Online Time Series Anomaly Detection with State Space Gaussian Processes

Abstract

We propose r-ssGPFA, an unsupervised online anomaly detection model for uniand multivariate time series building on the efficient state space formulation of Gaussian processes. For high-dimensional time series, we propose an extension of Gaussian process factor analysis to identify the common latent processes of the time series, allowing us to detect anomalies efficiently in an interpretable manner. We gain explainability while speeding up computations by imposing an orthogonality constraint on the mapping from the latent to the observed. Our model's robustness is improved by using a simple heuristic to skip Kalman updates when encountering anomalous observations. We investigate the behaviour of our model on synthetic data and show on standard benchmark datasets that our method is competitive with state-of-the-art methods while being computationally cheaper.

Network Traffic Anomaly Detection: A Revisiting to Gaussian Process and Sparse Representation

“…• Baseline 1 (GP-based approach [12]): GP is adopted to calculate the mean and variance of the upcoming time slot, if the actual traffic is larger than f (t) + δσ 2 (t), where δ controls the confidence region, then it is believed to be anomaly. • Baseline 2 (Threshold-based approach) [13]…”

“…In addition, as a measure of uncertainty over the predicted traffic, GP could analytically infer a posterior distribution of the prediction, which is of vital importance for anomaly detection. In [12], if the predicted traffic exceeds a likelihood threshold based on the inferred distribution, it is assumed that traffic anomaly occurs. However, such method is vulnerable to noise and modeling error.…”

“…Especially, self-similarity and periodicity are two major properties, as traffic pattern and human activity are profoundly coupled [19]. In this regard, the existing GP-based traffic modeling algorithms try to combine SE function, Rational Quadratic (RQ) function, and periodic function to mimic these two properties [12], [13]. However, based on the analysis of the G ÈANT dataset † , we find that both normal and anomaly traffic contains more patterns than intuition, which is also evolving over time.…”

Online Multivariate Anomaly Detection and Localization for High-Dimensional Settings

“…The problem of anomaly detection has been an important subject of study in several research communities, such as statistics, signal processing, machine learning, information theory, and data mining, either specifically for an application domain or as a generic method. To name a few, an SVM classification approach for anomaly detection was proposed in [ 10 ]; Bayesian methods were developed for social networks [ 11 ], partially observed traffic networks [ 12 ], and streaming environmental data [ 13 ]; deep neural network models were proposed for detecting anomalies multivariate time series [ 14 , 15 , 16 , 17 , 18 ]; several information theoretic measures were proposed in [ 19 ] for the intrusion detection problem; and two new information metrics for DDoS attack detection was introduced in [ 3 ]. Due to the challenging nature of the problem and considering the challenges posed by today’s technological advances such as big data problems, there is still a need for studying the anomaly detection problem.…”