Moment-Based Anomaly Detection in High-Dimensional Mixed Data

Davide Ferrari; Andrea Nicolodi

stat.MLOct 12, 2026

Moment-Based Anomaly Detection in High-Dimensional Mixed Data

Authors: Davide Ferrari, Andrea Nicolodi

Organizations: Free University of Bozen–Bolzano, Italy · University of Trento, Italy

Abstract

We propose an anomaly detection method for high-dimensional mixed-type data that maps heterogeneous features to a common scale via standardized moment-based transformations, yielding interpretable feature-level anomaly scores. These scores are combined through a dependence-aware aggregation step to construct the Mixed-data Influence (MDI) score, accounting for correlations across features and providing a unified measure of how strongly an observation departs from the reference data distribution. By incorporating higher-order moments, the MDI can detect anomalies that arise not only from location shifts, but also from changes in variability, skewness, and other distributional characteristics. The aggregation mechanism allows our method to capture both sparse anomalies concentrated in a small number of features and weak, coordinated deviations distributed across many features. We empirically investigate the distribution and thresholding behavior of the MDI score across different sample sizes, dimensions, dependence structures, and data types. Simulation experiments and two real-data applications, to multi-omics and ESG data, evaluate finite-sample calibration, detection performance, and feature-level interpretability.

Figures & tables

	Block correlation				AR(1) correlation
$k$	$d=20$	$d=30$	$d=200$	$d=300$	$d=20$	$d=30$	$d=200$	$d=300$
Balanced mix (baseline): A:B:C:D = 25:25:25:25
0	0.032	0.035	0.042	0.042	0.027	0.034	0.054	0.055
2	0.728	0.598	0.081	0.078	0.748	0.565	0.076	0.058
3	0.956	0.937	0.813	0.756	0.955	0.951	0.820	0.776
4	0.978	0.981	0.983	0.984	0.979	0.985	0.988	0.980

Table 1: Monte Carlo estimates of Type I error (

k=0

) and power (

k>\in\{2,3,4\}

) for the global test with size

\alpha=0.05

under dense shift contamination regime. For

k\in\{2,3,4\}

, all features are contaminated according to

\boldsymbol{\theta}_{j}^{(i)}=\boldsymbol{\theta}_{0j}+\boldsymbol{\Delta}_{j}^{(i)}

, where

\boldsymbol{\Delta}_{j}^{(i)}=\mathbf{J}_{0j}^{1/2}\mathbf{h}_{j}

and

\mathbf{h}_{j}=10\boldsymbol{1}/d^{1/k}

j\leq d

. The row

k=0

corresponds to the null model, with

\mathbf{h}_{j}=\boldsymbol{0}

for all

j\leq d

. Results are reported for different proportions of variable types: Normal (A), Skew-Normal (B), Poisson (C) and categorical (D) under block and AR(1) correlation structures. Results are based on

1000

Monte Carlo sample of size

n=150

	Block correlation				AR(1) correlation
$s/d$	$d=20$	$d=30$	$d=200$	$d=300$	$d=20$	$d=30$	$d=200$	$d=300$
Balanced mix (baseline): A:B:C:D = 25:25:25:25
0	0.035	0.034	0.045	0.040	0.025	0.038	0.051	0.056
0.1	0.894	0.923	0.990	0.996	0.907	0.919	0.992	0.998
0.2	0.962	0.985	0.999	0.998	0.975	0.985	0.999	1.000
0.3	0.995	0.995	1.000	1.000	0.984	0.992	1.000	1.000

Table 2: Monte Carlo estimates of Type I error (

s/d=0

) and power (

s/d>0

) for the global test at nominal level

\alpha=0.05

under the sparse shift contamination regime. For

s>0

, a subset

\mathcal{S}\subset{1,\ldots,d}

s

features is selected at random in each replication. The contaminated features satisfy

\boldsymbol{\theta}_{j}^{(i)}=\boldsymbol{\theta}_{0j}+\boldsymbol{\Delta}_{j}^{(i)}

, where

\boldsymbol{\Delta}_{j}^{(i)}=\mathbf{J}_{0j}^{1/2}\mathbf{h}_{j}

and

\mathbf{h}_{j}=10,\boldsymbol{1}

for

j\in\mathcal{S}

, while

\mathbf{h}_{j}=\boldsymbol{0}

for

j\notin\mathcal{S}

. The row

s/d=0

corresponds to the null model. Results are reported for different proportions of variable types: Normal (A), Skew-Normal (B), Poisson (C), and categorical (D), under block and AR(1) correlation structures. Based on

1000

Monte Carlo replications with sample size

n=150

Panel of Figure 1 — Figure 1: Densities of the standardized test statistic $MDI(\boldsymbol{\boldsymbol{X}}^{\star})$ under $H_{0}$ (histograms and solid kernel density estimates) and under the alternative hypothesis (dashed kernel density estimates) for $d\in\{100,500,1000\}$ (rows). The left and right columns correspond to mean and variance contamination, respectively. Contaminated features are generated from $\mathcal{N}(3,1)$ and $\mathcal{N}(0,5)$ , while uncontaminated features follow $\mathcal{N}(0,1)$ . In all settings, $5\%$ of the features are contaminated. Results are based on $1000$ Monte Carlo replications with sample size $n=750$ .

Figure 2: Empirical distributions of the MDI statistic for CLL multi-omics data subsets. Histograms and solid kernel density estimates correspond to IGHV-mutated subjects, and dashed kernel density estimates to IGHV-unmutated subjects. Scores are computed using the

102

IGHV-mutated subjects as the reference set.The vertical dotted line indicates the standard-normal threshold (

z_{0.90}

), corresponding to (

\alpha=0.10)

Figure 3: Heatmaps for the average feature-wise contributions. For each patient (rows) and omic feature (columns), color intensity corresponds to the weighted absolute contribution $|\delta^{\star}_{j}|$ averaged across 100 random data splits. The top panel shows the IGHV-mutated group (clean data), while the bottom panel shows the IGHV-unmutated group (outliers). The bottom row of each panel reports the across-patient mean for each feature. For visualization purposes, heatmap values were capped at the 99th-percentile threshold.

Figure 4: Analysis of the 127 controversy-exposed financial institutions. Left: distribution of firm-level MDI scores; the histogram and solid kernel density estimate correspond to controversy-exposed firms, the dashed curve denotes the standard normal density, and the vertical dotted line marks the 0.95 standard-normal quantile as a visual reference. Right: two-dimensional MDS visualization of the three clusters obtained by applying Ward’s method to firms’ KPI-level contribution profiles. The KPI-specific moments, covariance estimates, and dependence-adjusted aggregation weights are estimated from the controversy-free reference sample.

Anomaly Detection

Anomaly detection finds rare or unexpected patterns in data, from defective products and system faults to fraud and security threats.

See all 654 papers

Detect, Explain, Interpret: An End-to-End Benchmark for Time Series Anomaly Detection, Explainability and Interpretability
Oct 1, 2026Roberto Stanzione, Jules Barbe, Magali Parrino +2Interpretable Anomaly Detection Anomaly Localization
Inria, ENS, CNRS, PSL Paris, France · Scality Paris, France · Inria, ENS, CNRS, PSL, EDF Paris, France
Masked Diffusion Modeling for Anomaly Detection
May 28, 2026Lixing Zhang, Yuchen Liang, Liyan XieMasked Diffusion Models Tabular Anomaly Detection
University of Minnesota · Ohio State University
Kurtosis-Guided Denoising Score Matching for Tabular Anomaly Detection
May 7, 2026Victor Livernoche, Jie Zan, Reihaneh RabbanyTabular Anomaly Detection Unsupervised Anomaly Detection
McGill University, Mila, Montréal, Canada

Oct 1, 2026J/K move · Enter open · S save

Detect, Explain, Interpret: An End-to-End Benchmark for Time Series Anomaly Detection, Explainability and Interpretability

Roberto Stanzione, Jules Barbe, Magali Parrino, Jérémie Fourmann+1

Inria, ENS, CNRS, PSL Paris, France · Scality Paris, France · Inria, ENS, CNRS, PSL, EDF Paris, France

Interpretable Anomaly Detection Anomaly Localization Time-Series Anomaly Detection

Open paper AskPDF arXiv

Time Series Anomaly Detection has received increasing attention, driven by the growing availability of complex time series data. This surge has led to the development of numerous detection methods, as well as a variety of benchmarks aimed at thoroughly evaluating their performance. However, most existing detectors remain largely agnostic to domain context, overlooking explainability and interpretability. One of the main reasons for this gap is that current benchmarks primarily focus on detection accuracy, and only few of them evaluate spatial explainability. Moreover, no benchmark currently provides sufficiently rich semantic annotations to support the generation of human-understandable interpretations of anomalies. To address these limitations, we introduce SHAD (Scality High-dimensional Anomaly Detection benchmark), a fully annotated benchmark composed of 215 multivariate, high-dimensional time series collected from real-world distributed cloud storage systems operated by Scality. The proposed dataset includes rich contextual information, covering three families of anomalies with varying degrees of severity. As further contribution, we provide a foundation for future work by evaluating baseline methods for Detection, Explainability, and Interpretability, covering all stages of a TSAD pipeline. For Detection, we benchmark a wide range of existing anomaly detectors, testing their effectiveness on the proposed real-world dataset. Then, we consider explainability by evaluating whether measuring the contribution of each dimension in the generated anomaly score can provide accurate anomaly attributions. Finally, for interpretability, we investigate the effectiveness of frozen LLM baselines in localizing and interpreting anomalies.

Abstract

Anomaly Detection

Explore similar work

Detect, Explain, Interpret: An End-to-End Benchmark for Time Series Anomaly Detection, Explainability and Interpretability

Masked Diffusion Modeling for Anomaly Detection

Kurtosis-Guided Denoising Score Matching for Tabular Anomaly Detection