Less is More: Building Selective Anomaly Ensembles
  Ensemble techniques for classification and clustering have long proven
effective, yet anomaly ensembles have been barely studied. In this work, we tap
into this gap and propose a new ensemble approach for anomaly mining, with
application to event detection in temporal graphs. Our method aims to combine
results from heterogeneous detectors with varying outputs, and leverage the
evidence from multiple sources to yield better performance. However, trusting
all the results may deteriorate the overall ensemble accuracy, as some
detectors may fall short and provide inaccurate results depending on the nature
of the data in hand. This suggests that being selective in which results to
combine is vital in building effective ensembles---hence "less is more".
  In this paper we propose SELECT; an ensemble approach for anomaly mining that
employs novel techniques to automatically and systematically select the results
to assemble in a fully unsupervised fashion. We apply our method to event
detection in temporal graphs, where SELECT successfully utilizes five base
detectors and seven consensus methods under a unified ensemble framework. We
provide extensive quantitative evaluation of our approach on five real-world
datasets (four with ground truth), including Enron email communications, New
York Times news corpus, and World Cup 2014 Twitter news feed. Thanks to its
selection mechanism, SELECT yields superior performance compared to individual
detectors alone, the full ensemble (naively combining all results), and an
existing diversity-based ensemble.
