Semi-supervised learning combines labeled records with a larger pool of unlabeled data. In outlier detection, it uses labels about which records should receive high scores to improve predictions, especially for outliers similar to those already seen. section 15.4 section 15.6
A practical workflow is:
- Label flagged records, and consider labeling records just below the flagging threshold. A label expresses whether similar records should score highly in the future—not merely whether a record is statistically unusual or proved important during investigation. section 15.4 section 15.6
- Wait until enough labels have accumulated to train a useful model. Strong systems may require thousands of labeled outliers, so this approach is often more feasible after a detector has been running for some time. section 15.4
- Use the resulting scores alongside unsupervised outlier detection. Classification can improve scores for familiar kinds of relevant outlier, but it handles novel records poorly. section 15.4 section 15.6
Labels can also support rules, classifiers, and regression tests. These serve different purposes: rules and classifiers sort known kinds of records, while tests check that known outliers still score highly after a model is retuned. section 15.0 section 15.6
