OIL-AD: An anomaly detection framework for decision-making sequences

Anomaly detection in decision-making sequences is a challenging problem due to the complexity of normality representation learning and the sequential nature of the task. Most existing methods based on Reinforcement Learning (RL) are difficult to implement in the real world due to unrealistic assumptions, such as having access to environment dynamics, reward signals, and online interactions with the environment. To address these limitations, we propose an unsupervised method named Offline Imitation Learning based Anomaly Detection (OIL-AD), which detects anomalies in decision-making sequences using two extracted behaviour features: action optimality and sequential association . Our offline learning model is an adaptation of behavioural cloning with a transformer policy network, where we modify the training process to learn a Q function and a state value function from normal trajectories. We propose that the Q function and the state value function can provide sufficient information about agents’ behavioural data, from which we derive two features for anomaly detection. The intuition behind our method is that the action optimality feature derived from the Q function can differentiate the optimal action from others at each local state, and the sequential association feature derived from the state value function has the potential to maintain the temporal correlations between decisions (state–action pairs). Our experiments show that OIL-AD can achieve outstanding online anomaly detection performance with up to 34.8% improvement in F 1 score over comparable baselines. The source code is available on https://github.com/chenwang4/OILAD . • An offline-imitation-learning-based anomaly detection framework (OIL-AD) is proposed. • OIL-AD is an unsupervised, online detection method, designed for practical implementation. • This paper introduces two behaviour features, action optimality and sequential association. • Action optimality measures whether the agent selects the normal action in each state. • Sequential association characterizes if the agent is making expected sequential decisions.