Anomaly detection is crucial for understanding unusual behaviors in data, as anomalies offer valuable insights. This paper introduces Dependency-based Anomaly Detection (DepAD), a general framework that utilizes variable dependencies to uncover meaningful anomalies with better interpretability. DepAD reframes unsupervised anomaly detection as supervised feature selection and prediction tasks, which allows users to tailor anomaly detection algorithms to their specific problems and data. We extensively evaluate representative off-the-shelf techniques for the DepAD framework. Two DepAD algorithms emerge as all-rounders and superior performers in handling a wide range of datasets compared to nine state-of-the-art anomaly detection methods. Additionally, we demonstrate that DepAD algorithms provide new and insightful interpretations for detected anomalies.
LPCVAE: A Conditional VAE with Long-Term Dependency and Probabilistic Time-Frequency Fusion for Time Series Anomaly Detection
Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China（中国科学院大学网络安全学院）
VISTA: Unsupervised 2D Temporal Dependency Representations for Time Series Anomaly Detection
Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；University of Glasgow（格拉斯哥大学）；University College London（伦敦大学学院）；Collaborative Innovation Center for Transport Studies, Dalian Maritime University（大连海事大学交通协同创新中心）；Department of Electric Engineering, Tsinghua University（清华大学电机工程系）；Shenzhen Skyworth AI Co. ,Ltd（深圳创维人工智能有限公司）
Unveiling the Unseen: A Comprehensive Survey on Explainable Anomaly Detection in Images and Videos
Department of Electrical and Computer Engineering, Northeastern University（电气与计算机工程系，东北大学）；School of Data Science, University of Virginia（数据科学学院，弗吉尼亚大学）；Department of Electrical and Computer Engineering and Khoury College of Computer Science, Northeastern University（电气与计算机工程系和Khoury计算机科学学院，东北大学）
Research and application of Transformer based anomaly detection model: A literature review
Huazhong University of Science and Technology（华中科技大学）；School of Cyber Science and Engineering（网络科学与工程学院）；School of Artificial Intelligence and Automation（人工智能与自动化学院）
Shanghai University of Finance and Economics（上海财经大学）；Carnegie Mellon University（卡内基梅隆大学）
Given a long list of anomaly detection algorithms developed in the last few decades, how do they perform with regard to (i) varying levels of supervision, (ii) different types of anomalies, and (iii) noisy and corrupted data? In this work, we answer these key questions by conducting (to our best knowledge) the most comprehensive anomaly detection benchmark with 30 algorithms on 57 benchmark datasets, named ADBench. Our extensive experiments (98,436 in total) identify meaningful insights into the role of supervision and anomaly types, and unlock future directions for researchers in algorithm se…
National University of Defense Technology（国防科技大学）；College of Computer Science and Technology（计算机科学与技术学院）；Institute for Quantum Information（量子信息研究所）
Anomaly detection of multivariate time series is meaningful for system behavior monitoring. This paper proposes an anomaly detection method based on unsupervised Short- and Long-term Mask Representation learning (SLMR). The main idea is to extract short-term local dependency patterns and long-term global trend patterns of the multivariate time series by using multi-scale residual dilated convolution and Gated Recurrent Unit(GRU) respectively. Furthermore, our approach can comprehend temporal contexts and feature correlations by combining spatial-temporal masked self-supervised representation l…
As large-scale time-series data can easily be found in real-world applications, multivariate time-series anomaly detection has played an essential role in diverse industries. It enables productivity improvement and maintenance cost reduction by preventing malfunctions and detecting anomalies based on time-series data. However, multivariate time-series anomaly detection is challenging because real-world time-series data exhibit complex temporal dependencies. For this task, it is crucial to learn a rich representation that effectively contains the nonlinear temporal dynamics of normal behavior. …
George Washington University（乔治华盛顿大学）；Rutgers University（罗格斯大学）；Shandong University（山东大学）
Many real-world IoT systems, which include a variety of internet-connected sensory devices, produce substantial amounts of multivariate time series data. Meanwhile, vital IoT infrastructures like smart power grids and water distribution networks are frequently targeted by cyber-attacks, making anomaly detection an important study topic. Modeling such relatedness is, nevertheless, unavoidable for any efficient and effective anomaly detection system, given the intricate topological and nonlinear connections that are originally unknown among sensors. Furthermore, detecting anomalies in multivaria…
Rethinking Weak Supervision in Anomaly Detection: A Comprehensive Benchmark
Shanghai University of Finance and Economics（上海金融学院）；Ant Group（蚂蚁集团）；Key Laboratory of Interdisciplinary Research of Computation and Economics（计算与经济交叉学科重点实验室）
Since with massive data growth, the need for autonomous and generic anomaly detection system is increased. However, developing one stand-alone generic anomaly detection system that is accurate and fast is still a challenge. In this paper, we propose conventional time-series analysis approaches, the Seasonal Autoregressive Integrated Moving Average (SARIMA) model and Seasonal Trend decomposition using Loess (STL), to detect complex and various anomalies. Usually, SARIMA and STL are used only for stationary and periodic time-series, but by combining, we show they can detect anomalies with high a…
Macquarie University（麦考瑞大学）；Academy of Mathematics and Systems Science, Chinese Academy of Sciences（中国科学院数学与系统科学研究院）；Rutgers, the State University of New Jersey（罗格斯，新泽西州立大学）；Carnegie Mellon University（卡内基梅隆大学）
Anomalies represent rare observations (e.g., data records or events) that deviate significantly from others. Over several decades, research on anomaly mining has received increasing interests due to the implications of these occurrences in a wide range of disciplines. Anomaly detection, which aims to identify rare observations, is among the most vital tasks in the world, and has shown its power in preventing detrimental events, such as financial fraud, network intrusion, and social spam. The detection task is typically solved by identifying outlying data points in the feature space and inheren…
Graph Neural AI with Temporal Dynamics for Comprehensive Anomaly Detection in Microservices
Boston University（波士顿大学）；Carnegie Mellon University（卡内基梅隆大学）；University of California, San Diego（加利福尼亚大学圣迭戈分校）；Hofstra University（霍夫斯特拉大学）；University of Southern California（南加州大学）
RobustMAD: Evaluating Real-World Robustness of Multimodal Small Language Models for Deployable Anomaly Detection Assistants
Singapore University of Technology and Design（新加坡科技设计大学）；Agency for Science, Technology and Research (A*STAR)（新加坡科技研究局）；Nanyang Technological University（南洋理工大学）；Chongqing University（重庆大学）
Deep Learning Advancements in Anomaly Detection: A Comprehensive Survey
Lassonde School of Engineering, York University（约克大学拉松德工程学院）；Huazhong University of Science and Technology（华中科技大学）；School of Computer Science and Engineering, Nanyang Technological University（南洋理工大学计算机科学与工程学院）
Nowadays, advanced intrusion detection systems (IDSs) rely on a combination of anomaly detection and signature-based methods. An IDS gathers observations, analyzes behavioral patterns, and reports suspicious events for further investigation. A notorious issue anomaly detection systems (ADSs) and IDSs face is the possibility of high false alarms, which even state-of-the-art systems have not overcome. This is especially a problem with large and complex systems. The number of non-critical alarms can easily overwhelm administrators and increase the likelihood of ignoring future alerts. Mitigation …
ChronoGraph: A Real-World Graph-Based Multivariate Time Series Dataset
Bitdefender；University of Bucharest（布加勒斯特大学）；University of Stuttgart（斯图加特大学）；International Max Planck Research School for Intelligent Systems（智能系统国际马克斯·普朗克研究学校）
SHU-UTS SILC Business School, Shanghai University（上海大学悉尼工商学院）；SHU-SUCG Research Centre for Building Industrialization（上海建工集团建筑工业化研究中心）；Shanghai Tunnel Engineering Co., Ltd（上海隧道工程有限公司）
Time-series anomaly detection plays a vital role in monitoring complex operation conditions. However, the detection accuracy of existing approaches is heavily influenced by pattern distribution, existence of multiple normal patterns, dynamical features representation, and parameter settings. For the purpose of improving the robustness and guaranteeing the accuracy, this research combined the strengths of negative selection, unthresholded recurrence plots, and an extreme learning machine autoencoder and then proposed robust anomaly detection for time-series data (RADTD), which can automatically…
Foundation Models for Anomaly Detection: Vision and Challenges
School of Computing Technologies, RMIT University（计算技术学院，皇家墨尔本理工大学）；STEM, the University of South Australia（STEM，南澳大利亚大学）；School of Computing and Information Systems, University of Melbourne（计算与信息学院，墨尔本大学）；CSIRO's Data61（CSIRO的数据61）
Detecting anomalies in large complex systems is a critical and challenging task. The difficulties arise from several aspects. First, collecting ground truth labels or prior knowledge for anomalies is hard in real-world systems, which often lead to limited or no anomaly labels in the dataset. Second, anomalies in large systems usually occur in a collective manner due to the underlying dependency structure among devices or sensors. Lastly, real-time anomaly detection for high-dimensional data requires efficient algorithms that are capable of handling different types of data (i.e. continuous and …
University of Toronto（多伦多大学）；Vector Institute（向量研究所）；Zalando Research（Zalando研究院）；Morgan Stanley（摩根士丹利）；Technical University of Munich（慕尼黑工业大学）；Amazon Research（亚马逊研究院）
We introduce a novel, practically relevant variation of the anomaly detection problem in multi-variate time series: intrinsic anomaly detection. It appears in diverse practical scenarios ranging from DevOps to IoT, where we want to recognize failures of a system that operates under the influence of a surrounding environment. Intrinsic anomalies are changes in the functional dependency structure between time series that represent an environment and time series that represent the internal state of a system that is placed in said environment. We formalize this problem, provide under-studied publi…
NUS（新加坡国立大学）；Institute for Infocomm Research (IR) A*STAR（新加坡科技研究局资讯通信研究院）
Anomaly detection in multi-variate time series (MVTS) data is a huge challenge as it requires simultaneous representation of long term temporal dependencies and correlations across multiple variables. More often, this is solved by breaking the complexity through modeling one dependency at a time. In this paper, we propose a Time-series Representational Learning through Contrastive Predictive Coding (TRL-CPC) towards anomaly detection in MVTS data. First, we jointly optimize an encoder, an auto-regressor and a non-linear transformation function to effectively learn the representations of the MV…
We discuss how VMware is solving the following challenges to harness data to operate our ML-based anomaly detection system to detect performance issues in our Software Defined Data Center (SDDC) enterprise deployments: (i) label scarcity and label bias due to heavy dependency on unscalable human annotators, and (ii) data drifts due to ever-changing workload patterns, software stack and underlying hardware. Our anomaly detection system has been deployed in production for many years and has successfully detected numerous major performance issues. We demonstrate that by addressing these data chal…
CCE: Confidence-Consistency Evaluation for Time Series Anomaly Detection
Pengcheng Laboratory, Shenzhen, Guangdong, 518066, China（鹏城实验室，深圳，广东，518066，中国）；School of Future Technology, South China University of Technology, Guangzhou, Guangdong 510650, China（未来技术学院，华南理工大学，广州，广东 510650，中国）；School of Computer Science and Engineering, South China University of Technology, Guangzhou, Guangdong 510650, China（计算机科学与工程学院，华南理工大学，广州，广东 510650，中国）；Department of Computer Science, Hong Kong Baptist University, Hong Kong SAR, China（计算机科学系，香港 Baptist 大学，香港特别行政区，中国）
Technische Universität Kaiserslautern（凯泽斯劳滕工业大学）；BASF SE（巴斯夫股份公司）；Bosch AI（博世人工智能）；Technische Universität Dortmund（多特蒙德工业大学）；ABB Corporate Research Center Ladenburg（ABB拉登堡企业研究中心）；University of California Irvine（加州大学欧文分校）；Fraunhofer ITWM（弗劳恩霍夫工业数学研究所）；Technische Universität München（慕尼黑工业大学）
This paper provides the first comprehensive evaluation and analysis of modern (deep-learning) unsupervised anomaly detection methods for chemical process data. We focus on the Tennessee Eastman process dataset, which has been a standard litmus test to benchmark anomaly detection methods for nearly three decades. Our extensive study will facilitate choosing appropriate anomaly detection methods in industrial applications.
BenchReAD: A systematic benchmark for retinal anomaly detection
The Center for Smart Health, School of Nursing, the Hong Kong Polytechnic University, Hong Kong, China（香港理工大学护理学院智能健康中心）；School of Biomedical Engineering, Tsinghua University, Beijing, China（清华大学生物医学工程学院）；Research Center for Medical AI, Shenzhen Institute of Advanced Technology, Chinese Academy of Sciences, Shenzhen, China（中国科学院深圳先进技术研究院医学人工智能研究中心）
A Comprehensive Study of Machine Learning Techniques for Log-Based Anomaly Detection
University of Ottawa（渥太华大学）；Prince Sultan University（普森国王大学）；University of Luxembourg（卢森堡大学）；Research Ireland Lero Centre, University of Limerick（爱尔兰Lero研究中心，利默里克大学）
KAIST（韩国科学技术院）；Koh Young Technology, Inc.（高永科技股份有限公司）
Surface mount technology (SMT) is a process for producing printed circuit boards. Solder paste printer (SPP), package mounter, and solder reflow oven are used for SMT. The board on which the solder paste is deposited from the SPP is monitored by solder paste inspector (SPI). If SPP malfunctions due to the printer defects, the SPP produces defective products, and then abnormal patterns are detected by SPI. In this paper, we propose a convolutional recurrent reconstructive network (CRRN), which decomposes the anomaly patterns generated by the printer defects, from SPI data. CRRN learns only norm…
Conditional Attribution for Root Cause Analysis in Time-Series Anomaly Detection
German Research Center for Artificial Intelligence (DFKI)（德国人工智能研究中心（DFKI））；Paul Wurth S.A（保罗·沃思公司）；Rheinland-Pfälzische Technische Universität Kaiserslautern-Landau（莱茵河-巴尔夫技术大学凯撒斯劳滕-兰道）
UIUC（伊利诺伊大学厄巴纳-香槟分校）；KAIST（韩国科学技术院）；University of Vermont（佛蒙特大学）
Online anomaly detection from a data stream is critical for the safety and security of many applications but is facing severe challenges due to complex and evolving data streams from IoT devices and cloud-based infrastructures. Unfortunately, existing approaches fall too short for these challenges; online anomaly detection methods bear the burden of handling the complexity while offline deep anomaly detection methods suffer from the evolving data distribution. This paper presents a framework for online deep anomaly detection, ARCUS, which can be instantiated with any autoencoder-based deep ano…
Modeling inter-dependencies between time-series is the key to achieve high performance in anomaly detection for multivariate time-series data. The de-facto solution to model the dependencies is to feed the data into a recurrent neural network (RNN). However, the fully connected network structure underneath the RNN (either GRU or LSTM) assumes a static and complete dependency graph between time-series, which may not hold in many real-world applications. To alleviate this assumption, we propose a dynamic bipartite graph structure to encode the inter-dependencies between time-series. More concret…
