Anomaly Detection and Explanation Discovery on Event Streams

Song, Fei; Zhou, Boyao; Sun, Quan; Sun, Weiwei; Xia, Shiwen; Diao, Yanlei

doi:10.1145/3242153.3242158

Cited by 5 publications

(3 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In our experimental study, we particularly focus on three DL methods that represent the recent state of the art [30,48,36] (detailed in §5). While gaining more traction lately, anomaly explanation (AE) is relatively less explored [3,50,41,22,20,29,34,46]. We hope our benchmark brings more attention to this important problem.…”

Section: Related Workmentioning

confidence: 99%

Exathlon: A Benchmark for Explainable Anomaly Detection over Time Series

Jacob¹,

Song²,

Stiegler³

et al. 2020

Preprint

Self Cite

View full text Add to dashboard Cite

Access to high-quality data repositories and benchmarks have been instrumental in advancing the state of the art in many domains, as they provide the research community a common ground for training, testing, evaluating, comparing, and experimenting with novel machine learning models. Lack of such community resources for anomaly detection (AD) severely limits progress. In this report, we present AnomalyBench, the first comprehensive benchmark for explainable AD over high-dimensional (2000+) time series data. AnomalyBench has been systematically constructed based on real data traces from ∼100 repeated executions of 10 large-scale stream processing jobs on a Spark cluster. 30+ of these executions were disturbed by introducing ∼100 instances of different types of anomalous events (e.g., misbehaving inputs, resource contention, process failures). For each of these anomaly instances, ground truth labels for the root-cause interval as well as those for the effect interval are available, providing a means for supporting both AD tasks and explanation discovery (ED) tasks via root-cause analysis. We demonstrate the key design features and practical utility of AnomalyBench through an experimental study with three state-of-the-art semi-supervised AD techniques.Recent advances in data science and machine learning (ML) significantly reinforced the need for developing robust anomaly detection and explanation solutions that can be reliably deployed in production environments [20,29]. However, progress has been rather slow and limited. While there is extensive research activity going on [9], proposed solutions have been mostly adhoc and far from Preprint. Under review.

show abstract

Section: Related Workmentioning

confidence: 99%

Exathlon: A Benchmark for Explainable Anomaly Detection over Time Series

Jacob¹,

Song²,

Stiegler³

et al. 2020

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…Table 1 reports the overall number of anomalies we detect of each type for births and deaths and some summary statistics across all anomaly types and Figure 5 maps these We find considerably more mortality anomalies (n = 156) than fertility anomalies (n = 22). Given that anomalies are always the product of events (Song et al 2018), finding more mortality than fertility anomalies is not surprising. Mortality is likely to spike in response to a catastrophic event (like an earthquake or terrorist attack) or due to a disease outbreak while the effects of a catastrophic event on fertility is less predictable.…”

Section: Interesting Anomalous Fertility/mortality Eventsmentioning

confidence: 99%

Causal Inference in Population Trends: Searching for Demographic Anomalies in Big Data

Hauer¹

2020

Preprint

View full text Add to dashboard Cite

The proliferation of big data, wider access to advanced computing platforms, and the development of powerful statistical algorithms can uncover hidden anomalies in social data, previously dismissed as noise. Here, we combine causal inference techniques and abductive reasoning to identify fertility and mortality anomalies on twenty years of complete demographic data in the United States. We uncover real, “hidden” baby booms/busts and mortality spikes/dips, distinguishable from regular trend variations. We identify more than 22 and 156 fertility and mortality anomalies, totaling more than 200k and 600k anomalous births and deaths, respectively. Notable detectable mortality anomalies include the September 11 2001 terrorist attack in New York and the emergence and acceleration of the opioid epidemic in New Hampshire. Notable fertility anomalies include the “missing births” in Louisiana after Hurricane Katrina and the reduction in fertility behavior after the September 2008 stock market crash in Connecticut, amongst others. The combined causal inference and abductive reasoning approach can be readily adapted to find other, undiscovered social phenomena or to evaluate the efficacy of important public policies.

show abstract

“…Third, a recent position paper [31] argues for a new system that can harness the power of Deep Learning for detecting complex anomaly types, while at the same time can recover human-readable explanations for detected anomalies. In particular, Deep Neural Networks (DNNs) have demonstrated capabilities for handling highdimensional time series data and detecting both contextual and collective anomalies [8].…”

Section: Introductionmentioning

confidence: 99%

Explainable anomaly detection on high-dimensional time series data

Rad

Song

Jacob

et al. 2021

Proceedings of the 15th ACM International Conference on Distributed and Event-Based Systems

Self Cite

View full text Add to dashboard Cite

As enterprise information systems are collecting event streams from various sources, the ability of a system to automatically detect anomalous events and further provide human-readable explanations is of paramount importance. In this paper, we present an approach to integrated anomaly detection (AD) and explanation discovery (ED), which is able to leverage state-of-the-art Deep Learning (DL) techniques for anomaly detection, while being able to recover humanreadable explanations for detected anomalies. At the core of the framework is a new human-interpretable dimensionality reduction (HIDR) method that not only reduces the dimensionality of the data, but also maintains a meaningful mapping from the original features to the transformed low-dimensional features. Such transformed features can be fed into any DL technique designed for anomaly detection, and the feature mapping will be used to recover humanreadable explanations through a suite of new feature selection and explanation discovery methods. Evaluation using a recent explainable anomaly detection benchmark demonstrates the efficiency and effectiveness of HIDR for AD, and the result that while all three recent ED techniques failed to generate quality explanations on highdimensional data, our HIDR-based ED framework can enable them to generate explanations with dramatic improvements in the quality of explanations and computational efficiency.

show abstract

Anomaly Detection and Explanation Discovery on Event Streams

Cited by 5 publications

References 13 publications

Exathlon: A Benchmark for Explainable Anomaly Detection over Time Series

Exathlon: A Benchmark for Explainable Anomaly Detection over Time Series

Causal Inference in Population Trends: Searching for Demographic Anomalies in Big Data

Explainable anomaly detection on high-dimensional time series data

Contact Info

Product

Resources

About