Usad

Abstract

The automatic supervision of IT systems is a current challenge at Orange. Given the size and complexity reached by its IT operations, the number of sensors needed to obtain measurements over time, used to infer normal and abnormal behaviors, has increased dramatically making traditional expert-based supervision methods slow or prone to errors. In this paper, we propose a fast and stable method called UnSupervised Anomaly Detection for multivariate time series (USAD) based on adversely trained autoencoders. Its autoencoder architecture makes it capable of learning in an unsupervised way. The use of adversarial training and its architecture allows it to isolate anomalies while providing fast training. We study the properties of our methods through experiments on five public datasets, thus demonstrating its robustness, training speed and high anomaly detection performance. Through a feasibility study using Orange's proprietary data we have been able to validate Orange's requirements on scalability, stability, robustness, training speed and high performance.

SOPA‐GA‐CNN: Synchronous optimisation of parameters and architectures by genetic algorithms with convolutional neural network blocks for securing Industrial Internet‐of‐Things

“…For SWaT dataset, we compare the following state‐of‐the‐art methods: DNN [52], SVM [52], TABOR [53], MAD‐GAN [54], LSTM‐VAE [55], USAD [50], GDN [56], ResNet‐101, and VGG16, DenseNet‐121, and two neuroevolution‐based approaches, CNN 1D [34] and GA‐CNN‐IDS [5], to further demonstrate the superiority of our auto‐designed SOPA‐GA‐CNN model. CNN 1D [34] is a neuroevolution‐based IDS framework for SWaT and WADI where the search space containing the layer types and ensemble subgroups is explored by GA. GA‐CNN‐IDS [5] is a GA‐based IDS framework validated on NSL‐KDD [57] that automatically optimises the connection between the CNN layers of the model.…”

“…The detailed comparison results are shown in Table 6, where the best performance values are in bold. Although the Precision obtained by SOPA‐GA‐CNN is slightly inferior to GDN [56], DNN [52], USAD [50] and MAD‐GAN [54], it is still better than other competitors, especially the other two neuroevolution‐based methods. The Recall value obtained by SOPA‐GA‐CNN is only inferior to LSTM‐VAE [55].…”

“…To speed up the training process, both datasets are downsampled at a ten‐second rate by taking the median values. Referring to the work [50], we deployed the point‐adjust on both datasets. For supervised scenarios, we evaluated SOPA‐GA‐CNN on BoT‐IoT, Gas Pipeline and Power System Attack Dataset with the multi‐classification tasks.…”

“…For the WADI dataset, the detailed comparison results of the proposed SOPA-GA-CNN and the state-of-the-art methods are shown in Table 7, where the best values are shown in bold. In the case of unsupervised learning, we consider the following methods: LSTM-VAE [55], USAD [50], GDN [56], MAD-GAN [54], ResNet-101, VGG16, DenseNet-121, and two neuroevolution-based approaches: CNN 1D [34] and GA-CNN-IDS [5] for comparison. Although the Recall value is inferior to DenseNet-121, VGG16, ResNet-101 and GA-CNN-IDS [5], the Precision value obtained by SOPA-GA-CNN is only slightly inferior to GDN [56] and significantly superior to other competitors.…”

Unsupervised Deep Learning for IoT Time Series

“…[127] Reconstruction-based Reconstruction errors of an LTSM-based autoencoder are used as the anomaly score. [128] Reconstruction-based A weighted sum of the reconstruction errors of two adversarially-trained autoencoders is used as the anomaly score. [129] Reconstruction-based It learns representations more meaningful for anomaly detection through the process of reconstruction.…”