WisCon: Active Ensemble Anomaly Detection

• WisCon is an active ensemble learning method for contextual anomaly detection that combines multiple candidate contexts, instead of relying on a single predetermined context.
• It employs X-means clustering on contextual subspaces and Isolation Forest on behavioral attributes, enabling robust detection through adaptive context evaluation.
• Active learning via Low Confidence Anomaly sampling selectively identifies informative anomalies, refining context importance and improving detection with limited labels.

WisCon, short for “Wisdom of the Contexts,” is an active ensemble learning method for contextual anomaly detection designed for settings in which the true contextual and behavioral attributes are unknown, there may be multiple useful contexts, and a single pre-specified context is inadequate for uncovering all anomaly types (Calikus et al., 2021). It addresses the central difficulty of contextual anomaly detection: an object can be anomalous only within a specific context, even when it appears normal in the global feature space or in many subspaces. The method therefore replaces the search for one “right” context with an ensemble of candidate contexts, learns their relative usefulness from a small labeling budget, prunes harmful contexts, and aggregates contextual anomaly scores with learned importance weights.

1. Problem setting and formal definitions

Contextual anomaly detection distinguishes between contextual attributes, which describe environment or conditions, and behavioral attributes, which describe the behavior of interest. A contextual anomaly is a point whose behavior is atypical among points with similar context. The motivating examples include house heating, where high heat consumption in winter is normal but in summer it is anomalous, and high flow rate of hot water, which is only anomalous given similar heat consumption as context (Calikus et al., 2021).

The formal setting begins with an unlabeled dataset $U \in \mathbb{R}^{n \times d}$, with feature set $F = \{f_1,\dots,f_d\}$. A context $C$ is defined such that $C \subset F$, the corresponding behavior is $B = F \setminus C$, and both $C$ and $B$ are non-empty. The paper defines the “true context” $C^\prime$ as the context that represents the actual ground-truth contextual attributes in a dataset, while also emphasizing that $C^\prime$ is usually unknown in practice (Calikus et al., 2021).

Given a context $C$ and a point $F = \{f_1,\dots,f_d\}$0, the reference group $F = \{f_1,\dots,f_d\}$1 is the set of points that share similarity with $F = \{f_1,\dots,f_d\}$2 with respect to $F = \{f_1,\dots,f_d\}$3. The contextual anomaly score $F = \{f_1,\dots,f_d\}$4 then quantifies the deviation of $F = \{f_1,\dots,f_d\}$5 from its reference group with respect to behavioral attributes $F = \{f_1,\dots,f_d\}$6. An oracle $F = \{f_1,\dots,f_d\}$7 returns the true label $F = \{f_1,\dots,f_d\}$8, where $F = \{f_1,\dots,f_d\}$9 denotes anomaly and $C$0 denotes normal. The central task is “Active Multi-Context Anomaly Detection”: given unlabeled data $C$1, unknown true context $C$2, an oracle $C$3, and a budget $C$4, the goal is to produce a contextual anomaly score for each point in $C$5 after obtaining $C$6 labels, such that anomaly detection performance is maximized (Calikus et al., 2021).

This formulation is notable because it does not assume prior knowledge of which features are contextual and which are behavioral. It also explicitly allows the possibility that different anomaly types are exposed by different contexts, rather than by a single globally valid contextual split.

2. Context generation and base contextual detectors

WisCon assumes a set of candidate contexts $C$7 and constructs a contextual detector for each one. In the reported experiments, context generation is exhaustive for low-dimensional data: when $C$8, all possible contexts are considered, yielding $C$9 non-trivial partitions. For high-dimensional data, PCA is first applied to reduce the dimensionality to 10 components, and contexts are then formed on those components to keep the number of contexts computationally manageable (Calikus et al., 2021).

For each context $C \subset F$0, WisCon splits the features into contextual attributes $C \subset F$1 and behavioral attributes $C \subset F$2. It then applies X-means clustering on the contextual subspace $C \subset F$3 to obtain clusters $C \subset F$4, each of which serves as a reference group. Within each reference group, an Isolation Forest is trained using only the behavioral features. The resulting anomaly scores are collected into a score vector $C \subset F$5, and a “unification” procedure transforms the raw scores into probability-like values in $C \subset F$6 so that they are comparable across contexts (Calikus et al., 2021).

After processing all candidate contexts, WisCon obtains a score matrix $C \subset F$7, where column $C \subset F$8 is $C \subset F$9. This stage is entirely unsupervised. Its purpose is not yet to decide which contexts are useful, but to construct a large pool of context-specific anomaly views that can later be assessed by active learning.

A key empirical claim of the method is that most candidate contexts are poor, a small number perform well, and the distributions of per-context AUC-PR values are highly skewed. This directly motivates the later weighting and pruning stages: equal treatment of all contexts is not appropriate (Calikus et al., 2021).

3. Active learning and the Low Confidence Anomaly strategy

WisCon uses active learning not primarily to train a pointwise classifier, but to determine which contexts are useful. At each iteration, up to a label budget $B = F \setminus C$0, it selects an unlabeled instance according to a query strategy $B = F \setminus C$1, obtains its oracle label, computes a sample weight $B = F \setminus C$2, and updates each context’s detection error and importance score (Calikus et al., 2021). The paper expresses the objective as

$B = F \setminus C$3

Several query strategies are considered. Random sampling selects points uniformly at random. Query-by-committee uses the set of contextual detectors as a committee, with disagreement measured by either consensus entropy or average KL divergence. Most-likely anomalous sampling selects points flagged as anomalous by the largest weight mass of contexts. The paper reports that these conventional strategies are not ideal for the target setting of rare useful contexts and severe class imbalance (Calikus et al., 2021).

The method’s distinctive contribution is Low Confidence Anomaly (LCA) sampling. The empirical observation behind LCA is that many true anomalies are detected as anomalous in only a small fraction of contexts, whereas false positives are often anomalous in many contexts. The paper terms anomalies detected by only a small fraction of contexts “low confidence anomalies.” These anomalies are informative because the few contexts that detect them are likely to be the truly useful ones (Calikus et al., 2021).

For an unlabeled sample $B = F \setminus C$4, each context produces a binary prediction

$B = F \setminus C$5

where the threshold $B = F \setminus C$6 is chosen to keep false positives below $B = F \setminus C$7. WisCon then computes the importance-weighted anomaly probability

$B = F \setminus C$8

and the margin rate

$B = F \setminus C$9

The margin is largest near $C$0, where the ensemble is maximally divided between normal and anomalous judgments (Calikus et al., 2021).

LCA samples according to

$C$1

where $C$2 is a bias factor, set to $C$3 in the experiments, and $C$4. This biases selection toward high-margin points while preserving exploration. To prevent normal points from dominating context evaluation, LCA uses sample weights

$C$5

Consequently, only labeled anomalies influence context importance, and anomalies near the margin have greater impact than easy anomalies detected by almost all contexts (Calikus et al., 2021).

The paper’s interpretation is explicit: maximizing the number of anomalies labeled is not sufficient. What matters is labeling anomalies that are informative about which contexts are uniquely helpful.

4. Context importance, pruning, and ensemble aggregation

Once labels are acquired, WisCon evaluates each context as if it were a weak learner. For context $C$6, the weighted detection error after $C$7 labels is

$C$8

with

$C$9

This is the weighted fraction of misclassified labeled points under that context (Calikus et al., 2021).

The final importance score is then defined in AdaBoost style: $B$0 Contexts with low error receive high positive weights, while contexts with $B$1 receive non-positive or negative weights. WisCon prunes all contexts with negative importance scores. The remaining score vectors $B$2 are combined by importance-weighted averaging: $B$3 This produces the final anomaly score for each point (Calikus et al., 2021).

The significance of this construction is twofold. First, it rejects the assumption that all automatically generated contexts should contribute equally. Second, it converts a large and mostly noisy set of context-specific detectors into an adaptive ensemble that emphasizes contexts aligned with labeled anomalies and suppresses misleading ones. The paper further argues that naïve averaging dilutes strong contexts with weak ones, whereas max aggregation tends to inherit false positives from every context (Calikus et al., 2021).

5. Experimental evaluation and empirical findings

The reported empirical study uses 18 datasets: 4 synthetic datasets, 2 real datasets with injected contextual anomalies, and 12 real datasets with real anomalies. The synthetic sets include single-context and multiple-context constructions, high-dimensional data with $B$4, and a dataset containing global rather than contextual anomalies. The real injected datasets are El Nino and Houses. The real anomaly datasets include Abalone, ANN-Thyroid, Arrhythmia, Letter Recognition, Mammography, Optdigits, Pendigits, Satellite/Satimage, Thyroid, Vowels, and Yeast (Calikus et al., 2021).

Evaluation uses AUC-ROC and AUC-PR. Active baselines include iForest-AAD, Active-RF, Active-KNN, and Active-SVM. Unsupervised contextual baselines include ROCOD, ConOut, CAD, iForest-Con, LOF-Con, and OCSVM-Con. Unsupervised non-contextual baselines include iForest, LOF, OCSVM, LODA, SOD, and Feature Bagging (Calikus et al., 2021).

Against active baselines, WisCon has the best average rank across datasets for budgets $B$5 and for both AUC-PR and AUC-ROC. Its advantage is especially pronounced at small budgets. On large datasets such as Synthetic1, El Nino, Houses, and Mammography, active classifiers and AAD struggle with few labels, whereas WisCon already attains high AUC-PR. Friedman tests reject equivalence of methods, with $B$6-values as low as $B$7, and Nemenyi critical difference plots show WisCon significantly better than most active baselines, particularly under label scarcity (Calikus et al., 2021).

Against unsupervised baselines, WisCon achieves the highest average rank over single-context contextual methods, the multi-context method ConOut, and general non-contextual detectors. This remains true even though the single-context contextual baselines are given the “true context” or the best context found by exhaustive search or PCA, which the paper treats as a substantial advantage. Pairwise Wilcoxon tests show WisCon significantly better than iForest-Con, OCSVM-Con, and ROCOD in at least 12 of 18 datasets (Calikus et al., 2021).

Ablation analyses reinforce the method’s central claims. LCA improves rapidly and saturates early, often near maximum performance at budget below 100, and is consistently better than random, query-by-committee, and most-likely anomalous sampling. WisCon’s full ensemble outperforms both WisCon-Single, which uses only the single context with highest learned importance, and WisCon-True, which uses the best single context. On Synthetic 2, which contains three distinct true contexts with different anomaly sets, single-context variants are clearly inferior, and the ensemble is essential (Calikus et al., 2021).

These results support the paper’s stated hypothesis that there is no single perfect context that successfully uncovers all kinds of contextual anomalies, and that leveraging multiple contexts is necessary.

6. Assumptions, limitations, and relation to adjacent methods

WisCon assumes that not all features are contextual, that multiple possible contexts exist, that true anomalies are rare, that oracle labels are correct, that clustering in context space yields meaningful reference groups, and that Isolation Forest is a reasonable detector in behavioral space (Calikus et al., 2021). The paper does not provide formal guarantees such as convergence or sample-complexity bounds; its analysis is largely empirical.

The main scalability issue is the exponential number of possible contexts, $B$8. The proposed mitigation is PCA to 10 components for $B$9, but this may lose information relevant for some anomalies. Computational cost also arises from running X-means clustering and per-cluster Isolation Forests for each context, and from recomputing errors and importance scores for all contexts during active learning (Calikus et al., 2021).

Hyperparameter guidance is reported explicitly. For X-means, maximum numbers of clusters $C^\prime$0 were tested, with $C^\prime$1 used by default unless it yielded very small clusters, in which case $C^\prime$2 was used. Isolation Forest used 100 estimators and max samples of 256. The anomaly threshold for binary prediction was $C^\prime$3, and the LCA bias factor was $C^\prime$4 (Calikus et al., 2021).

In relation to adjacent research areas, WisCon is described as a data-centered ensemble in which each base detector operates on a different context-behavior partition but uses the same base algorithm. It differs from model-centered ensembles, which combine different algorithms on the same data, and from generic subspace anomaly methods such as LODA, SOD, and Feature Bagging, which do not distinguish context from behavior and do not use reference groups (Calikus et al., 2021). It also differs from active anomaly discovery approaches that aim mainly to maximize the number of anomalies shown to an analyst. Here, active learning is used at a meta-level to learn which contexts are useful.

The method is presented as suitable for smart buildings and energy monitoring, industrial sensor networks and predictive maintenance, fraud detection, and healthcare or patient monitoring—domains in which multiple plausible context definitions exist, anomalies are context-dependent, and a modest amount of labeling is possible (Calikus et al., 2021). A plausible implication is that WisCon is most valuable when the principal modeling difficulty is not merely detecting outliers, but identifying the contextual regimes under which different forms of abnormality become visible.