RareSense: Rarity-Aware Similarity Search for Anomaly Retrieval in Transactional Data

2026-07-30

AI Summary

This work addresses the limitation of traditional similarity measures in sparse set-valued transactional data, where high-frequency attributes dominate and obscure rare, high-order structural anomalies. To overcome this, the authors propose RareSense, a novel framework that introduces minimal rare itemsets and association rules into similarity search for the first time. RareSense constructs a rare rule profile for each object by mining rare association rules and compares profiles using a weighted Jaccard similarity that integrates inverse support, confidence, lift, and structural complexity—ensuring similarity is driven by shared rare evidence rather than common features. Theoretically, the framework generalizes IDF-weighted Jaccard as a special case and induces a pseudometric space over equivalence classes of rule profiles. Experiments demonstrate that RareSense significantly outperforms atomic-level baselines in query retrieval and global anomaly ranking across four cybersecurity and classification benchmark datasets, achieving performance on par with specialized detectors.

Abstract

Similarity search over sparse set-valued data is often dominated by frequent background attributes because classical measures such as Jaccard, cosine, and Hamming compare objects through atomic overlap. IDF (Inverse document frequency) weighting partially reduces this effect but remains atom-wise and cannot explicitly represent informative higher-order co-occurrences. We introduce RareSense, a rarity-aware similarity framework for sparse transactional anomaly data. RareSense mines minimal rare itemsets as intermediate structures, derives reliable rare association rules, maps objects into sparse rare-rule profiles, and compares them using weighted Jaccard similarity. Rule weights combine inverse support, confidence, lift, structural complexity, and stability, so that neighborhoods are determined by shared rare evidence rather than uniform feature overlap. We show that IDF-weighted Jaccard is a restricted singleton case of RareSense, and that the induced distance is a pseudometric on the original objects and a metric over equivalence classes defined by identical rule profiles. Experiments across four benchmark families spanning cybersecurity and general categorical domains show that RareSense attains the highest observed macro-average query-conditioned retrieval performance among the evaluated similarity measures. The statistical analysis indicates significant overall differences, with corrected paired comparisons favoring RareSense over the atomic baselines. The gains remain workload-dependent and are strongest when anomalies share repeatable rare higher-order structure. For global anomaly ranking, RareSense achieves the highest observed macro-average performance while remaining statistically comparable to several strong dedicated detectors.

Problem

• similarity search
• rarity-aware
• anomaly retrieval
• sparse transactional data
• rare itemsets

Innovation

• rarity-aware similarity
• rare itemsets
• association rules
• weighted Jaccard
• anomaly retrieval