Research on email anomaly detection has typically relied on specially prepared datasets that may not adequately reflect the type of data that occurs in industry settings. In our research, at a major financial services company, privacy concerns prevented inspection of the bodies of emails and attachment details (although subject headings and attachment filenames were available). This made labeling possible anomalies in the resulting redacted emails more difficult. Another source of difficulty is the high volume of emails combined with the scarcity of resources making machine learning (ML) a necessity, but also creating a need for more efficient human training of ML models. Active learning (AL) has been proposed as a way to make human training of ML models more efficient. However, the implementation of Active Learning methods is a human-centered AI challenge due to potential human analyst uncertainty, and the labeling task can be further complicated in domains such as the cybersecurity domain (or healthcare, aviation, etc.) where mistakes in labeling can have highly adverse consequences. In this paper we present research results concerning the application of Active Learning to anomaly detection in redacted emails, comparing the utility of different methods for implementing active learning in this context. We evaluate different AL strategies and their impact on resulting model performance. We also examine how ratings of confidence that experts have in their labels can inform AL. The results obtained are discussed in terms of their implications for AL methodology and for the role of experts in model-assisted email anomaly screening.

翻译：关于邮件异常检测的研究通常依赖特殊准备的数据集，这些数据集可能无法充分反映工业场景中实际出现的数据类型。我们在某大型金融服务公司的研究中，因隐私限制无法查看邮件正文和附件详情（尽管标题和附件文件名可用），这使得对截断邮件中的潜在异常进行标注更加困难。另一难点在于邮件量庞大而资源稀缺，迫使必须采用机器学习（ML），但也需要更高效的人工训练ML模型。主动学习（AL）被认为是提高ML模型人工训练效率的方法。然而，由于人类分析员可能存在不确定性，且在某些领域（如网络安全、医疗、航空等）标注错误可能产生严重后果，主动学习方法的实施成为一项以人为中心的人工智能挑战。本文展示了将主动学习应用于截断邮件异常检测的研究成果，比较了不同主动学习方法在该场景下的效用，评估了不同主动学习策略及其对模型性能的影响，并探究了专家对标注的信心评分如何指导主动学习。研究结果从方法论意义及专家在模型辅助邮件异常筛查中的作用两方面进行了讨论。