epidemics with hidden Markov models. Proceedings of the Fifth International Symposium on Intelligent Data Analysis 2003; 2810: 521-532.
• 38 Weisstein EW. “Binomial Theorem.” From Math-World – A Wolfram Web Resource. 2006 Available from: http://mathworld.wolfram.com/Binomial Theorem.html.