Framework for selecting thresholds for anomaly detection models and generating quantitative explanations

A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:

• computing outlier scores for each feature of a data set received at a computing system, wherein each outlier score corresponds to a z-normalized distance value computed for subsequences of a time-series portion of the data set;
• determining Boolean transactions based on the outlier scores by dividing the outlier scores into bins representing discrete threshold ranges per feature and generating, for each timestamp, a Boolean transaction indicating whether each feature's outlier score falls within a corresponding bin;
• performing a frequent pattern mining on the Boolean transactions to generate item sets comprising conjunctions of feature-bin pairs having support greater than or equal to a minimum support threshold and risk ratio greater than or equal to a predefined risk ratio value;
• sorting the item sets based on one or more of support, risk ratios of the item sets, and/or cardinalities of the item sets;
• identifying outlier score threshold ranges per features based on the selected item sets;
• and
• generating explanations by mapping feature-outlier ranges to feature-value ranges by filtering timestamp indexes of a distance profile vector corresponding to values within the threshold ranges and obtaining subsequences related to those timestamp indexes to determine minimum and maximum feature values for each feature-value range.