Symposium on Machine Learning for Anomaly Detection

Final Report for NSF Grant IIS-0442128

Stephen Bay and Pat Langley
Institute for the Study of Learning and Expertise
2164 Staunton Court, Palo Alto, CA 94306

The Symposium on Machine Learning for Anomaly Detection was held at Stanford University on May 22 and 23rd, 2004. Over 30 researchers attended the meeting, of which 11 participants, all known for their work in this area, presented talks on their recent results. The symposium fostered discussion between scientists working on anomaly detection in disparate domains and provided a forum where they could meet to share their experiences and approaches. The role of machine learning was the central theme of the meeting and the speakers discussed many common issues such as representation, cost functions, and controlling false positives.

We organized the symposium into talks and discussions over two consective days. We also dedicated a session of the second day to the issues of improving research on anomaly detection within the broader machine learning community. Below we summarize the contents for each speaker's presentation in the order given. This information, together with slides and references to what each author judged to be his or her most relevant paper, can be found on the symposium Web site at

The presentations covered an interesting variety of machine learning techniques that directly or indirectly build models of normal behavior and use this to detect abnormalities. Several common issues arose in the talks, including the need for developing explanations of the anomalies, dealing with domains that involve multiple time scales, and ensuring robustness to violations of modeling assumptions.

The participants also discussed strategies for improving the visibility of anomaly detection research within the greater communities of machine learning, data mining, and knowledge discovery. Proposed strategies included encouraging researchers to make extra effort to cite relevant technical work even if the domain of application is different from their own, targeting journals for special issues, and planning follow-up meetings on the topic. With respect to the last point, several attendees of the symposium are co-organizing a workshop on anomaly detection at the Eleventh ACM SIGKDD International Conference on Knowledge Discovery and Data Mining in 2005. The proposed workshop has been accepted and its Web page can be found at

In summary, the Symposium on Machine Learning for Anomaly Detection encouraged the interchange of knowledge among researchers who have been addressing different applications that are nevertheless unified by their interest in learning models from data which can then be used to detect anomalies. Informal discussions during the meeting also suggested promising directions for future research in this increasingly important area of machine learning. Participants agreed that the symposium served important functions and expressed strong interest in continuing their interactions in additional meetings.