pdf吴恩达机器学习courserapdflecture15_W

1、Anomaly detec-onProblem mo-va-onMachine LearningAnomalydetec-on exampleAircra9 engine features:= heat generated= vibra-on intensityDataset:New engine:(heat)Andrew Ng(vibra-on)Densityes-ma-onDataset:Isanomalous?(heat)Andrew Ng(vibra-on)Anomalydetec-on exampleFraud detec-on:= features of users ac-vi-e

2、sModelfrom data.Iden-fy unusual users by checking which haveManufacturingMonitoring computers in a data center.= features of machine= memory use,= CPU load,= number of disk accesses/sec,= CPU load/network trac.Andrew NgAnomaly detec-onGaussian distribu-onMachine LearningGaussian (Normal) distribu-on

3、Say. Ifis a distributed Gaussian with mean, variance.Andrew NgGaussian distribu-on exampleAndrew NgParameter es-ma-onDataset:Andrew NgAnomalydetec-onAlgorithmMachine LearningDensityes-ma-onTraining set:Each example isAndrew NgAnomalydetec-onalgorithm1.Choose featuresthat you think might be indica-ve

4、 ofanomalous examples.Fit parameters2.3.Given new example, compute:Anomaly ifAndrew NgAnomalydetec-on exampleAndrew NgAnomaly detec-onDeveloping and evalua-ng an anomaly detec-on systemMachine LearningThe importance of real-number evalua-onWhen developing a learning algorithm (choosing features, etc

5、.), making decisions is much easier if we have a way of evalua-ng our learning algorithm.Assume we have some labeled data, of anomalous and non-anomalous examples.(if normal,if anomalous).Training set:anomalous)(assume normal examples/notCross valida-on set:Test set:Andrew NgAircraA engines mo-va-ng

6、 example10000good (normal) engines20awed engines (anomalous)Training set: 6000 good enginesCV: 2000 good engines( Test: 2000 good engines), 10 anomalous (), 10 anomalous ()Alterna-ve:Training set: 6000 good enginesCV: 4000 good engines( Test: 4000 good engines), 10 anomalous (), 10 anomalous ()Andre

7、w NgAlgorithm evalua-onFit modelon training setOn a cross valida-on/testexample, predictPossible evalua-on metrics:- True posi-ve, false posi-ve, false nega-ve, true nega-ve- Precision/Recall- F1-scoreCan also use cross valida-on set to choose parameterAndrew NgAnomaly detec-onAnomaly detec-on vs. s

8、upervised learningMachine LearningAnomaly detec-onVery small number ofposi-vevs.Supervised learningLarge number of posi-ve and nega-ve examples.examples( commonLarge number of nega-ve ( examples.Many dierent “types” of). (0-20 is)Enough posi-ve examples foralgorithm to get a sense of what posi-ve ex

9、amples are like, future posi-ve examples likely to be similar to ones in training set.anomalies. Hard for any algorithmto learn from posi-ve exampleswhat the anomalies look like; future anomalies may look nothing like any of the anomalousexamples weve seen so far.Andrew NgAnomaly detec-onvs.Supervis

10、ed learningEmail spam classica-onFraud detec-onWeather predic-on (sunny/rainy/etc).Manufacturing (e.g. aircra9engines)Monitoring machines in a dataCancer classica-oncenterAndrew NgAnomalydetec-onChoosing whatfeatures to useMachine LearningNon-gaussian featuresError analysis for anomaly detec-onWantl

11、arge for normal examples.small for anomalous examplesMost common problem:.is comparable (say, both large) for normaland anomalous examplesMonitoring computers in a data centerChoose features that might take on unusually large or small values in the event of an anomaly.= memory use of computer= numbe

12、r of disk accesses/sec= CPU load= network tracAnomalydetec-onMul-variateGaussiandistribu-onMachine LearningMo-va-ng example: Monitoring machines in a data center(CPU Load)(CPU Load)(Memory Use)Andrew Ng(Memory Use)Mul-variate Gaussian (Normal) distribu-on. Dont modeletc. separately.ModelParameters:a

13、ll in one go.(covariance matrix)Andrew NgMul-variate Gaussian (Normal) examplesAndrew NgMul-variate Gaussian (Normal) examplesAndrew NgMul-variate Gaussian (Normal) examplesAndrew NgMul-variate Gaussian (Normal) examplesAndrew NgMul-variate Gaussian (Normal) examplesAndrew NgMul-variate Gaussian (No

14、rmal) examplesAndrew NgAnomaly detec-onAnomaly detec-on using the mul-variate Gaussian distribu-onMachine LearningMul-variate Gaussian (Normal) distribu-onParametersParameter fng:Given training setAndrew NgAnomaly detec-on with the mul-variate Gaussian1. Fit modelby sefng2. Given a new example, computeFlag an anomaly ifAndrew NgRela-onship tooriginal modelOriginal model:Corresponds to mul-variateGaussianwhereAndrew NgOriginal modelvs.Mul-variate GaussianManually create features tocapture anomalies where take unusual combi