Unsupervised Online Anomaly Detection On Irregularly Sampled Or Missing Valued Time-Series Data Using LSTM Networks

Abstract

We study anomaly detection and introduce an algorithm that processes variable length, irregularly sampled sequences or sequences with missing values. Our algorithm is fully unsupervised, however, can be readily extended to supervised or semi-supervised cases when the anomaly labels are present as remarked throughout the paper. Our approach uses the Long Short Term Memory (LSTM) networks in order to extract temporal features and find the most relevant feature vectors for anomaly detection. We incorporate the sampling time information to our model by modulating the standard LSTM model with time modulation gates. After obtaining the most relevant features from the LSTM, we label the sequences using a Support Vector Data Descriptor (SVDD) model. We introduce a loss function and then jointly optimize the feature extraction and sequence processing mechanisms in an end-to-end manner. Through this joint optimization, the LSTM extracts the most relevant features for anomaly detection later to be used in the SVDD, hence completely removes the need for feature selection by "expert" knowledge. Furthermore, we provide a training algorithm for the online setup, where we optimize our model parameters with individual sequences as the new data arrives. Finally, on real-life datasets, we show that our model significantly outperforms the standard approaches thanks to its combination of LSTM with SVDD and joint optimization.

Online Anomaly Detection for Smartphone-Based Multivariate Behavioral Time Series Data

“…Recent research on unsupervised online anomaly detection mainly focuses on improving accuracy using a customized neural network or a clustering method designed for a specific scenario. Hsieh et al [ 11 ] proposed an algorithm using a long short-term memory (LSTM)-based autoencoder for smart manufacturing; Aminanto et al [ 12 ] used the isolation forest method to solve the threat-alert fatigue problem; Yu et al [ 13 ] proposed an algorithm called DDCOL, a density-based clustering method to detect anomalies in various key performance indicators for IT companies; Karaahmetoglu et al [ 14 ] combined LSTM networks with a support vector data descriptor to process irregularly sampled sequences; Hwang et al [ 15 ] presented an anomaly traffic detection mechanism, D-PACK, which consists of a convolutional neural network and an autoencoder for auto-profiling the traffic patterns and filtering abnormal traffic. Jones et al [ 16 ] applied an adaptive resonance theory artificial neural network to identify cyberattacks on Internet-connected photovoltaic system inverters; Scaranti et al [ 17 ] developed an intrusion detection system based on online clustering to detect attacks in an evolving network.…”