1. Algorithm
2. evaluating an anomaly detection system
3. anomaly detection vs supervised learning
4. choose what features to use.
- choose the features xi which hist(xi) is like gaussian shape, or transfer xi such as log(xi+c) to make hist(xi) to be like gaussian shape.
- if anomaly case's feature is almost like normal case's feature, try to use some new features to distinguish these two cases.
5. multivariate gaussian distribution
the figure below shows the greed point is an anomaly case while it will be justified as normal without using multivariate gaussian distribution
multivariate gaussian distribution
6. anomaly detection using multivariate gaussian distribution
7. original model vs multivariate gaussian distribution
