Existing anomaly detection methods tend to utilize a large amount of training data to learn patterns of normal data for effective anomaly identification, but such methods typically incur substantial training time overhead. Considering that unlabeled data often contains a lot of redundant information, selecting and utilizing a small yet representative subset instead of the entire dataset can significantly improve training efficiency while maintaining detection performance. To this end, we introduce an end-to-end reinforcement learning framework with a balanced sampling strategy that targets both normal and abnormal instances. This framework identifies and exploits potential anomalies in the unlabeled data while sampling peripheral normal instances (often difficult to detect), thereby enhancing the overall anomaly detection performance without requiring excessive time for the sampling process. Additionally, we present a joint reward mechanism, combined with inconsistency penalties, which optimizes both an agent's action space and the representation space, ultimately improving the quality of the sampling process. Extensive experiments on four public datasets from different domains demonstrate the effectiveness and efficiency of our framework. The code is available at https://github.com/ZhouF-ECNU/READ.

Integrated payment platforms have significantly improved the convenience of daily life, yet they also present a fertile ground for fraudulent behavior. This paper focuses on the detection of anomalous merchants at the transaction level on such platforms, as locating specific anomalous patterns at such a granular level aids in taking corresponding security measures. However, in an integrated payment scenario, a limited number of imprecise labels are accessed at the merchant level rather than the transaction level, thus rendering transaction-level anomaly detection quite difficult. Meanwhile, the collected data comprises not only normal merchants and target anomalies (of interest) but also non-target anomalies (of lesser interest). To address these challenges, we adopt a two-step approach. First, we cluster merchants exhibiting similar behaviors and filter out potential non-target anomalies to better understand the transactional patterns among normal merchants. Then, we learn transaction representations encapsulated within hyperspheres, considering three key aspects: transaction context, historical information, and merchant information; and leverage such representations to determine anomaly scores for individual transactions. Real-world transactions from an integrated payment platform were used in the experiments. The results demonstrate that our model outperforms several state-of-the-art baselines, with an average AUPRC improvement of 10.5%-11.6%, 16.5%-16.7%, and 3.7%-5.4% in the three discovered merchant clusters.

Anomaly detection has emerged as a prominent research area with extensive exploration across various applications. Existing methods predominantly focus on detecting all anomalies exhibiting unusual patterns, however, they overlook the critical need to prioritize the detection of target anomaly categories (anomalies of primary interest) that could pose significant threats to various systems. This oversight results in the excessive involvement of valuable human labor and resources in dealing with non-target anomalies (that are of lower interest). This work is focused on target-class anomaly detection, which entails overcoming several challenges: (1) deficient prior information regarding non-target anomalies and (2) an elevated false positive rate caused by the presence of non-target anomalies. Thus, we introduce a novel semi-supervised model, called TargAD, which leverages a few labeled target anomalies, along with potential non-target anomaly candidates and normal candidates selected from unlabeled data. By introducing a novel loss function, TargAD effectively maximizes the distributional differences among normal candidates, target anomalies, and non-target anomaly candidates, leading to a significant improvement in detecting target anomalies. Furthermore, when confronted with novel non-target anomaly scenarios, TargAD maintains its accuracy in detecting target anomalies. We conducted extensive experiments, the results of which demonstrate that TargAD outperforms eleven state-of-the-art baselines on a real-world dataset and three publicly available datasets, with average AUPRC improvements of 5.9%-24.8%, 9.2%-57.8%, 2.7%-71.3%, and 2.0%-70.3%, respectively.

Communication intrusion detection in Advanced Metering Infrastructure (AMI) is an eminent security technology to ensure the stable operation of the Smart Grid. However, methods based on traditional machine learning are not appropriate for learning high-dimensional features and dealing with the data imbalance of communication traffic in AMI. To solve the above problems, we propose an intrusion detection scheme by combining feature dimensionality reduction and improved Long Short-Term Memory (LSTM). The Stacked Autoencoder (SAE) has shown excellent performance in feature dimensionality reduction. We compress high-dimensional feature input into low-dimensional feature output through SAE, narrowing the complexity of the model. Methods based on LSTM have a superior ability to detect abnormal traffic but cannot extract bidirectional structural features. We designed a Bi-directional Long Short-Term Memory (BiLSTM) model that added an Attention Mechanism. It can determine the criticality of the dimensionality and improve the accuracy of the classification model. Finally, we conduct experiments on the UNSW-NB15 dataset and the NSL-KDD dataset. The proposed scheme has obvious advantages in performance metrics such as accuracy and False Alarm Rate (FAR). The experimental results demonstrate that it can effectively identify the intrusion attack of communication in AMI.