基于低秩张量分解与深度展开的网络流量自适应异常检测
Adaptive Anomaly Detection in Network Flows with Low-Rank Tensor Decompositions and Deep Unrolling
AI总结：
针对网络流量异常检测中深度学习训练数据效率低、域自适应难等问题，提出结合低秩张量分解与深度展开的自适应检测架构，经实验验证其数据效率高、性能优且适配不同网络拓扑。
摘要：
异常检测（AD）日益被视为保障未来通信系统弹性的关键组成部分。尽管深度学习已展现出当前最优的AD性能，但其在关键系统中的应用受到训练数据效率、域自适应和可解释性方面担忧的阻碍。本研究针对不完整测量下的网络流量AD问题，利用鲁棒张量分解方法与深度展开技术来应对上述挑战。我们首先基于正则化模型拟合目标提出了一种新颖的块逐次凸逼近算法，其中正常流量被建模为低秩张量，异常被建模为稀疏张量。我们对目标函数进行了增广以降低计算成本。我们应用深度展开技术，基于所提出的算法推导了一种新颖的深度网络架构，将正则化参数视为可学习权重。受贝叶斯方法启发，我们扩展了该模型架构，以实现对单流量和单时间步统计量的在线自适应，在保持低参数量和保留问题置换等变性的同时提升了AD性能。为了优化深度网络权重以提升检测性能，我们采用了一种基于接收者操作特征曲线下面积高效近似的同伦优化方法。在合成数据和真实世界数据上的大量实验表明，我们提出的深度网络架构具有很高的训练数据效率，性能优于参考方法，并且能够无缝适应变化的网络拓扑。
英文摘要：
Anomaly detection (AD) is increasingly recognized as a key component for ensuring the resilience of future communication systems. While deep learning has shown state-of-the-art AD performance, its application in critical systems is hindered by concerns regarding training data efficiency, domain adaptation and interpretability. This work considers AD in network flows using incomplete measurements, leveraging a robust tensor decomposition approach and deep unrolling techniques to address these challenges. We first propose a novel block-successive convex approximation algorithm based on a regularized model-fitting objective where the normal flows are modeled as low-rank tensors and anomalies as sparse. An augmentation of the objective is introduced to decrease the computational cost. We apply deep unrolling to derive a novel deep network architecture based on our proposed algorithm, treating the regularization parameters as learnable weights. Inspired by Bayesian approaches, we extend the model architecture to perform online adaptation to per-flow and per-time-step statistics, improving AD performance while maintaining a low parameter count and preserving the problem's permutation equivariances. To optimize the deep network weights for detection performance, we employ a homotopy optimization approach based on an efficient approximation of the area under the receiver operating characteristic curve. Extensive experiments on synthetic and real-world data demonstrate that our proposed deep network architecture exhibits a high training data efficiency, outperforms reference methods, and adapts seamlessly to varying network topologies.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
