EnsembleLens supports algorithm engineers and data mining experts in evaluating and selecting anomaly detection algorithms for a given multidimensional dataset. In the absence of ground truth labels, the workflow uses ensemble analysis — generating multiple detection results from heterogeneous algorithms on different feature subspaces — to enable comparative evaluation. Through a macro-meso-micro visual analytics approach, the analyst progressively inspects ensemble component relationships, labels detected anomalies based on domain knowledge, and iteratively refines algorithm importance weights until a stable, interpretable ranking emerges.
The input is a multidimensional dataset (e.g., medical records, chemical properties, biodegradation attributes) with numerical features. The analyst selects a feature bagging method (random, non-redundant, or rotated) and configures six baseline anomaly detection algorithms (oc-SVM, KNN, LOF, ABOD, RCov, iForest) with initial parameter settings. The system generates feature subspaces (two per algorithm by default) and runs each algorithm on its assigned subspace, producing 12 ensemble components — each an outlier score ranking over all data instances.
Pairwise Kendall rank correlations are computed between all ensemble components, along with average correlations and initial equal weights. Three coordinated levels of visualisation are generated: (a) a macro-level global inspection view showing ensemble components clustered in a 2D triangle space by outlier-score similarity, (b) a meso-level correlation matrix with custom glyphs encoding pairwise top-20 outlier comparisons and correlation values, and (c) a micro-level ranking view (available on click) showing detailed outlier score lists with feature value context in a barcode layout. Supporting views include a detector view (hexagonal algorithm importance display with parameter sensitivity), a feature subspace view, and a validation view (parallel coordinates recording all exploration history).
The analyst follows a macro-meso-micro exploration pattern. At the macro level, they identify algorithms whose components are outliers in the clustering (e.g., LOF and ABOD far from the main group). At the meso level, they inspect correlation glyphs for pairs with few crossing lines (low agreement) or many (high agreement). They click a glyph to open the micro-level ranking view comparing two components' top-ranked outliers. Using the dichotomous colour scheme encoding feature values relative to the mean, the analyst judges whether top-ranked instances are plausibly anomalous. They label confirmed anomalies (or confirmed normals) by clicking, and the system updates algorithm weights based on the labelling. Optionally, the analyst tunes algorithm parameters via the detector view, triggering recomputation of affected components. This cycle repeats — inspecting, labelling, updating weights — until the combined weighted ranking stabilises and the analyst is satisfied with the evaluation.
The analyst synthesises findings: which algorithms perform best for this dataset (highest weight), why they perform well (feature subspace inspection, data characteristics matching algorithm strengths), which algorithms fail and under what conditions, and the final combined anomaly ranking. The validation view preserves the full exploration provenance for reproducibility.