Anomaly Detection via Estimated Mutual Information and Its Relationship to the GLRT.

The problem of detecting an anomaly based on two sets of data, the first one that is assumed to represent a quiescent condition, and the second that may contain an anomaly, is addressed. Using estimated mutual information as a discriminating indicator of change, a detector is configured and interpreted, with the changing parameter modeled as the outcome of a random variable. The relationship of the proposed detector to the standard generalized likelihood ratio test is also examined. It is found that the resulting approach merges concepts in information theory, for which a Bayesian assumption is made for the underlying change parameter, with classical decision theory, for which a frequentist assumption for the change parameter is utilized.