Anomaly Detection in the Presence of Missing Values
  Standard methods for anomaly detection assume that all features are observed
at both learning time and prediction time. Such methods cannot process data
containing missing values. This paper studies five strategies for handling
missing values in test queries: (a) mean imputation, (b) MAP imputation, (c)
reduction (reduced-dimension anomaly detectors via feature bagging), (d)
marginalization (for density estimators only), and (e) proportional
distribution (for tree-based methods only). Our analysis suggests that MAP
imputation and proportional distribution should give better results than mean
imputation, reduction, and marginalization. These hypotheses are largely
confirmed by experimental studies on synthetic data and on anomaly detection
benchmark data sets using the Isolation Forest (IF), LODA, and EGMM anomaly
detection algorithms. However, marginalization worked surprisingly well for
EGMM, and there are exceptions where reduction works well on some benchmark
problems. We recommend proportional distribution for IF, MAP imputation for
LODA, and marginalization for EGMM.
