Robust Anomaly Detection for Multivariate Time Series through Stochastic Recurrent Neural Network

Su, Ya; Zhao, Youjian; Niu, Chenhao; Liu, Rong; Sun, Wei; Pei, Dan

doi:10.1145/3292500.3330672

Cited by 751 publications

(563 citation statements)

References 15 publications

Supporting

Mentioning

476

Contrasting

Unclassified

Order By: Relevance

“…Concatenate t (1) , t (2) , t (3) and t (4) , and express as t = [t (1) , t (2) , t (3) , t (4) ], then a data set including 4 known subsequences is generated by the following formula…”

Section: A Simulation Setupmentioning

confidence: 99%

“…T Here has been a growing recognition of the value of time series data because many applications, such as anomaly detection [1], [2], working condition perception [3], [4] and soft measurement [5], [6], [7], are being enabled by the rapid development of data driven algorithms. Time series segmentation is to partition a given time series into subsequences which are internally homogeneous [8].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Segmentation of Multivariate Industrial Time Series Data Based on Dynamic Latent Variable Predictability

Huang

2020

IEEE Access

View full text Add to dashboard Cite

Time series segmentation is an important vehicle of data mining and extensively applied in the areas of machine learning and anomaly detection. In real world tasks, dynamics widely exist in time series but have been little concerned. This paper proposes an algorithm which can partition a multivariate time series into subsequences at points where the dynamics change. In process industries, the change of dynamics often relates to operation regime change, working condition shifting or faults. Therefore, to segment time series according to change of dynamics can be useful in data preprocessing and getting deep insight of the process in various industrial process monitoring tasks. The proposed algorithm recursively merges neighborhood subsequences through a heuristic bottom-up procedure. The cost of merging is defined as the mutual predictability of the subsequence models which are constructed using the dynamic-inner principal component analysis algorithm. Then, the goal becomes finding the segmentation scheme which minimizes the averaged dynamic prediction errors of each subsequence model. The proposed algorithm is evaluated on both simulated data and the time series data collected from an industrial processing plant. The results show that it outperforms the static principal component analysis based methods. INDEX TERMS time series analysis, time series prediction, time series segmentation, change point detection, dynamic inner model, dynamic principal component analysis

show abstract

“…Concatenate t (1) , t (2) , t (3) and t (4) , and express as t = [t (1) , t (2) , t (3) , t (4) ], then a data set including 4 known subsequences is generated by the following formula…”

Section: A Simulation Setupmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Segmentation of Multivariate Industrial Time Series Data Based on Dynamic Latent Variable Predictability

Huang

2020

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Zhang et al [16] detect fraud on reconstructed residual correlation matrix. LSTM-NDT [6] and OmniAnomaly [12] adopt dynamic thresholding on reconstructed feature errors. Despite great effectiveness, these approaches tend to underperform in our task due to high intra-class variance of normal data, where one passenger's normal records can be irregular/fraudulent for others.…”

Section: Related Workmentioning

confidence: 99%

Mobility Irregularity Detection with Smart Transit Card Data

Wang

Yao

Liu

et al. 2020

Advances in Knowledge Discovery and Data Mining

View full text Add to dashboard Cite

Identifying patterns and detecting irregularities regarding individual mobility in public transport system is crucial for transport planning and law enforcement applications (e.g., fraudulent behavior). In this context, most of recent approaches exploit similarity learning through comparing spatial-temporal patterns between normal and irregular records. However, they are limited in utilizing passenger-level information. First, all passenger transits are fused in a certain region at a timestamp whereas each passenger has own repetitive stops and time slots. Second, these differences in passenger profile result in high intraclass variance of normal records and blur the decision boundaries. To tackle these problems, we propose a modelling framework to extract passenger-level spatial-temporal profile and present a personalised similarity learning for irregular behavior detection. Specifically, a route-tostop embedding is proposed to extract spatial correlations between transit stops and routes. Then attentive fusion is adopted to uncover spatial repetitive and time invariant patterns. Finally, a personalised similarity function is learned to evaluate the historical and recent mobility patterns. Experimental results on a large-scale dataset demonstrate that our model outperforms the state-of-the-art methods on recall, F1 score and accuracy. Raw features and the extracted patterns are visualized and illustrate the learned deviation between the normal and the irregular records.

show abstract

“…Stochastic gradient variational bayes (SGVB) [21] is a variational inference algorithm commonly applied in VAE to tune the parameters φ and θ and maximizes the evidence of lower bound (ELBO) [29], L(x t ):…”

Section: Basics Of a Variant Of Rnn -Gru Vae Sgvb And Planar Nfmentioning

confidence: 99%

“…Second, VAE is applied to map observations (i.e., input observations in x−space) to stochastic (i.e., z−space) variables. Third, to model temporal dependence among stochastic variables explicitly in the latent space, a connection technique called linear Gaussian state-space model (SSM) is applied to connect between stochastic variables and the concatenation of stochastic variables and GRU hidden variables [29]. Lastly, to help stochastic variables in qnet (described hereafter) capture complex distributions of input data, Planar NF is also applied to grasp non-Gaussian posterior distributions in latent stochastic space.…”

Section: Basics Of a Variant Of Rnn -Gru Vae Sgvb And Planar Nfmentioning

confidence: 99%

ECSD: Enhanced Compromised Switch Detection in an SDN-Based Cloud Through Multivariate Time-Series Analysis

Dinh

Park

2020

IEEE Access

View full text Add to dashboard Cite

Nowadays, Software-Defined Networks (SDNs) are increasingly being used in many practical settings, posing a variety of security risks, such as compromised switches. Once a switch is compromised by an attacker, the switch may be either malfunctioning or misconfigured, displaying some abnormal network behaviors, e.g., delaying, dropping, adding, or modifying the traffic. In our previous work, we proposed an efficient scheme for detecting compromised SDN switches based on chaotic analysis of network traffic using an autoregressive-integrated-moving-average model. This scheme showed good results overall; however, it still showed high false-alarm rates due to a hard-set threshold. In this paper, we propose an enhanced scheme to detect compromised SDN switches effectively and reliably. The scheme consists of two phases (online and offline), leveraging the advantages of a stochastic recurrent neural network variant of multivariate time-series-based anomaly detection. Our main idea is to capture the normal patterns of multivariate time series by learning strong representations with the key techniques, such as planar normalizing flow and stochastic variable connection, then reconstruct input data by the representations, and use the reconstruction probabilities to find anomalies. Evaluation results of our proposed scheme yield outstanding performance in comparison with our previous work and other solutions.

show abstract

Robust Anomaly Detection for Multivariate Time Series through Stochastic Recurrent Neural Network

Cited by 751 publications

References 15 publications

Segmentation of Multivariate Industrial Time Series Data Based on Dynamic Latent Variable Predictability

Segmentation of Multivariate Industrial Time Series Data Based on Dynamic Latent Variable Predictability

Mobility Irregularity Detection with Smart Transit Card Data

ECSD: Enhanced Compromised Switch Detection in an SDN-Based Cloud Through Multivariate Time-Series Analysis

Contact Info

Product

Resources

About