Difference between contextual anomaly and collective anomaly

Question

Contextual and collective anomalies are defined as follows (source):

Contextual Anomalies. If a data instance is anomalous in a specific context (but not otherwise), then it is termed as a contextual anomaly (also referred to as conditional anomaly

Collective Anomalies. If a collection of related data instances is anomalous with respect to the entire data set, it is termed as a collective anomaly. The individual data instances in a collective anomaly may not be anomalies by themselves, but their occurrence together as a collection is anomalous.

Common example of collective anomalies I have seen are breakings of rythim in electrocardiograms

My question is, couldn't this also be seen as a set of contextual anomalies? As I see it, any data instance in the anomalous sequence is also a contextual anomaly (previous and next points are "too flat").

Is there an example of a collective anomaly that cannot be detected using algorithms for detection of contextual anomalies? What are the key differences one needs to consier when approaching contextual anomalies versus collective anomalies?

Answer 1

That ECG timeseries is just one datastream, so it might not be the clearest example. If thinking about the presence of a pattern, I would say that missing a beat is just a regular anomaly. But can also be considered a contextual anomaly, the Y value is normal, but not at that particular point in time. A collective anomaly would require monitoring multiple datastreams, like the heartbeat of multiple persons. A contextual anomaly would require we have access to a different type of data from which we can infer the context.

Let's imagine we have data of the heartbeat for many (1000) persons in a single city. BPM logged every 5 minutes for instance. The overall median BPM across all persons is say 80, and the 1% and 99% percentile say 30 and 180.

A regular anomaly would be if a persons heartbeat value was less than 30 or higher than 180. Like 20 or 230. Example of values that would be normal could be 50 (very relaxed) or 150 (exercising).

However, if the average across all 1000 people would be 150 BPM for one time interval, that is a collective anomaly. While fine individually, it is very unlikely that everyone is exercising at the same time!

And if a person has a BPM of 150 at 5 AM in the morning, that is a likely contextual anomaly. The value is fine in general, but it's very unlikely that a person is exercising in the middle of the night! Here the context is time-of-day.

Or if we have access to the state of the person, and the state == 'resting', and BPM is 150, that is also an contextual anomaly (with context being the persons state) - regardless of the time of day.

Answer 2

In the same paper you mentioned in your question author says right after definitions of types of anomalies:

It should be noted that while point anomalies can occur in any data set, collective anomalies can occur only in data sets in which data instances are related. In contrast, occurrence of contextual anomalies depends on the availability of context attributes in the data. A point anomaly or a collective anomaly can also be a contextual anomaly if analyzed with respect to a context. Thus a point anomaly detection problem or collective anomaly detection problem can be transformed to a contextual anomaly detection problem by incorporating the context information.

So the answer to your first question is yes, this example can be seen as a set of contextual anomalies. In general, if you can define a context then it's a contextual anomaly.

As for the last question, contextual anomalies and collective anomalies are detected with different techniques, which are briefly described in the same paper.