Searching for Unknown Anomalies in Hierarchical Data Streams

We consider the problem of anomaly detection among a large number of processes, where the probabilistic models of anomalies are unknown. At each time, aggregated noisy observations can be taken from a chosen subset of processes, where the chosen subset conforms to a tree structure. The observation distribution depends on the chosen subset and the absence/presence of anomalies. We develop a sequential search strategy using a hierarchical Kolmogorov-Smirnov (KS) statistics. Referred to as Tree-based Anomaly Search using KS statistics (TASKS), the proposed strategy is order-optimal with respect to the size of the search space and the detection accuracy.