Reliable Anomaly Detection with Explanation and Feedback

Anomalies, though rare, can lead to significant economic losses and critical system failures. While detection is essential, much of the existing research focuses solely on identifying anomalies—often overlooking performance guarantees, interpretability, and long-term adaptability. This thesis addresses these gaps by introducing three core building blocks: detection, explanation, and feedback. First, we present PAC-Wrap, a detection module that augments existing anomaly detectors with two-sided statistical guarantees on both the false positive rate (FPR) and the false negative rate (FNR). Second, we introduce AR-Pro, an explanation module that generates counterfactual explanations and suggests potential rectifications in a domain-agnostic manner. Third, we develop a feedback module that incorporates human input to incrementally update anomaly detection models, helping maintain tight performance guarantees as data and usage evolve. These components are modular and generalize across domains, supporting flexible integration in diverse application settings. To evaluate the approach, we conducted three real-world case studies. The first addresses social isolation and loneliness (SI/L) among older adults—a condition associated with serious health risks. We developed and deployed \emph{iCareLoop}, a cyber-physical sensing system that monitors daily activity patterns in senior communities across the U.S. and Japan. Built on top of iCareLoop, SMILE integrates detection and explanation via AR-Pro to identify SI/L risk and generate personalized intervention strategies. The second case study focuses on forensic analysis in hierarchical social networks, such as corporate fraud or extremist networks, where labeled data is limited and the stakes are high. We formulate this as a graph anomaly detection problem and apply PAC-Wrap to ensure reliable detection outcomes. The third case study targets potentially malicious Bash command-line activity in the cybersecurity domain. In this high-risk, low-label setting, we apply PAC-Wrap to a textual anomaly detector to enforce statistical guarantees under evolving threat conditions. In summary, this thesis presents a generalizable anomaly detection system that integrates reliability, interpretability, and adaptability through three modular building blocks. We validate this approach across applications in healthcare, social networks, and cybersecurity, demonstrating its effectiveness in high-stakes, real-world environments.

Author dc:creator

• Ji, Xiayan

Advisors dc:contributor.advisor

• Lee, Insup
• Sokolsky, Oleg

• Computer Sciences

Language dc:language.iso

en

Repository record dc:identifier.uri

https://repository.upenn.edu/handle/20.500.14332/61357

OAI identifier oai:identifier

oai:repository.upenn.edu:20.500.14332/61357