Labeled data consists of records marked with what they represent or how they should be handled. In outlier detection, a useful minimum is a binary label: a record of interest or a record not of interest. More specific labels can distinguish types of outliers. A label about future scoring is not necessarily a judgment that a record is statistically unusual or that an investigation found it important. section 15.5 section 15.6
Labels become useful as flagged records are reviewed:
- Categorize investigated records so recurring types can be tracked and investigated together. section 15.0
- Keep examples of both records of interest and records not of interest; reviewed records can accumulate into a training set over time. section 4.3.3 section 15.5
- Retain known cases for regression tests when detectors, features, parameters, or ensemble methods change. section 15.5
When classification becomes feasible
Suppose machinery has failed before, and logs are available from periods before failures and from normal operation. If simple rules cannot distinguish them, those labeled cases may support a classifier. The obstacle is often the supply of failure examples: rare events may yield enough cases in a very large dataset, but not necessarily enough to learn reliably, especially when many distinct error types must be recognized. section 4.3.3
With enough reviewed records, labels can support classifiers or semisupervised methods that score familiar kinds of outliers more accurately. Strong semisupervised systems may require thousands of labeled outliers and still use unsupervised detectors. Classification-based methods are less suited to novel cases, so they need not replace detectors aimed at finding previously unseen patterns. section 15.4 section 15.6
Labeled records also provide a practical check after retraining: known outliers should still score highly, without too many records labeled not of interest receiving high scores. This matters when data or detection goals change, even if the underlying detectors remain the same. section 15.5
