# Mistake in this Anomaly Detection paper?

While reading the paper Anomaly Detection over Noisy Data using Learned Probability Distributions, I think I have discovered a mistake. On page 3, right column. They say (italic text between brackets is mine):

We measure how likely each element $x_i$ is an outlier (an anomaly) by comparing the difference change in the log likelihood of the distribution if ...

Followed by ($LL$ denotes log-likelihood):

If this difference $(LL_t - LL_{t-1})$ is greater than some value $c$, we declare the element an anomaly and permanently move the element from the majority set to the anomaly set.

Then they provide insight in this principle by saying:

The parameter $c$ affects the number of anomalies that are detected by the system. With very low values of $c$ only the most extreme anomalies are detected while with higher values of $c$ more elements are declared anomalies.

I believe that the last part should be just the opposite: the higher the value of $c$, the harder it becomes for the difference in log-likelihood to reach the threshold, the fewer elements are classified as anomalies. Note that the difference in log-likelihood is defined as the increase of log-likelihood.

I couldn't find anything online stating that the paper indeed has this mistake. Am I missing something, or is it indeed wrong?

• e-mail the authors ..? – Tim Jul 17 '17 at 9:34
• Email sent ;) (After trying to figure out what this guy's up-to-date email address was.) – Martijn Courteaux Jul 17 '17 at 9:48

I agreed with your comment and it does indeed look like the author made a mistake. As "c" is the threshold for the difference between the new (after removing x_i) and the old log likelihood, it would not make sense to say "higher values of c more elements are declared anomalies"

Thanks for reading this paper so carefully. I am the author of the paper. I wrote this paper more than 17 years ago so I don't remember the details! This was one of the first papers I had written as a graduate student and I was not very good at explaining concepts in papers.

Just looking at it quickly, one confusing aspect of the paper is that the log likelihoods are negative and as you add more data they become negative numbers with larger absolute values. So the different is actually a negative number. I think that is partly why that section is confusing.

But you are right in terms of the concept. The more unlikely the distribution becomes the more likely the new datapoint is an anomaly.

• I don't get it: log-likelihood is monotonically increasing with respect to the likelihood: $log(x) > log(y) \iff x > y$. The fact that they these numbers are negative doesn't change my argument I believe. The difference in log likelihood will still be positive if the change made the result more probable. – Martijn Courteaux Jul 24 '17 at 12:23