Cluster-based local outlier factor (CBLOF) detects outliers by combining cluster membership with distance to relevant cluster centers. It is especially useful when records form meaningful groups and outlierness is better judged relative to those groups than to the full dataset. section 6.6 section 7.8
CBLOF proceeds through several practical decisions:
- Cluster every observation, commonly with K-means in PyOD, although any clustering algorithm may be used. section 6.6
- Label clusters as large or small using tunable alpha and beta parameters. section 6.6
- Score points in large clusters by their distance to the cluster center; evaluate points in small clusters relative to the nearest large cluster center. section 6.6
- Use PyOD’s default nearest-large-center distance, or include cluster sizes with use_weights for behavior closer to the original formulation. section 6.6
Small and large clusters
With three clusters, C1, C2, and C3, points in the small C3 cluster may be scored against the nearby large C2 center even when they lie close to C3’s own center. This reflects the possibility that C3 is a subcluster or a clustering artifact. section 6.6
CBLOF depends on the clustering quality. Extreme values can distort clustering and cause masking or swamping; adding ten extreme training values reduced a reported AUROC from 0.79 to 0.52. Cleaning strong outliers beforehand and testing detector robustness are therefore important. section 8.5.5
Figure 6.12 The idea behind CBLOF. The data is divided into three clusters, C1, C2, and C3. As C3 is a small cluster, it can be more reasonable to evaluate the points in C3 relative to the closest large cluster, C2. Given a different clustering of this data, these points could have been included in C2 in any case.
Compare the three-cluster arrangement visually to see why a small cluster may be evaluated against a nearby large cluster rather than its own center. section 6.6
