Time series anomaly detection with reconstruction-based state-space models

Recent advances in digitization have led to the availability of multivariate time series data in various domains, enabling real-time monitoring of operations. Identifying abnormal data patterns and detecting potential failures in these scenarios are important yet rather challenging. In this work, we propose a novel unsupervised anomaly detection method for time series data. The proposed framework jointly learns the observation model and the dynamic model, and model uncertainty is estimated from normal samples. Specifically, a long short-term memory (LSTM)-based encoder-decoder is adopted to represent the mapping between the observation space and the latent space. Bidirectional transitions of states are simultaneously modeled by leveraging backward and forward temporal information. Regularization of the latent space places constraints on the states of normal samples, and Mahalanobis distance is used to evaluate the abnormality level. Empirical studies on synthetic and real-world datasets demonstrate the superior performance of the proposed method in anomaly detection tasks.

[1]  Zahra Zamanzadeh Darban,et al.  Deep Learning for Time Series Anomaly Detection: A Survey , 2022, ACM Computing Surveys.

[2]  Chuan-Sheng Foo,et al.  An Evaluation of Anomaly Detection and Diagnosis in Multivariate Time Series , 2021, IEEE Transactions on Neural Networks and Learning Systems.

[3]  Alberto Bemporad,et al.  Learning nonlinear state-space models using autoencoders , 2021, Autom..

[4]  Cheng Feng,et al.  Time Series Anomaly Detection for Cyber-physical Systems via Neural System Identification and Bayesian Filtering , 2021, KDD.

[5]  Maria A. Zuluaga,et al.  USAD: UnSupervised Anomaly Detection on Multivariate Time Series , 2020, KDD.

[6]  Asaf Shabtai,et al.  Efficient Cyber Attack Detection in Industrial Control Systems Using Lightweight Neural Networks and PCA , 2019, IEEE Transactions on Dependable and Secure Computing.

[7]  Alexander Binder,et al.  Deep One-Class Classification , 2018, ICML.

[8]  Bo Zong,et al.  Deep Autoencoding Gaussian Mixture Model for Unsupervised Anomaly Detection , 2018, ICLR.

[9]  Aditya P. Mathur,et al.  WADI: a water distribution testbed for research in the design of secure cyber physical systems , 2017, CySWATER@CPSWeek.

[10]  Lovekesh Vig,et al.  LSTM-based Encoder-Decoder for Multi-sensor Anomaly Detection , 2016, ArXiv.

[11]  Nils Ole Tippenhauer,et al.  SWaT: a water treatment testbed for research and training on ICS security , 2016, 2016 International Workshop on Cyber-physical Systems for Smart Water Networks (CySWater).

[12]  VARUN CHANDOLA,et al.  Anomaly detection: A survey , 2009, CSUR.

[13]  Zhi-Hua Zhou,et al.  Isolation Forest , 2008, 2008 Eighth IEEE International Conference on Data Mining.

[14]  Jürgen Schmidhuber,et al.  Framewise phoneme classification with bidirectional LSTM and other neural network architectures , 2005, Neural Networks.

[15]  Charles X. Ling,et al.  Using AUC and accuracy in evaluating learning algorithms , 2005, IEEE Transactions on Knowledge and Data Engineering.

[16]  Jeffrey K. Uhlmann,et al.  Unscented filtering and nonlinear estimation , 2004, Proceedings of the IEEE.

[17]  J. Ma,et al.  Time-series novelty detection using one-class support vector machines , 2003, Proceedings of the International Joint Conference on Neural Networks, 2003..

[18]  S. Hochreiter,et al.  Long Short-Term Memory , 1997, Neural Computation.

[19]  R. E. Kalman,et al.  A New Approach to Linear Filtering and Prediction Problems , 2002 .

[20]  Guigang Zhang,et al.  Deep Learning , 2016, Int. J. Semantic Comput..

[21]  R. Kálmán A New Approach to Linear Filtering and Prediction Problems 1 , 2011 .

[22]  Saiful Islam,et al.  Mahalanobis Distance , 2009, Encyclopedia of Biometrics.