ALARM: human-in-the-loop anomaly detection

Anomalies are often indicators of malfunction or inefficiency in various systems such as manufacturing, healthcare, finance and surveillance to name a few. While the literature is abundant in effective detection algorithms due to this practical relevance, autonomous anomaly detection is rarely used in real-world scenarios. Especially in high-stakes applications, a human-in-the-loop is often involved in processes beyond detection such as verification and troubleshooting. In this work, we introduce ALARM (for analyst-in-the-loop anomaly reasoning and management); an end-to-end framework that supports the anomaly mining cycle comprehensively, from detection to action. Besides unsupervised detection of emerging anomalies, it offers anomaly explanations and an interactive GUI for human-in-the-loop processes--visual exploration, sense-making and ultimately action-taking via designing new detection rules that help close "the loop'' as the new rules complement rule-based supervised detection, typical of many deployed systems in practice. We demonstrate method's efficacy through a series of case studies with fraud analysts from the financial industry.