Véronne Yepmo

Grégory Smits
email: gregory.smits@imt-atlantique.fr

Marie-Jeanne Lesot
email: marie-jeanne.lesot@lip6.fr

Olivier Pivert
email: olivier.pivert@irisa.fr

CADI: Contextual Anomaly Detection using an Isolation Forest

Keywords: Computing methodologies → Anomaly detection, Cluster analysis, Knowledge representation and reasoning Anomaly detection, contextual/local anomaly, isolation forest, clustering, anomaly explanation, XAI

Reconstructing the data inner structure and identifying abnormal points are two major tasks in many data analysis processes. A step beyond the decomposition of a data set as inliers and outliers, that then may be interpreted as anomalies, is to distinguish local from global outliers. This paper introduces a unified approach based on a revised version of an isolation forest that allows for both the reconstruction of dense regions of points, the identification of anomalies and the generation of contextual explanations about the abnormality of these points. To make the anomaly detection more informative and reliable, anomalies are compared to the reconstructed partition of the inliers so as to explain why they are considered abnormal and from which local generation mechanism they could originate from. Relying on a common data property, namely the isolation of anomalies from dense groups of regularities, eases the understanding of the data set structure and makes the provided explanations more informative than those provided by two independent mechanisms, one for clustering and one for detecting anomalies. Conducted experimentations show the relevance of the structural knowledge extracted from the proposed isolation forest and the effectiveness and robustness of the approach thanks to the unified isolation-based data model to analyse different facets of the data.

INTRODUCTION

Detecting points that significantly deviate from the rest of the data set is a crucial issue in many applicative contexts as these outliers may correspond to anomalies, frauds, attacks or suspicious behaviors. Many machine learning techniques are dedicated to this task of separating outliers from the other points considered as regularities (see e.g. [START_REF] Chandola | Anomaly Detection: A Survey[END_REF][START_REF] Ruff | A unifying review of deep and shallow anomaly detection[END_REF]). Most of these anomaly detection approaches focus on calculating an anomaly score for each point to quantify the extent to which the point globally deviates from the rest of the data set. Other methods quantify how much the point deviates from its neighborhood. However, anomaly detectors are often embedded into decision-aid systems where their end users require explanations in addition to these scores to be convinced that an action has to be taken to deal with these anomalies. A way to increase the trust in the automatic mechanism that has built this separation of the data into two unbalanced classes (regular points vs. anomalies), is to provide end users with explanations about the reasons why a point is tagged as an anomaly [START_REF] Yepmo | Anomaly explanation: A review[END_REF].

Many anomaly detection algorithms acknowledge the existence of local anomalies, which deviate only from a subset of the data set (red circles on Fig. 1), as opposed to global anomalies which deviate from all the other instances in the data set (red square on Fig. 1). However, the distinction between local and global anomalies is often forgotten in the outputs of anomaly detectors, and during the explanation process. On the data set in Figure 1, even if the detector is able to flag all red instances as anomalies, no existing anomaly explanation method will intrinsically capture that 𝑥 1 is an anomaly for the blue cluster because of its value on 𝐴 1 . This explanation can be produced only if some knowledge about the groups of regularities in the data set is available, and that knowledge is leveraged.

The COIN strategy introduced in [START_REF] Liu | Contextual outlier interpretation[END_REF] is an anomaly explanation method that makes a step towards the extraction of these so-called contextual explanations. The method identifies, for each outlier to explain, its nearest groups of inliers and the outlying attributes wrt. that neighborhood. However, COIN relies on an external anomaly detector and an external clustering algorithm. It combines different machine learning approaches to detect anomalies first, second to locally analyze the data distribution, and then to generate data structure aware explanations about each found anomaly. With such a pipeline, the accuracy of each component depends on specific hyper-parameters that have to be tuned and often on distances that have to be carefully selected as well. The work proposed in this paper suggests the encapsulation of these different steps in a unified approach.

The main contribution of this work is to introduce a unified approach leveraging an isolation-based data model both to identify and explain local anomalies. This approach called CADI which stands for Contextual Anomaly Detection using an Isolation forest, capitalizes on the advantages of the initial Isolation Forest (IF) method introduced in [START_REF] Fei | Isolation-Based Anomaly Detection[END_REF], namely to be accurate and interpretable with only few hyper-parameters to set and no distance measure to choose. To go beyond the detection of anomalies, a density constraint is applied on the randomly generated separation lines to ensure that they do not split dense regions whose identification is a prerequisite to the reconstruction of the data inner structure. With the identification of anomalies and the reconstruction of the data inner structure, each anomaly is then explained wrt. the identified clusters of regular data points, still using the knowledge embedded in the IF.

The rest of the paper is organized as follows. Section 2 explores the existing literature on the different components of CADI. Section 3 presents the approach whose relevance is then confirmed by experimentations conducted in Section 4.

RELATED WORK

CADI aims at associating each detected anomaly with informative descriptions about the strength of its abnormality and the reasons for its classification as an anomaly according to its neighborhood. This section thus positions CADI wrt. existing approaches in the fields of anomaly detection and, in particular, anomaly explanation.

Anomaly Detection

Many machine learning strategies have been proposed to address specifically the issue of identifying anomalies from a data set [START_REF] Chandola | Anomaly Detection: A Survey[END_REF]. The unsupervised case is the most attractive one because of the unpredictability of anomalies and the difficulty of labeling data sets. Considering that regular observations are largely predominant in a data set, deep learning-based strategies identify as anomalies those points that do not fit the concise representation of the training data [START_REF] Zhou | Anomaly Detection with Robust Deep Autoencoders[END_REF]. Local Outlier Factor (LOF) [START_REF] Breunig | LOF: Identifying Density-Based Local Outliers[END_REF], One-Class Support Vector 𝑏𝑢𝑖𝑙𝑑_𝑡𝑟𝑒𝑒 (𝐷 𝑟 , 𝑑 + 1), 𝐷, 𝑑, 𝐴, 𝑣) 12: end if Machines [START_REF] Amer | Enhancing One-Class Support Vector Machines for Unsupervised Anomaly Detection[END_REF] and IF [START_REF] Fei | Isolation-Based Anomaly Detection[END_REF] are also among the most popular unsupervised methods. They leverage the fact that anomalies are located in low density subspaces and easily separable from the other points to identify them. The Isolation Forest algorithm is very appealing for anomaly detection because it is fast, interpretable at the tree level and makes no assumption regarding the distribution of the data set. Plus, the efficiency and the robustness of the approach against the choice of the hyper-parameters have been confirmed throughout the years by different benchmarks [START_REF] Chang | Data-efficient and interpretable tabular anomaly detection[END_REF][START_REF] Han | ADBench: Anomaly Detection Benchmark[END_REF]. As CADI relies on a revisited version of an IF, a focus is now made on this particular technique.

IF [START_REF] Fei | Isolation-Based Anomaly Detection[END_REF] identifies so called global anomalies corresponding to points that can be easily separated from the rest of the data. It is an ensemble-based algorithm as a forest is composed of 𝑡 trees built on 𝑡 randomly drawn subsets of the data set D. As summarized in Algorithm 1, a tree stems from recursive splits of a data subset 𝐷 on randomly chosen attributes and randomly chosen values 𝑣 in the range of values observed in 𝐷 for each chosen attribute 𝐴. The points with a value lower than 𝑣 on attribute 𝐴 are transferred to the left child of the current node, and the others to the right child. This separation process is repeated recursively until one of the following two conditions is met:

• the node is no longer separable (it contains a single point) ;

• the depth limit, a predefined hyper-parameter of the method, is reached.

The algorithm depends on three hyper-parameters: the number of trees in the forest 𝑡, the sample size Ψ and the depth limit of a tree ℎ 𝑙𝑖𝑚 . A node is formally defined by a sextuplet (𝐿𝑁 , 𝑅𝑁 , 𝐷, 𝑑, 𝐴, 𝑣), where 𝐿𝑁 and 𝑅𝑁 are pointers to its left and right nodes respectively, 𝐷 ⊆ D, 𝑑 ∈ N is its depth in the tree, 𝐴 ∈ A and 𝑣 ∈ 𝑑𝑜𝑚(𝐴).

A denotes the set of all attributes and for each 𝐴 ∈ A, 𝑑𝑜𝑚(𝐴) denotes its domain. In Algorithm 1, the method 𝑛𝑜𝑑𝑒 (𝑙𝑒 𝑓 𝑡_𝑐ℎ𝑖𝑙𝑑, 𝑟𝑖𝑔ℎ𝑡_𝑐ℎ𝑖𝑙𝑑, 𝐷, 𝑑, 𝐴, 𝑣) returns a new node.

Once the forest built, each point to evaluate is propagated to the leaves of each tree in the forest and an anomaly score, function of the average depth of the node containing the data point in each tree, is computed as follows [START_REF] Fei | Isolation-Based Anomaly Detection[END_REF]:

𝑠 (𝑥) = 2 -𝐸 (ℎ (𝑥 ) ) 𝑐 (Ψ) , (1)
where 𝐸 (ℎ(𝑥)) is the average depth of the data point over the t trees. 𝑐 (Ψ) is a normalization factor corresponding to the average path length of unsuccessful searches in a binary tree with Ψ nodes [START_REF] Fei | Isolation-Based Anomaly Detection[END_REF].

Several variants of the IF method have been proposed in the literature. Some focus on the calculation of the anomaly score, without modifying the process of building the trees and the forest. This is the case of [START_REF] Mensi | Enhanced anomaly scores for isolation forests[END_REF] where five new functions to compute anomaly scores are proposed. Others modify the construction of the trees but not the calculation of scores. In [START_REF] Fei | On Detecting Clustered Anomalies Using SCiForest[END_REF] and [START_REF] Hariri | Extended Isolation Forest[END_REF], oblique separations are used, but with different goals: detecting clusters of anomalies for the former and improving score consistency for the latter. In [START_REF] Cortes | Revisiting randomized choices in isolation forests[END_REF], the separations are not completely random and aim at minimizing the weighted standard deviation of the subtrees depth induced by each separation. More generally, the variants proposed in the literature focus on the outlier detection task [START_REF] Xiang | DeepiForest: A Deep Anomaly Detection Framework with Hashing Based Isolation Forest[END_REF].

The CADI approach proposed in this paper introduces a novel usage of an IF as a unified data model to identify anomalies, reconstruct the inner structure of the regular points and provide explanations about the found anomalies simultaneously.

Anomaly Explanation and Interpretation

In many applicative contexts, end users expect more than a decomposition of the data into regular points vs. anomalies. Explanations about the reasons for the abnormality of each anomaly can indeed increase the trust and usability of the automatically extracted knowledge. Because of the diverse nature of anomalies, anomaly explanation deserves special treatment even though it has benefited from XAI works dedicated to the explanation of classifiers in general. A general categorization of explanation methods in general and anomaly explanation methods in particular is the model-agnostic vs. model-specific one. A model-agnostic method provides an explanation to any anomaly detection algorithm while a model-specific method is tailored for a particular detector. Recently, more refined taxonomies of anomaly explanation methods have been proposed. In [START_REF] Yepmo | Anomaly explanation: A review[END_REF], four categories of explanations are identified: attribute importance explanation, attribute value explanation, point comparison explanation, and intrinsic data structure analysis explanation. In [START_REF] Panjei | A survey on outlier explanations[END_REF], the following categories of explanations are introduced: methods that rank anomalies, methods that reveal causal relationships between anomalies, and methods that identify attributes responsible for the abnormality of points or groups of points. In both cases, it is stated that techniques returning important attributes are the most common in the literature [START_REF] Gupta | Beyond Outlier Detection: LookOut for Pictorial Explanation[END_REF][START_REF] Mokoena | Why is this an anomaly? Explaining anomalies using sequential explanations[END_REF]. However, these techniques often ignore the local context of an outlier during the explanation generation. A way to remedy this omission and to go a step further is to link anomalies with the intrinsic structure of the data set. A few methods thus consider the anomaly detection as a part of a clustering process [START_REF] Lesot | Credit-Card Fraud Profiling Using a Hybrid Incremental Clustering Methodology[END_REF][START_REF] Macha | Explaining anomalies in groups with characterizing subspace rules[END_REF] or a complement of it [START_REF] Amit K Shukla | Explaining Data Regularities and Anomalies[END_REF].

CADI shares a same objective with the COIN (Contextual Outlier INterpretation) approach [START_REF] Liu | Contextual outlier interpretation[END_REF], namely: to help end users understand why a given point is flagged as an anomaly considering its context. The additional information associated with each anomaly in the COIN approach is a triplet containing i) an anomaly score, ii) a list of attributes supporting the decision of considering the point as abnormal and iii) a description of the local context of the anomaly. Whereas COIN has to be combined with an anomaly detector and a clustering method, the latter being applied on the neighborhood of the anomalous point to explain, CADI provides a unified and self-contained approach to reach the same goal. Another anomaly explanation method, Attention-guided Triplet deviation network for Outlier interpretatioN (ATON) [START_REF] Xu | Beyond Outlier Detection: Outlier Interpretation by Attention-Guided Triplet Deviation Network[END_REF] also includes some local information when producing the explanations. It learns the deviations between the outlier to explain and its regular neighbors in an embedded feature space. However, unlike COIN, it only outputs feature importance weights.

Outlier-Aware Clustering

Being able to reconstruct the data inner structure without being affected by the presence of outliers makes CADI a robust clustering approach. The clustering task aims at decomposing a data set into homogeneous, i.e. compact, and distinct, i.e. well separated, subgroups in the data. As such, it can be seen as summarizing the underlying data distribution and providing a legible overview of the data content. Yet most clustering algorithms suffer from the presence of outliers: the points that do not conform with the global structure of the data most often hinder the identification of regular clusters. The so-called robust clustering methods aim at addressing this issue, providing data partitions that are not perturbed by outliers: they aim at outputting the same results as would be obtained without outliers and without requiring to perform a preliminary step of outlier detection and removal. Robust clustering can be roughly categorized into two types of methods [START_REF] Borgelt | Handling Noise and Outliers in Fuzzy Clustering[END_REF]: some of them proceed by automatically down-weighting atypical data points [START_REF] Dotto | A reweighting approach to robust clustering[END_REF], using several approaches to define these weights, e.g. including noise clustering [START_REF] Rajesh | Characterization and detection of noise in clustering[END_REF], possibilistic clustering [START_REF] Pal | A possibilistic fuzzy c-means clustering algorithm[END_REF], replacing the traditional normal distributions by multivariate t-distributions [START_REF] Mclachlan | Robust cluster analysis via mixtures of multivariate t-distributions[END_REF] or dedicated approaches [START_REF] Klawonn | What Is Fuzzy about Fuzzy Clustering? Understanding and Improving the Concept of the Fuzzifier[END_REF]. Other methods propose to replace the classical squared Euclidean distance, which is known to be highly sensitive to outliers, by other distances [START_REF] Patrick | Fuzzy clustering with squared Minkowski distances[END_REF]. Along the same lines, some approaches are explicitly based on robust M-estimators incorporated in the cost function [START_REF] Dave | Robust clustering methods: a unified view[END_REF], the possibilistic c-means [START_REF] Krishnapuram | The possibilistic C-means algorithm: insights and recommendations[END_REF] can be seen in this framework. These approaches define robustness as the ability to ignore the outliers, possibly grouping them in a specific cluster, as in the noise clustering approach for instance.

By aiming at providing a rich overview of the whole dataset, including the regular points inner structure and the existing anomalies, CADI is related to the approaches introduced in [START_REF] Lesot | Descriptive concept extraction with exceptions by hybrid clustering[END_REF], [START_REF] Chawla | 𝑘-means--: A unified approach to clustering and outlier detection[END_REF] and [START_REF] Liu | Clustering With Outlier Removal[END_REF] but leverages a common data structure (viz. an isolation forest) to extract these two types of knowledge.

THE CADI APPROACH

This section details the CADI approach focusing first on the modification made on the IF construction algorithm to avoid splitting dense subspaces that will then form clusters or parts of them. The anomaly scoring function is also revisited to take into account the impact of the density constraint on the isolation process. The same IF is then used to reconstruct a partition of the regular data points, and identify local anomalies to the found clusters. Finally, the identified anomalies are explained wrt. the clusters of regular data points. Deepest common ancestor between the paths from the root of 𝑇 (𝑙 𝑖 ) to 𝑙 𝑖 and 𝜂 𝑖 (𝑥)

Density-Aware Isolation Forest

As reminded in Sec. 2.1, in the classical IF approach, an isolation tree is built through recursive splits of a data subset 𝐷. A split is a couple (𝐴, 𝑣), where 𝐴 is a randomly chosen attribute 𝐴 ∈ A and 𝑣 a value from its observed domain 𝑣 ∈ [min 𝑥 ∈𝐷 𝑥 .𝐴, max 𝑥 ∈𝐷 𝑥 .𝐴]. CADI revisits this completely random process to keep only the splits that fall in low density regions. Anomalies being by definition detached from regular phenomenon materialized by dense subspaces, the objective of this revisited isolation algorithm is to find separation lines in low density areas surrounding dense regions. To do so, a densitybased constraint is added and determines if a split is maintained or discarded. The hypothesis is the following: if a significant number of points are found in the neighborhood of the split, it is potentially separating a cluster. In that case, the split is discarded and another one is generated. The goal is to surround the clusters of regular points by the separations, so that some leaves may contain a cluster, or a significant portion of a cluster. One hyper-parameter denoted 𝛼 is introduced in addition to the IF hyper-parameters to control the size of the margin around the separation which represents its neighborhood. Alg. 2 details how density-aware isolation trees are constructed and Fig. 2 illustrates an example of split selection. The split (𝐴 1 , 𝑣 1 ) on Fig. 2 is discarded as many points are located in the margin surrounding the separation. It is not the case for the split (𝐴 2 , 𝑣 2 ) that is kept. Compared to the initial IF algorithm, a cost overhead is undeniably induced by this split selection, as in the original IF approach the splits are randomly drawn. However, to learn from the discarded splits and to avoid generating separations in intervals that have already been discarded because they contain many data points, the set of tested intervals on each attribute J = {𝐼 𝐴 1 , . . . , 𝐼 𝐴 𝑚 } (𝐼 𝐴 being the set of tested intervals on attribute 𝐴) is stored and passed as a parameter through the recursive calls to the build_tree function (line 20 in Alg. 2). If the method was not able to find a valid separation in the whole interval of values of an attribute (line 10), this attribute is discarded (line 11). The discarded attributes are therefore also stored, in the variable 𝐶. If the method is unable to find a valid separation on any attribute (line 3), then a terminal Return 𝑛𝑜𝑑𝑒 (𝑛𝑢𝑙𝑙, 𝑛𝑢𝑙𝑙, 𝐷, 𝑑, 𝑛𝑢𝑙𝑙, 𝑛𝑢𝑙𝑙) ⊲ returns a leaf Return 𝑏𝑢𝑖𝑙𝑑_𝑡𝑟𝑒𝑒 (𝐷, 𝑑, 𝛼, J, 𝐶) ⊲ select another split 21: end if node is returned (line 4), the current set of points being considered as inseparable.

In a tree generated by CADI a leaf may be of three different types depending on the termination condition that yields it. An Isolation Node (IN) stores a data point that has been isolated from the rest of the dataset, it is generated when As compared to a classical IF, a CADI forest induces an additional cost related to the storage of the excluded intervals. As they are stored only for one node at a time, this overhead is a constant. The time complexity differs from that of a classical IF by the selection of the separations. This difference is, in the worst case, linear with respect to the number of attributes: O (|A|).

Clustering from an IF

A CADI forest has three types of terminal nodes: IN, DN, and DLN. IN leaves contain potential anomalies, as the data points were isolated. DLN leaves are those containing points which have not been separated after a certain number of splits, just like in IF. DN leaves contain points that cannot be separated no matter the attribute. They therefore gather dense group of points, corresponding to clusters or portions of clusters. As a result, in order to obtain a partition of the data set, these leaves need to be combined.

The combination strategy of CADI's DN leaves is inspired by grid-based clustering [START_REF] Agrawal | Automatic Subspace Clustering of High Dimensional Data for Data Mining Applications[END_REF] where the feature space is first partitioned by a grid. Each cell of the grid is a combination of intervals on the attributes in A, and contains some points. Then, contiguous dense cells are merged to form clusters. In practice, a graph G = (V, E) is built. Each vertex of the graph is a cell and there is an edge 𝐸 between two vertices 𝑉 1 , 𝑉 2 ∈ V if the corresponding cells are contiguous. The connected components of the graph are later extracted, and each connected component is a cluster. Like cells in grid-based clustering, DN leaves in CADI contain data points and delimitate dense regions of the data space. However, there are some major differences between the two units. First, DN leaves coming from different trees may have some points in common (because of the sampling), whereas grid cells are disjoint in terms of points. Second, the subspaces delimitated by DN leaves may overlap. As a result, instead of adding an edge between two vertices if the corresponding leaves are contiguous, an edge 𝐸 is created if the two leaves are somewhat similar in terms of points. This similarity is measured by the Jaccard index between the two leaves and corresponds to the weight of 𝐸:

𝑤 𝐸 = |𝑉 1 ∩ 𝑉 2 | |𝑉 1 ∪ 𝑉 2 | , with 𝐸 = (𝑉 1 , 𝑉 2 )
. 𝑉 1 and 𝑉 2 are the sets of points contained is the respective leaves. Each connected component is a cluster. This strategy allows to automatically discover the number of clusters in the data set, just like in grid-based clustering. The data points not assigned to a cluster, because they were not part of any sample used to build the forest, are propagated through each tree until they reach a terminal node. A majority vote is then performed among the clusters of the corresponding DN leaves. Before the extraction of the connected components, a preprocessing step is applied: the leaves included in other leaves are deleted from V to remove redundancies.

Anomaly Interpretation

In the COIN [START_REF] Liu | Contextual outlier interpretation[END_REF] approach, an outlier explanation is composed of:

(1) a quantification of the point abnormality,

(2) a local positioning wrt. its surrounding regularities, which is equivalent for the method to a set of the clustered neighbors of the point, (3) a subset of attributes weighted by their relative contribution to the abnormality of the suspicious point.

Similarly to COIN, the CADI approach provides for each outlier:

(1) a quantification of the point abnormality, (2) a quantification of its deviation wrt. each identified cluster, (3) a subset of attributes weighted both by their relative contribution to bringing the suspicious point closer to each cluster and their relative contribution to the abnormality of the suspicious point wrt. each cluster.

Anomaly Score. Leveraging the property that it is more likely to isolate anomalies than regularities using random splits, the anomaly score of a given point is computed in the original IF approach as a function of its depth of isolation in the different trees of the forest. Using the CADI approach, and due to the density constraint imposed on the randomly generated splits, a dense region may be completely scanned without increasing the depth of the tree, thus leading to a leaf of type DN containing a high number of inseparable points located at low depth. To differentiate leaves of type IN from those of type DN, it thus makes more sense to define an anomaly score based on the cardinality of the set of points isolated in a same leaf instead of its depth. Equation 2 is used to calculate an anomaly score for a given point 𝑥 that depends on the cardinality of the node it is isolated in:

𝑠 𝑖 (𝑥) = 1 - |𝜂 𝑖 (𝑥)| -1 Ψ , (2)
where 𝜂 𝑖 (𝑥) is the node containing 𝑥 in the 𝑖-th tree. The score 𝑠 𝑖 (𝑥) varies in ]0, 1] taking its maximum value when 𝑥 is isolated alone in an IN leaf and is close to 0 when the whole data subset ends in a same leaf. The latter situation occurs when no separation line can be validated on the whole universe: the dataset consists of a single indivisible cluster.

The global anomaly score is the average over the whole forest containing 𝑡 trees:

𝑠 (𝑥) = 1 𝑡 𝑡 ∑ 𝑖=1 𝑠 𝑖 (𝑥). (3)
Local Structure-Aware Anomalies. In its original version, an IF detects points that may be easily separated from the rest of the dataset, leading to so-called global anomalies. Local anomalies may also be identified by an IF, but no distinction between local and global anomalies is made in the output of the method. Many recent works (see Sec. 2.2) focus on providing users with more informative descriptions of the data set, especially through a local contextualization of the found anomalies. It is now shown that a forest generated by CADI embeds all the necessary structural knowledge to identify possible links between anomalies and clusters.

Let 𝑥 be a point whose anomaly score 𝑠 (𝑥) is sufficiently high to be considered as an anomaly. The next step is to determine for each cluster 𝐶 ∈ C whether 𝑥 can be considered as an abnormal deviation of the regular phenomenon modelled by 𝐶. Let {𝑙 1 , . . . , 𝑙 𝑝 } be the set of DNs making up 𝐶, and 𝑇 (𝑙 𝑖 ), 𝑖 = 1 . . . 𝑝 be the tree in which 𝑙 𝑖 is found. Still using the structural knowledge embedded in 𝑇 (𝑙 𝑖 ) only, viz. without having to choose an appropriate distance In a tree, e.g. 𝑇 (𝑙 𝑖 ), the path from the root to the leaf 𝑙 𝑖 implies different separations each narrowing the subspace originally enclosed by the root. As a result, if 𝑥 and the points in 𝑙 𝑖 are found in the same node deep in the tree, they are more likely to be close from each other in the feature space. In that case, if 𝑥 is separated from the points in 𝑙 𝑖 , it is more likely to be deviating from 𝑙 𝑖 . By applying this principle to all the 𝑙 𝑖 s in a cluster 𝐶, a score corresponding to the local deviation of 𝑥 wrt. 𝐶 is computed. This contextual score depends on the depth of the deepest common ancestor (𝑑𝑐𝑎) between the node containing 𝑥 in the 𝑖-th tree 𝜂 𝑖 (𝑥), and each 𝑙 𝑖 in the corresponding 𝑇 (𝑙 𝑖 ):

𝑐 (𝑥, 𝐶) = 1 𝑝 𝑝 ∑ 𝑖=1 ℎ(𝑑𝑐𝑎(𝜂 𝑖 (𝑥), 𝑙 𝑖 )) ℎ 𝑙𝑖𝑚 , (4)
where 𝑑𝑐𝑎(𝜂 𝑖 (𝑥), 𝑙 𝑖 ) refers to the deepest common ancestor of 𝜂 𝑖 (𝑥) and leaf node 𝑙 𝑖 , and ℎ(𝑑𝑐𝑎(𝜂 𝑖 (𝑥), 𝑙 𝑖 )) is its depth. The process described above is illustrated on Figure 3. On Fig. 3a, two clusters 𝐶 1 and 𝐶 2 have been identified: 𝐶 1 = {𝑙 1 , 𝑙 2 } and 𝐶 2 = {𝑙 3 , 𝑙 4 , 𝑙 5 }. The contextual score of 𝑥 with each cluster is computed using the depth of the deepest common ancestor between 𝑥 and each 𝑙 𝑖 (Fig. 3b). These contextual scores are therefore given by: 𝑐 (𝑥, 𝐶 1 ) = (5/ℎ 𝑙𝑖𝑚 + 4/ℎ 𝑙𝑖𝑚 )/2 = 9/2ℎ 𝑙𝑖𝑚 and 𝑐 (𝑥, 𝐶 2 ) = (2/ℎ 𝑙𝑖𝑚 + 1/ℎ 𝑙𝑖𝑚 + 1/ℎ 𝑙𝑖𝑚 )/3 = 4/3ℎ 𝑙𝑖𝑚 . As a conclusion, 𝑥 is a local anomaly of 𝐶 1 .

Common and Discriminating Attributes. In addition to the contextual scores computed between an anomaly 𝑥 and each cluster 𝐶 ∈ C, it is possible and particularly interesting to determine which attributes make of 𝑥 a contextual anomaly of a given cluster 𝐶. Each attribute 𝐴 is thus associated with a couple of weights forming the vector 𝑒 (𝐴, 𝑥, 𝐶). The first item of the couple indicates how much the value possessed by 𝑥 on 𝐴 (𝑥 .𝐴) is shared by other members of 𝐶. The second item of the couple quantifies how much 𝐴 makes 𝑥 an anomaly of 𝐶. To compute these weights, the paths in each 𝑇 (𝑙 𝑖 ) from its root to 𝜂 𝑖 (𝑥) and 𝑙 𝑖 respectively are analyzed like in Fig. 3b. In a tree 𝑇 (𝑙 𝑖 ), the attribute involved in 𝑑𝑐𝑎(𝜂 𝑖 (𝑥), 𝑙 𝑖 ), attribute denoted by 𝐴(𝑑𝑐𝑎(𝜂 𝑖 (𝑥), 𝑙 𝑖 )) in Equation 5, is considered as an explanation of the reason why 𝑥 is an anomaly, whereas the other attributes involved in the path from the root of 𝑇 𝑙 𝑖 to 𝑑𝑐𝑎(𝜂 𝑖 (𝑥), 𝑙 𝑖 ) (𝑑𝑐𝑎 excluded) describe the context shared by 𝑙 𝑖 and 𝑥. The couple represented by the vector 𝑒 𝑙 𝑖 (𝐴, 𝑥) quantifies the contribution of attribute 𝐴 to explain 𝑥 as a local anomaly of the dense subset of points gathered in the leaf 𝑙 𝑖 .

𝑒 𝑙 𝑖 (𝐴, 𝑥) = 𝜔 (𝐴) 1 if 𝐴 = 𝐴(𝑑𝑐𝑎(𝜂 𝑖 (𝑥), 𝑙 𝑖 )) and 0 otherwise [START_REF] Carletti | Interpretable Anomaly Detection with DIFFI: Depth-based feature importance of Isolation Forest[END_REF] where 𝜔 (𝐴) is the number of times attribute 𝐴 is used as a separation attribute in the path from the root of 𝑇 (𝑙 𝑖 ) to 𝑑𝑐𝑎(𝜂 𝑖 (𝑥), 𝑙 𝑖 ) (𝑑𝑐𝑎 excluded).

At the forest and cluster levels, the weight vector attached to an attribute 𝐴 to quantify its contribution to explain why 𝐴 is an anomaly of 𝐶 is computed as follows:

𝑒 (𝐴, 𝑥, 𝐶) = 1 𝑝 𝑝 ∑ 𝑖=1 𝑒 𝑙 𝑖 (𝐴, 𝑥). ( 6
)

EXPERIMENTS

The objective of this section is to evaluate the proposed CADI approach. Answers to the following questions are sought: 1) Is CADI able to accurately detect anomalies in a data set? 2) Is CADI able to provide an accurate partition of the data set? 3) Is CADI able to identify contextual anomalies wrt. clusters of regular data points? 4) Is CADI able to provide accurate contextual explanations for the anomalies? Each component of CADI is therefore evaluated.

Data Sets and Experimental Setup

As anomaly detection has been extensively explored in the literature, several real-world data sets for the assessment of this task exist. Eleven real-world and two synthetic data sets [START_REF] Rayana | ODDS Library[END_REF], described in Table 2, are used to evaluate the anomaly detection step.

Unfortunately, there is no information neither on the presence of clusters in these data sets, the locality of anomalies, nor on the ground-truth explanations. In general, evaluating an explanation on real-world data sets is not an easy task, because of this absence of ground-truth. With some knowledge about the data, it is possible to have an insight on these ground-truth explanations. In the anomaly explanation literature, a common practice is to add controlled noise attributes [START_REF] Carletti | Interpretable Anomaly Detection with DIFFI: Depth-based feature importance of Isolation Forest[END_REF][START_REF] Liu | Contextual outlier interpretation[END_REF]. The hypothesis behind this practice is that true explanations should lie among the original (viz. not noise) attributes. We believe that an evaluation using this scheme is not faithful enough, since the true outlying attributes must be part of the original ones. This scheme therefore only evaluates the ability of a method to provide non-aberrant explanations. In [START_REF] Xu | Beyond Outlier Detection: Outlier Interpretation by Attention-Guided Triplet Deviation Network[END_REF], another technique to generate ground-truth explanations on real-world data sets is proposed. The outlying degree/score of real outliers in every possible subspace of the original feature space is computed. The ground-truth explanation is the subspace where the anomaly receives the highest score. Three different anomaly detectors are used, among which IF. Depending on the detector used, there are different ground-truth outlying attributes that are used separately during the evaluation. With this scheme, there is no information regarding the possible clusters of regular data points.

In contrast to real-world data sets, the true outlying attributes are known during the generation of synthetic data sets. Furthermore, since the generation process is known, data sets containing clusters and local anomalies can be produced. Since the best usage of CADI is this setting, only synthetic data sets are used for the evaluation of the subsequent components of the method. We follow a strategy similar to the one described in [START_REF] Liu | Contextual outlier interpretation[END_REF] for the generation of synthetic data sets. In the first synthetic data set, each anomaly is close to only one cluster. The outlying attributes wrt. the corresponding cluster constitue the ground-truth. In the second data set, some anomalies share some attributes values with more than one cluster. The third data set contains anomalies that deviate from all the clusters. The last cluster contains, in addition to local and global anomalies, a cluster of anomalies. To evaluate the ability of CADI to discover non-spherical clusters, the second and third data sets contain stretched clusters. In addition to that, the fourth data set is the moons data set generally used to evaluate clustering. It is composed of two interleaving half circles, to which we manually added outliers. Information about the synthetic data sets generated are summarized in Table 3.

To enhance the reproducibility of our experimental results, the code and the synthetic data sets along with the ground truths are publicly available 1 .

The parameters of CADI are set to these default values: 𝑡 = 100, Ψ = 256, ℎ 𝑙𝑖𝑚 = 8 and the margin size is 𝛼 = 5% of the attribute's initial range. The default values of 𝑡, Ψ and ℎ 𝑙𝑖𝑚 are the same as for IF. The intuition behind a fixed value of 𝛼 is the following : if two points are separated by less than that 𝛼 × 𝑟𝑎𝑛𝑔𝑒 (𝐴) on an attribute 𝐴, they should remain together during the tree building process. However, the value of that parameter can be adjusted with some knowledge about the data. For example, if the user wants to keep together data points having a difference in values on a specific attribute 𝐴 less than a quantity 𝛽, then the value of 𝛼 for this attribute can be set to 𝛽/𝑟𝑎𝑛𝑔𝑒 (𝐴). This fixed value of 𝛼 causes an update on l.14 in Alg. 2. If the data distribution is uniform, then 𝑚𝑎𝑟𝑔/(max 𝑥 ∈𝐷 𝑥 .𝐴min 𝑥 ∈𝐷 𝑥 .𝐴) × |𝐷 | points should be expected in the margin. Nevertheless, 𝛼 is an upper bound of the quantity 𝑚𝑎𝑟𝑔/(max 𝑥 ∈𝐷 𝑥 .𝐴min 𝑥 ∈𝐷 𝑥 .𝐴), as the quantity (max 𝑥 ∈𝐷 𝑥 .𝐴-min 𝑥 ∈𝐷 𝑥 .𝐴) decreases with separation. l.14 is therefore not modified in the implementation and the experiments.

Anomaly Detection

This part of the experiments aims at evaluating CADI in terms of anomaly detection. To this end, the real-world and synthetic data sets are used. For each data set, the ground-truth anomalies are known. The Area under the Receiver Operating Characteristic curve (AUC/AUROC) is computed. AUC is an appealing method for anomaly detection evaluation because it is independent of the outlying degree threshold. It represents the probability that an anomaly receives a higher score than a regular data point. CADI is compared to the classical IF method in terms of AUC. For comparison between IF and other anomaly detection algorithms, some benchmarks, like [START_REF] Han | ADBench: Anomaly Detection Benchmark[END_REF], are available. The means and standard deviations of the AUC after ten runs of CADI and IF are reported in Table 4.

In general, there is no significant difference between CADI and IF. However, CADI performs much better than IF on two data sets in particular: mammography and the synthetic data set wood. That performance increase is due to the fact that these data sets contain regular data points located in sparse regions of the feature space. As CADI combines the separability information and the local density information during the split selection, the method is able to make a better distinction than IF between regular data points located in sparse subspaces and isolated anomalies. IF in contrast uses only the separability information when computing the anomaly score, leading to a less precise distinction between regular data points located in sparse subspaces and anomalies. Another observation is that the standard deviations of the anomaly score with CADI are generally lower, implying that the results obtained are more stable. This stability is caused by the non-completely random selection of the separations in CADI.

Clustering Evaluation

To evaluate the clustering component of CADI, a forest is built for each synthetic data set. Anomalies are identified by choosing a score threshold of 0.95. Then, a partition of the regular data points is extracted by the procedure described in Sec. 3.2. For each synthetic data set, the true clustering labels of each data point are known. As a result, the Adjusted Rand Index (ARI) is used as evaluation metric. To have a ground-truth partition for computing the ARI, we assign all the known anomalies to a cluster, and the regular instances are assigned to their respective true cluster. CADI is compared with the density-based clustering algorithm DBSCAN [START_REF] Ester | A densitybased algorithm for discovering clusters in large spatial databases with noise[END_REF] and the robust clustering algorithm 𝑘-means-- [START_REF] Chawla | 𝑘-means--: A unified approach to clustering and outlier detection[END_REF]. The choice of DBSCAN for comparison is motivated by three main reasons: 1) DBSCAN identifies not only the clusters of regular data points but

Contextual Anomaly Detection

In addition to identifying anomalies and groups of regular data points, CADI provides some insight about the cluster(s) from which each anomaly may be deviate. As, to the best of our knowledge, no method in the literature is able to do so, there is no baseline for comparison. However, since the true cluster assignments are known for each anomaly in the generated data sets, the performance of CADI regarding the contextual anomaly detection can be evaluated.

To do so, for each outlier 𝑜, let P be the set of predicted clusters for 𝑜, i.e the set of clusters from which 𝑜 may be deviating according to CADI. Let T be the set of ground-truth clusters for 𝑜, i. For each data set, the precisions and recalls are averaged over the outliers. The results are shown in Table 6. CADI performs well on all the data sets, with perfect precision and recall on D 1 and D 2 .

The method is more challenged on D 3 as this data set contains several data points deviating from more than one cluster.

Contextual Explanations

The last part of CADI's assessment concerns the generated contextual explanations. CADI outputs for an outlier 𝑜 a list of discriminating feature weights wrt. each identified cluster (second items of the pairs in Eq. 6). COIN [START_REF] Liu | Contextual outlier interpretation[END_REF] also outputs a list of feature weights, but with respect to the local context of 𝑜 only, and not the set of clusters in the data set. ATON [START_REF] Xu | Beyond Outlier Detection: Outlier Interpretation by Attention-Guided Triplet Deviation Network[END_REF] on the other hand does not take the local context of 𝑜 into account, but still outputs a list of feature weights. Both COIN and ATON need as input the outlier 𝑜 to explain. It is not the case for CADI which performs anomaly detection prior to the explanation. COIN and ATON will nonetheless serve as baseline for the evaluation. In addition to these two, CADI is compared to the ground-truth explanation extraction procedure introduced in [START_REF] Xu | Beyond Outlier Detection: Outlier Interpretation by Attention-Guided Triplet Deviation Network[END_REF] and detailed in Section 4.1. The IF is used as detector for this method called ATON-GT from here onwards. ATON-GT outputs for each specified outlier 𝑜, the subspace in which it receives the highest anomaly score. The implementations of COIN, ATON and ATON-GT were kindly made available by their respective authors. Considering all the above-mentioned differences across CADI, COIN, ATON and ATON-GT, we propose the following evaluation procedure to provide a fair comparison:

• Since COIN, ATON and ATON-GT do not identify outliers per se, explanations for true outliers only are requested from all the four methods. This allows to also evaluate the ability of CADI to provide accurate explanations even for outliers the method was not able to identify as such. • The ground-truth explanations are a list of discriminating attributes wrt. each cluster. As a result, for the methods outputting feature importance scores (CADI, COIN and ATON), the top 𝑘 discriminating features are retrieved, with 𝑘 being the length of the true explanatory subspace. • For all four methods, the precision and recall of the explanations are computed in a similar manner as for contextual anomaly detection performance evaluation. This procedure is also used in [START_REF] Xu | Beyond Outlier Detection: Outlier Interpretation by Attention-Guided Triplet Deviation Network[END_REF]. For each data set, the precision and recall over all the outliers are computed. • As CADI should not only produce the good cluster(s) but also the good explanatory subspaces wrt. these clusters, the two information should match. Consequently, during the precision and recall computation, the predicted cluster is compared to the ground-truth cluster first, before comparing the explanatory subspaces. • For COIN, ATON and ATON-GT, the generated explanatory subspace is compared with the explanatory subspace of 𝑜 wrt. the true cluster(s) from which it is deviating, as these methods do not indicate from which cluster 𝑜 may be deviating.

The precision and recall for each data set and each method are shown in Table 7.

CADI has a high precision and recall on all the data sets, meaning that it is able not only to identify the cluster(s) from which an instance is deviating, but also to provide a faithful explanation wrt. these clusters in terms of discriminating attributes. COIN performs better than ATON on D 1 , D 2 and D 4 . This may be because of the clustering step of COIN that allows to mitigate the influence of different groups of points on the attributes importance. ATON and ATON-GT perform better than COIN on D 3 . In this data set, clusters are located in different subspaces and local anomalies can also be identified in these subspaces. As ATON-GT explores different subspaces during the explanation generation process, it has a slight advantage. CADI is also able to discover clusters (and consequently outliers) in subspaces because of the split generation procedure. As a result, it does not fall far behind ATON-GT in terms of precision on D 3 . In general, ATON-GT has a high recall, because it tends to overestimate the size of the explanatory subspace. For example, on data set D 1 , the explanatory subspace returned by ATON-GT for the red square outlier on Figure 4 is the full attribute space. Although feature 𝐴 1 is sufficient (regardless of the local context or not), that outlier is more easily isolated in the full feature space than in 𝐴 1 .

CONCLUSION AND FUTURE WORK

This paper presented a unified model for contextual and interpretable anomaly detection. The proposed method, called CADI proposes a revised version of the IF as a basis to identify outliers, groups of regular data points and to provide explanations of both global and local anomalies wrt. clusters, without relying on external algorithms to perform the different tasks. Conducted experiments show that CADI is indeed able not only to identify the anomalies as well as classical IF on real-world data sets, but also to provide meaningful and accurate explanations regarding the abnormality of an instance wrt. a group of points in synthetic data sets containing clusters and local anomalies. The main limitation of this work is the absence of evaluation of the explanation component on real-world data and higher dimensional data sets. This will require some work to provide adequate ground-truths and is the main direction for further research.

Figure 1 :

 1 Figure 1: Illustrative example

Algorithm 1 8 : 9 :

 189 Isolation Forest : 𝑏𝑢𝑖𝑙𝑑_𝑡𝑟𝑒𝑒 [23] 1: Inputs: a sample 𝐷 ⊂ D, the depth 𝑑 of the current node; 𝑑 = 0 during the first call of the method 2: Output: a node in an isolation tree 3: if |𝐷 | = 1 or 𝑑 > ℎ 𝑙𝑖𝑚 then 4: Return 𝑛𝑜𝑑𝑒 (𝑛𝑢𝑙𝑙, 𝑛𝑢𝑙𝑙, 𝐷, 𝑑, 𝑛𝑢𝑙𝑙, 𝑛𝑢𝑙𝑙) 𝑣 ← 𝑟𝑎𝑛𝑑𝑜𝑚([min 𝑥 ∈𝐷 𝑥 .𝐴, max 𝑥 ∈𝐷 𝑥 .𝐴]) ⊲ Random value selection 𝐷 𝑙 ← {𝑥 ∈ 𝐷/𝑥 .𝐴 < 𝑣 } 𝐷 𝑟 ← {𝑥 ∈ 𝐷/𝑥 .𝐴 ≥ 𝑣 } 10: Return 𝑛𝑜𝑑𝑒 (𝑏𝑢𝑖𝑙𝑑_𝑡𝑟𝑒𝑒 (𝐷 𝑙 , 𝑑 + 1), ⊲ Internal node 11:

Table 1 :

 1 Notations used throughout the paper Notation Meaning D Data set of 𝑁 points A = {𝐴 1 , . . . , 𝐴 𝑚 } Descriptive attributes 𝑑𝑜𝑚(𝐴) Domain of attribute A 𝐼 𝐴 Set of tested intervals on feature 𝐴 ∈ A 𝑥 ∈ D Data point 𝑥 .𝐴 Value for data point 𝑥 on attribute 𝐴 𝑡 Size of the forest F = {𝑇 1 , . . . ,𝑇 𝑡 } Ψ Size of the sample used to build a tree ℎ 𝑙𝑖𝑚 Depth limit 𝜂 𝑖 (𝑥) Leaf containing 𝑥 in the 𝑖-th tree 𝛼 Margin width percentage C Partition of D in 𝑘 clusters {𝐶 1 , . . . , 𝐶 𝑘 } 𝑇 (𝑙) Tree containing the leaf 𝑙 𝑑𝑐𝑎(𝜂 𝑖 (𝑥), 𝑙 𝑖 )

Figure 2 :

 2 Figure 2: Example of a discarded separation line (𝐴 1 , 𝑣 1 ) falling in a dense area (dashed line) and a validated separation (𝐴 2 , 𝑣 2 ) (plain line)

  |𝐷 | = 1. A terminal node is called a Dense Node (DN) if it gathers a set of inseparable points, formally if |𝐷 | > 1 and 𝐶 = A (l.3 in Alg. 2). Finally, a Depth-Limit Node (DLN) is such that 𝑑 = ℎ 𝑙𝑖𝑚 and 𝐶 ≠ A. Whereas the classical IF algorithm yields only nodes of type IN and DLN, the nodes of type DN induced by the density constraint applied on the randomly generated splits are particularly informative in the prospect of reconstructing the data inner structure (Sec. 3.2).

  (a) Clusters 𝐶 1 and 𝐶 2 (b) Deepest common ancestors (blue octogons) between 𝑥 and the 𝑙 𝑖 s (green squares). Partial trees are displayed.

Figure 3 :

 3 Figure 3: Contextual/Local anomaly detection: leveraging CADI trees and DN leaves

  e the set of clusters from which 𝑜 is deviating. The precision and recall are computed as 𝑝𝑟𝑒𝑐𝑖𝑠𝑖𝑜𝑛 = |P ∪ T |/|P | and 𝑟𝑒𝑐𝑎𝑙𝑙 = |P ∪ T |/|T |.

Figure 4 :

 4 Figure 4: Data set D 1 . For the outlier represented by a red square, ATON-GT returns as explanatory subspace the full feature space.

Table 2 :

 2 Real-world data sets

	Data set D	|A|	|D|	# anomalies
	Annthyroid	6	7200	534
	Arrhythmia	271	420	57
	Breast	9	683	239
	Cover	10 286048	2747
	HBK	4	75	14
	HTTP	3	567498	2213
	Ionosphere	32	351	126
	Mammography	6	11183	260
	Pima	8	768	268
	Satellite	36	6435	2036
	Shuttle	9	58000	3511
	SMTP	3	95156	30
	Wood	6	20	4

Table 3 :

 3 Synthetic data setsData set D |A| # clusters |D| # anomalies Description

	D 1	2	2	900	25	Spherical clusters. Local anomalies only.
	D 2	2	3	1508	8	Two spherical and one stretched clusters. Local and global anomalies.
	D 3	3	4	408	8	Four stretched clusters. Each pair of clusters located in only two dimensions Local and global anomalies.
	D 4	2	2	517	17	Two moons. One anomaly cluster. Local and global anomalies.

Table 4 :

 4 Anomaly detection performance: AUC 𝑘-means--are a variant of the classic 𝑘-means clustering algorithm. The approach has two parameters: the number 𝑘 of clusters to discover and the number 𝑙 of outliers in the data set. The 𝑙 farthest points are discarded during the cluster centers updates. We set the values of 𝑘 and 𝑙 to their true values for each dataset. The default parameters of DBSCAN are used on D 1 , D 2 and D 3 . The most important parameter of DBSCAN is 𝜖 which controls the size of the neighborhood. On D 4 , the default value of 𝜖 does not produce good results. It was fine-tuned. On that same data sets, the weakest edges were removed by CADI to obtain two clusters. The best ARI obtained when using CADI, DBSCAN and 𝑘-means--on the data sets are reported in Table5.𝑘-means--obtain the best ARI on D 1 and D 2 . This behavior was expected, since the classic 𝑘-means algorithm is efficient for extracting spherical clusters. On D 3 and D 4 , 𝑘-means--struggles, just like the original 𝑘-means struggles on these data sets in the absence of anomalies. DBSCAN and CADI on the other hand do not struggle to discover non-elliptical clusters. CADI obtains the best ARI in average.

	Data set	CADI	IF
	Annthyroid	0.772 ± 0.014 0.819 ± 0.013
	Arrhythmia	0.812 ± 0.007 0.775 ± 0.045
	Breast	0.994 ± 0.001 0.981 ± 0.004
	Cover	0.832 ± 0.027 0.873 ± 0.022
	HBK	1.0 ± 0.0	1.0 ± 0.0
	HTTP	0.998 ± 0.002 0.999 ± 0.001
	Ionosphere	0.827 ± 0.009 0.855 ± 0.005
	Mammography 0.844 ± 0.011 0.645 ± 0.037
	Pima	0.702 ± 0.007 0.684 ± 0.010
	Satellite	0.700 ± 0.014 0.699 ± 0.016
	Shuttle	0.992 ± 0.002 0.995 ± 0.001
	SMTP	0.883 ± 0.011 0.889 ± 0.008
	Wood	0.956 ± 0.061 0.868 ± 0.069
	D 1	0.999 ± 0.001	0.999 ± 0.001
	D 2	0.965 ± 0.005 0.979 ± 0.004
	D 3	0.974 ± 0.005 0.995 ± 0.002
	D 4	0.990 ± 0.001 0.972 ± 0.005
	Mean AUC	0.8965	0.8839
	also the anomalies. 2) DBSCAN, as CADI, automatically discovers
	the number of clusters and therefore does not require it as an input
	parameter. 3) DBSCAN is able to discover non-elliptical clusters.

Table 5 :

 5 Clustering performance: ARI

	Data set CADI DBSCAN 𝑘-means--
	D 1	0.986	0.914	1.0
	D 2	0.970	0.963	0.994
	D 3	0.936	0.971	0.333
	D 4	0.992	0.999	0.287
	Mean	0.971	0.962	0.653

Table 6 :

 6 Contextual anomaly detection performance

	Data set Precision Recall
	D 1	1.0	1.0
	D 2	1.0	1.0
	D 3	0.875	0.875
	D 4	0.941	1.0

Table 7 :

 7 Outlier interpretation performance

	Data set		Precision				Recall
		CADI	COIN	ATON ATON-GT CADI COIN ATON ATON-GT
	D 1	1.0	0.76	0.76	0.76	1.0	0.76	0.76	1.0
	D 2	1.0	0.81	0.60	0.81	1.0	0.81	0.69	1.0
	D 3	0.89	0.69	0.87	1.0	0.89	0.69	0.87	0.75
	D 4	1.0	1.0	0.94	0.67	1.0	1.0	0.94	0.91

Proceedings of ACM SAC Conference (SAC'24). ACM, New York, NY, USA, Article 4, 10 pages. https://doi.org/10.1145/3605098.3635969

https://gitlab.com/yveronne/cadi

ACKNOWLEDGMENTS

This research is part of the SEA DEFENDER project funded by the French DGA (Directorate General of Armaments).