A Deep Neural Network for Unsupervised Anomaly Detection and Diagnosis in Multivariate Time Series Data

Abstract

Nowadays, multivariate time series data are increasingly collected in various real world systems, e.g., power plants, wearable devices, etc. Anomaly detection and diagnosis in multivariate time series refer to identifying abnormal status in certain time steps and pinpointing the root causes. Building such a system, however, is challenging since it not only requires to capture the temporal dependency in each time series, but also need encode the inter-correlations between different pairs of time series. In addition, the system should be robust to noise and provide operators with different levels of anomaly scores based upon the severity of different incidents. Despite the fact that a number of unsupervised anomaly detection algorithms have been developed, few of them can jointly address these challenges. In this paper, we propose a Multi-Scale Convolutional Recurrent Encoder-Decoder (MSCRED), to perform anomaly detection and diagnosis in multivariate time series data. Specifically, MSCRED first constructs multi-scale (resolution) signature matrices to characterize multiple levels of the system statuses in different time steps. Subsequently, given the signature matrices, a convolutional encoder is employed to encode the inter-sensor (time series) correlations and an attention based Convolutional Long-Short Term Memory (ConvLSTM) network is developed to capture the temporal patterns. Finally, based upon the feature maps which encode the inter-sensor correlations and temporal information, a convolutional decoder is used to reconstruct the input signature matrices and the residual signature matrices are further utilized to detect and diagnose anomalies. Extensive empirical studies based on a synthetic dataset and a real power plant dataset demonstrate that MSCRED can outperform state-ofthe-art baseline methods.

Mobility Irregularity Detection with Smart Transit Card Data

“…The LSTM with the Nonparametric Dynamic Thresholding uses LSTM for multivariate time series prediction and defines a reconstructed error threshold based on historical error mean and variance. -MSCRED [16]. The Multi-Scale Convolutional Recurrent Encoder-Decoder encodes the correlation matrix for multivariate time series and uses the residual reconstructed matrix to detect a fraud.…”

“…Cao et al [2] and Xu et al [13] propose variation-auto-encoder based models with extensive experiments. Zhang et al [16] detect fraud on reconstructed residual correlation matrix. LSTM-NDT [6] and OmniAnomaly [12] adopt dynamic thresholding on reconstructed feature errors.…”

“…Finally, similarity-based algorithms are used to compare different passenger patterns. The similarity function can either be measured by a statistical distance metric between the normal and fraud data, or defined by a reconstruction error derived from an encoder-decoder structure [6,13,16]. Therefore, a reference passenger pattern can be discriminated from a potential irregular/fraudulent pattern.…”

Visual Analytics of Anomalous User Behaviors: A Survey

“…For example, Malhotra et al [124] develop a Long Short Term Memory Networks based Encoder-Decoder scheme for Anomaly Detection (EncDec-AD) that is able to uncover predictable, unpredictable, periodic, and aperiodic in long and short time series. Anomalies in multivariate time-series data are uncovered using a Multi-Scale Convolutional Recurrent Encoder-Decoder (MSCRED) [125], which can capture dynamics and encode the inter-correlations between different pairs of time series.…”

Unsupervised Anomaly Detection of Healthcare Providers Using Generative Adversarial Networks

“…Anomalies are defined as patterns in data that do not conform to expected or normal behaviour [11]. The finding of such patterns is often referred to as anomaly detection [11,29,31]. Different anomaly detection techniques may be applied depending on the nature of the data.…”