Google uses continuous streams of data from industry partners in order to deliver accurate results to users. Unexpected drops in traffic can be an indication of an underlying issue and may be an early warning that remedial action may be necessary. Detecting such drops is non-trivial because streams are variable and noisy, with roughly regular spikes (in many different shapes) in traffic data. We investigated the question of whether or not we can predict anomalies in these data streams. Our goal is to utilize Machine Learning and statistical approaches to classify anomalous drops in periodic, but noisy, traffic patterns. Since we do not have a large body of labeled examples to directly apply supervised learning for anomaly classification, we approached the problem in two parts. First we used TensorFlow to train our various models including DNNs, RNNs, and LSTMs to perform regression and predict the expected value in the time series. Secondly we created anomaly detection rules that compared the actual values to predicted values. Since the problem requires finding sustained anomalies, rather than just short delays or momentary inactivity in the data, our two detection methods focused on continuous sections of activity rather than just single points. We tried multiple combinations of our models and rules and found that using the intersection of our two anomaly detection methods proved to be an effective method of detecting anomalies on almost all of our models. In the process we also found that not all data fell within our experimental assumptions, as one data stream had no periodicity, and therefore no time based model could predict it.
University of Waterloo（滑铁卢大学）；National Research Council Canada（加拿大国家研究委员会）
Recently, there has been a significant amount of interest in satellite telemetry anomaly detection (AD) using neural networks (NN). For AD purposes, the current approaches focus on either forecasting or reconstruction of the time series, and they cannot measure the level of reliability or the probability of correct detection. Although the Bayesian neural network (BNN)-based approaches are well known for time series uncertainty estimation, they are computationally intractable. In this paper, we present a tractable approximation for BNN based on the Monte Carlo (MC) dropout method for capturing …
CAPMix: Robust KPI Anomaly Detection for AIOps in Noisy and Dynamic Environments
School of Computer Science and Engineering, Beihang University（北京航空航天大学计算机科学与工程学院）；School of Software, Beihang University（北京航空航天大学软件学院）；Shandong Inspur Intelligent Production Technology Co., Ltd（山东 Inspur 智能生产技术有限公司）；Zhongguancun Laboratory（中关村实验室）
Since with massive data growth, the need for autonomous and generic anomaly detection system is increased. However, developing one stand-alone generic anomaly detection system that is accurate and fast is still a challenge. In this paper, we propose conventional time-series analysis approaches, the Seasonal Autoregressive Integrated Moving Average (SARIMA) model and Seasonal Trend decomposition using Loess (STL), to detect complex and various anomalies. Usually, SARIMA and STL are used only for stationary and periodic time-series, but by combining, we show they can detect anomalies with high a…
Univ. Grenoble Alpes（格勒诺布尔阿尔卑斯大学）；ABB Research（ABB研究院）；Beijing Institute of Technology（北京理工大学）；INSA Lyon（里昂国立应用科学学院）；TU Delft（代尔夫特理工大学）
Classification algorithms have been widely adopted to detect anomalies for various systems, e.g., IoT, cloud and face recognition, under the common assumption that the data source is clean, i.e., features and labels are correctly set. However, data collected from the wild can be unreliable due to careless annotations or malicious data transformation for incorrect anomaly detection. In this paper, we extend a two-layer on-line data selection framework: Robust Anomaly Detector (RAD) with a newly designed ensemble prediction where both layers contribute to the final anomaly detection decision. To…
Brown University（布朗大学）；Pacific Northwest National Laboratory（西北太平洋国家实验室）
We propose a Bayesian physics-informed neural network (B-PINN) to solve both forward and inverse nonlinear problems described by partial differential equations (PDEs) and noisy data. In this Bayesian framework, the Bayesian neural network (BNN) combined with a PINN for PDEs serves as the prior while the Hamiltonian Monte Carlo (HMC) or the variational inference (VI) could serve as an estimator of the posterior. B-PINNs make use of both physical laws and scattered noisy measurements to provide predictions and quantify the aleatoric uncertainty arising from the noisy data in the Bayesian framewo…
NTT Communication Science Laboratories（NTT通信科学实验室）；Yahoo Labs（雅虎实验室）
We propose a nonparametric Bayesian probabilistic latent variable model for multi-view anomaly detection, which is the task of finding instances that have inconsistent views. With the proposed model, all views of a non-anomalous instance are assumed to be generated from a single latent vector. On the other hand, an anomalous instance is assumed to have multiple latent vectors, and its different views are generated from different latent vectors. By inferring the number of latent vectors used for each instance with Dirichlet process priors, we obtain multi-view anomaly scores. The proposed model…
Constructing an ensemble from a heterogeneous set of unsupervised anomaly detection methods is challenging because the class labels or the ground truth is unknown. Thus, traditional ensemble techniques that use the response variable or the class labels cannot be used to construct an ensemble for unsupervised anomaly detection. We use Item Response Theory (IRT) -- a class of models used in educational psychometrics to assess student and test question characteristics -- to construct an unsupervised anomaly detection ensemble. IRT's latent trait computation lends itself to anomaly detection becau…
North Carolina State University（北卡罗来纳州立大学）；Intuit Inc.（财捷公司）
Robust anomaly detection is a requirement for monitoring complex modern systems with applications such as cyber-security, fraud prevention, and maintenance. These systems generate multiple correlated time series that are highly seasonal and noisy. This paper presents a novel unsupervised deep learning architecture for multivariate time series anomaly detection, called Robust Seasonal Multivariate Generative Adversarial Network (RSM-GAN). It extends recent advancements in GANs with adoption of convolutional-LSTM layers and an attention mechanism to produce state-of-the-art performance. We condu…
In recent studies, Lots of work has been done to solve time series anomaly detection by applying Variational Auto-Encoders (VAEs). Time series anomaly detection is a very common but challenging task in many industries, which plays an important role in network monitoring, facility maintenance, information security, and so on. However, it is very difficult to detect anomalies in time series with high accuracy, due to noisy data collected from real world, and complicated abnormal patterns. From recent studies, we are inspired by Nouveau VAE (NVAE) and propose our anomaly detection model: Time ser…
Global Energy Interconnection Development and Cooperation Organization（全球能源互联网发展合作组织）；Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Microsoft Research Asia（微软亚洲研究院）
Nowadays, multi-sensor technologies are applied in many fields, e.g., Health Care (HC), Human Activity Recognition (HAR), and Industrial Control System (ICS). These sensors can generate a substantial amount of multivariate time-series data. Unsupervised anomaly detection on multi-sensor time-series data has been proven critical in machine learning researches. The key challenge is to discover generalized normal patterns by capturing spatial-temporal correlation in multi-sensor data. Beyond this challenge, the noisy data is often intertwined with the training data, which is likely to mislead the…
Univ. Grenoble Alpes（格勒诺布尔阿尔卑斯大学）；ABB Corporate Research（ABB企业研究院）；Beijing Institute of Technology（北京理工大学）；INSA Lyon（里昂国立应用科学学院）；TU Delft（代尔夫特理工大学）
Classification algorithms have been widely adopted to detect anomalies for various systems, e.g., IoT, cloud and face recognition, under the common assumption that the data source is clean, i.e., features and labels are correctly set. However, data collected from the wild can be unreliable due to careless annotations or malicious data transformation for incorrect anomaly detection. In this paper, we present a two-layer on-line learning framework for robust anomaly detection (RAD) in the presence of unreliable anomaly labels, where the first layer is to filter out the suspicious data, and the s…
North Carolina State University（北卡罗来纳州立大学）；Intuit AI（Intuit 人工智能）
Robust Anomaly Detection (AD) on time series data is a key component for monitoring many complex modern systems. These systems typically generate high-dimensional time series that can be highly noisy, seasonal, and inter-correlated. This paper explores some of the challenges in such data, and proposes a new approach that makes inroads towards increased robustness on seasonal and contaminated data, while providing a better root cause identification of anomalies. In particular, we propose the use of Robust Seasonal Multivariate Generative Adversarial Network (RSM-GAN) that extends recent advance…
Anomalies are by definition rare, thus labeled examples are very limited or nonexistent, and likely do not cover unforeseen scenarios. Unsupervised learning methods that don't necessarily encounter anomalies in training would be immensely useful. Generative vision models can be useful in this regard but do not sufficiently represent normal and abnormal data distributions. To this end, we propose constant curvature manifolds for embedding data distributions in unsupervised visual anomaly detection. Through theoretical and empirical explorations of manifold shapes, we develop a novel hyperspheri…
Multivariate anomaly detection can be used to identify outages within large volumes of telemetry data for computing systems. However, developing an efficient anomaly detector that can provide users with relevant information is a challenging problem. We introduce our approach to hierarchical multivariate anomaly detection called DeCorus, a statistical multivariate anomaly detector which achieves linear complexity. It extends standard statistical techniques to improve their ability to find relevant anomalies within noisy signals and makes use of types of domain knowledge that system operators co…
Shanghai University of Finance and Economics（上海财经大学）；Carnegie Mellon University（卡内基梅隆大学）
Given a long list of anomaly detection algorithms developed in the last few decades, how do they perform with regard to (i) varying levels of supervision, (ii) different types of anomalies, and (iii) noisy and corrupted data? In this work, we answer these key questions by conducting (to our best knowledge) the most comprehensive anomaly detection benchmark with 30 algorithms on 57 benchmark datasets, named ADBench. Our extensive experiments (98,436 in total) identify meaningful insights into the role of supervision and anomaly types, and unlock future directions for researchers in algorithm se…
Noise-Resilient Point-wise Anomaly Detection in Time Series Using Weak Segment Labels
University of California, Santa Cruz（加州大学圣克鲁兹分校）；Hong Kong Baptist University（香港浸会大学）；Squirrel AI（松鼠AI）；RIPED, CNPC（中国石油天然气集团公司石油勘探开发研究院）；DUT（大连理工大学）；BIAI, ZJUT（浙江工业大学人工智能研究院）；D5 Data（数澜科技）
Cornell University（康奈尔大学）；University of California, Davis（加利福尼亚大学戴维斯分校）
We consider the problem of detecting a few targets among a large number of hierarchical data streams. The data streams are modeled as random processes with unknown and potentially heavy-tailed distributions. The objective is an active inference strategy that determines, sequentially, which data stream to collect samples from in order to minimize the sample complexity under a reliability constraint. We propose an active inference strategy that induces a biased random walk on the tree-structured hierarchy based on confidence bounds of sample statistics. We then establish its order optimality in …
Detecting the Undetectable: Enhancing Unsupervised time series Anomaly Detection via Active Learning
LG CNS；Department of Industrial & Management Engineering, Korea University（高丽大学产业与管理工程系）；Department of Industrial Engineering, Seoul National University（首尔大学工业工程系）
Wireless Sensor Networks (WSNs) have become increasingly valuable in various civil/military applications like industrial process control, civil engineering applications such as buildings structural strength monitoring, environmental monitoring, border intrusion, IoT (Internet of Things), and healthcare. However, the sensed data generated by WSNs is often noisy and unreliable, making it a challenge to detect and diagnose anomalies. Machine learning (ML) techniques have been widely used to address this problem by detecting and identifying unusual patterns in the sensed data. This survey paper pr…
Low-Power, Neuromorphic, Acoustic Anomaly Detection for Persistent Machine Monitoring
Los Alamos National Laboratory（洛斯阿拉莫斯国家实验室）；AeroVironment, Inc（AeroVironment公司）；University of New Mexico COSMIAC Research Center（新墨西哥大学COSMIAC研究中心）；Air Force Research Laboratory（空军研究实验室）
Duke University（杜克大学）；University of Illinois at Urbana-Champaign（伊利诺伊大学厄巴纳-香槟分校）；Stanford University（斯坦福大学）；University of California, Merced（加利福尼亚大学默塞德分校）
This paper describes a methodology for detecting anomalies from sequentially observed and potentially noisy data. The proposed approach consists of two main elements: (1) {\em filtering}, or assigning a belief or likelihood to each successive measurement based upon our ability to predict it from previous noisy observations, and (2) {\em hedging}, or flagging potential anomalies by comparing the current belief against a time-varying and data-adaptive threshold. The threshold is adjusted based on the available feedback from an end user. Our algorithms, which combine universal prediction with rec…
Anomaly Detection via Mean Shift Density Enhancement
School of Data Science, Indian Institute of Science Education and Research（数据科学学院，印度科学教育与研究学院）；Institute of Computer Science, University of Rostock（计算机科学研究所，罗斯托克大学）；Leibniz-Institute for Food Systems Biology, Technical University of Munich（食品系统生物学莱比锡研究所，慕尼黑技术大学）；Stellenbosch Institute of Advanced Studies (STIAS)（斯托尔波茨堡高级研究 institute (STIAS)）
Applied AI Institute, Deakin University（迪肯大学应用人工智能研究所）
Temporal anomaly detection looks for irregularities over space-time. Unsupervised temporal models employed thus far typically work on sequences of feature vectors, and much less on temporal multiway data. We focus our investigation on two-way data, in which a data matrix is observed at each time step. Leveraging recent advances in matrix-native recurrent neural networks, we investigated strategies for data arrangement and unsupervised training for temporal multiway anomaly detection. These include compressing-decompressing, encoding-predicting, and temporal data differencing. We conducted a co…
Time series anomaly detection is extensively studied in statistics, economics, and computer science. Over the years, numerous methods have been proposed for time series anomaly detection using deep learning-based methods. Many of these methods demonstrate state-of-the-art performance on benchmark datasets, giving the false impression that these systems are robust and deployable in many practical and industrial real-world scenarios. In this paper, we demonstrate that the performance of state-of-the-art anomaly detection methods is degraded substantially by adding only small adversarial perturba…
COGNOS: Universal Enhancement for Time Series Anomaly Detection via Constrained Gaussian-Noise Optimization and Smoothing
School of Information Science and Technology, Beijing University of Technology, China（信息科学与技术学院，北京理工大学，中国）；Beijing Key Laboratory of Computational Intelligence and Intelligent System, Beijing University of Technology, China（北京计算智能与智能系统重点实验室，北京理工大学，中国）
Enhancing Network Anomaly Detection with Quantum GANs and Successive Data Injection for Multivariate Time Series
Department of Computer Engineering（计算机工程系）；Polytechnique Montreal（蒙特利尔理工学院）；Department of Compute Engineering（计算机工程系）；Department of Computer Science（计算机科学系）；Université de Sherbrooke（谢布鲁克大学）
Purdue University（普渡大学）；Amazon Web Services（亚马逊云科技）
We propose an outlier robust multivariate time series model which can be used for detecting previously unseen anomalous sounds based on noisy training data. The presented approach doesn't assume the presence of labeled anomalies in the training dataset and uses a novel deep neural network architecture to learn the temporal dynamics of the multivariate time series at multiple resolutions while being robust to contaminations in the training dataset. The temporal dynamics are modeled using recurrent layers augmented with attention mechanism. These recurrent layers are built on top of convolutiona…
University of Waterloo（滑铁卢大学）；National Research Council of Canada（加拿大国家研究委员会）
In this paper, we use a variance-based genetic ensemble (VGE) of Neural Networks (NNs) to detect anomalies in the satellite's historical data. We use an efficient ensemble of the predictions from multiple Recurrent Neural Networks (RNNs) by leveraging each model's uncertainty level (variance). For prediction, each RNN is guided by a Genetic Algorithm (GA) which constructs the optimal structure for each RNN model. However, finding the model uncertainty level is challenging in many cases. Although the Bayesian NNs (BNNs)-based methods are popular for providing the confidence bound of the models,…
KU Leuven（鲁汶大学）；Samsung AI Center（三星人工智能中心）；Tencent AI lab（腾讯人工智能实验室）；Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳））
Supervised learning can be viewed as distilling relevant information from input data into feature representations. This process becomes difficult when supervision is noisy as the distilled information might not be relevant. In fact, recent research shows that networks can easily overfit all labels including those that are corrupted, and hence can hardly generalize to clean datasets. In this paper, we focus on the problem of learning with noisy labels and introduce compression inductive bias to network architectures to alleviate this over-fitting problem. More precisely, we revisit one classica…
A Parameter-Efficient Quantum Anomaly Detection Method on a Superconducting Quantum Processor
Centre for Computational Science, Department of Chemistry, University College London, UK（伦敦大学学院计算科学中心）；Department of Computer Science, Tufts University, Medford, USA（塔夫茨大学计算机科学系）；Guanghua School of Management, Peking University, Beijing, China（北京大学光华管理学院）；Advanced Research Computing Centre, University College London, UK（伦敦大学学院先进计算中心）；Institute for Informatics, University of Amsterdam, The Netherlands（阿姆斯特丹大学信息学院）
