le distribution in the daily scale. Manipulation on those data (e.g. Fig. \[fig:example-ecdf\]) results in a drift or distortion of the distribution, which can be captured to trigger an alarm.

Statistical Divergence Detection with Reference(SDD-R) {#sec:alg-opt-reference}
------------------------------------------------------

From Section \[sec:preliminaries\] we know that statistical divergence only provides a distance between two or more distributions. In a set of data collections, we can only draw a complete graph where nodes denote data collections and edges refer to the symmetric divergence between two connected nodes. From the graph we can find some points that have apparently larger distances with most of other points and return them as anomalies. This may work if anomalous nodes do not compose a large proportion. However the procedure will be too complicated to work out with large amounts of data. If it is assured that data collections form only one cluster, some optimizations can be applied to reduce complexity.

Alternatively we can provide a frame of reference that generates absolute coordinates rather than the relative ones. This optimization is feasible if data collections form one single cluster in distribution space. This is true in most reality scenarios given that distribution is adopted to depict a macro property which comes out as one universal conclusion. In other words , if multiple distributions are used to describe subgroups of entire sample space, then a conclusive one can be obtained by averaging all these sub-distributions. Therefore, we can use an estimate cluster center as reference and test distances between the reference and each other data collections(Algorithm \[alg:sdd-r\]), yielding absolute distances.

Data Collections $\mathbb{D} = \{D_1, \dots, D_n\}$ Estimated anomalous probability $\alpha$ Anomalous Data Collections $P_i \gets$ the distribution of $D_i$ $P_R \gets \frac{1}{n}\sum_{i = 1}^n P_i$ $d_i \gets D(P_i||P_R)$ $\mathcal{N}(\mu, \sigma) \gets$ Gaussian distributi