0

I'm reading lots of statistical anomaly detection articles nowadays. Some of them use frequency of some feature for detecting anomalies on the new trace.

But, something gets my attention in some articles. Authors use "probability of occurrence" usage than just say frequency. Are they doing this for implying some property of that data set or data? Or frequency is another thing and I don't know the difference?

From [1]:

Using the observations in Section III.B, we develop a technique, called Kernel States Modeling (KSM), to automatically detect anomalies using the probability of occurrences of states in traces.

[1] Murtaza, Syed & Khreich, Wael & Hamou-Lhadj, Abdelwahab & Couture, Mario. (2013). A host-based anomaly detection approach by representing system calls as states of kernel modules. 2013 IEEE 24th International Symposium on Software Reliability Engineering, ISSRE 2013. 431-440. 10.1109/ISSRE.2013.6698896.

  • 1
    Not sure if I understand your confusion. If you measure frequency of an event over a sample and divide it by the number of samples you get the empirical probability of the event: https://en.wikipedia.org/wiki/Empirical_probability – Bar Oct 24 '18 at 13:02
  • You understood it right. Thanks. I must confuse because mostly I use the physical meaning of frequency. –  Oct 24 '18 at 13:18
  • 1
    A useful question to ask in this regard is "have you ever directly observed a probability?" The answer ought to be no, because a probability is a model construct. But "have you ever directly observed a frequency" ought to have a different answer. – whuber Oct 24 '18 at 19:05

1 Answers1

1

I am not familiar with the literature on statistical anomaly detection, so take this as speculation. One possibility is that the authors mean pretty much the same thing whether they use probability or frequency of occurrence (see comment by @Bar). See the answer to this question which covers a very similar topic and reminds us of a few caveats.

On the other hand, they could also be using the term probability in a Bayesian sense. There it describes the degree of confidence/belief in a hypothesis (i.e. feature is an anomaly). Here the probability can for example be estimated using the technique of e.g. Maximum a Posteriori Estimation. The number of features in a sample could be used as the basis for this estimate.

Right now I am reading Data Analysis: A Bayesian Tutorial by Sivia and Skilling which is clearing up a lot of the confusion about probability theory I have myself.

geo
  • 362
  • 3
  • 9