DeepAnT: A Deep Learning Approach for Unsupervised Anomaly Detection in Time Series
DeepAnT: A Deep Learning Approach for Unsupervised Anomaly Detection in Time Series
复制标题
DOI：
10.1109/access.2018.2886457
复制
发表时间：
2019-01-01
期刊：
影响因子：
3.9
通讯作者：
Ahmed, Sheraz
中科院分区：
文献类型：
--
作者：
Munir, Mohsin;Siddiqui, Shoaib Ahmed;Ahmed, Sheraz
传统的基于距离和密度的异常检测技术无法检测到流数据中常见的周期性和季节性相关的点异常，这在物联网时代的时间序列异常检测中留下了很大的空白。为了解决这个问题，我们提出了一种新的基于深度学习的时间序列数据异常检测方法（DeepAnT），该方法同样适用于非流情况。DeepAnT能够检测各种异常，即时间序列数据中的点异常、上下文异常和不一致。与学习异常的异常检测方法不同，DeepAnT使用未标记的数据来捕获和学习用于预测时间序列正常行为的数据分布。DeepAnT包括两个模块：时间序列预测器和异常检测器。时间序列预测模块使用深度卷积神经网络（CNN）来预测定义视界上的下一个时间戳。该模块接受一个时间序列窗口（用作上下文），并尝试预测下一个时间戳。然后将预测值传递给异常检测器模块，该模块负责将相应的时间戳标记为正常或异常。DeepAnT甚至可以在不去除给定数据集中的异常的情况下进行训练。通常，在基于深度学习的方法中，需要大量数据来训练模型。而在DeepAnT中，由于CNN的有效参数共享，可以在相对较小的数据集上训练模型，同时获得良好的泛化能力。由于DeepAnT中的异常检测是无监督的，因此在模型生成时不依赖于异常标签。因此，这种方法可以直接应用于现实生活场景，在现实生活中，几乎不可能标记来自由正常点和异常点组成的异构传感器的大数据流。我们在10个异常检测基准上对15种算法进行了详细的评估，这些基准总共包含433个真实和合成时间序列。实验表明，在大多数情况下，DeepAnT的表现优于最先进的异常检测方法，同时与其他方法表现相当。
Traditional distance and density-based anomaly detection techniques are unable to detect periodic and seasonality related point anomalies which occur commonly in streaming data, leaving a big gap in time series anomaly detection in the current era of the IoT. To address this problem, we present a novel deep learning-based anomaly detection approach (DeepAnT) for time series data, which is equally applicable to the non-streaming cases. DeepAnT is capable of detecting a wide range of anomalies, i.e., point anomalies, contextual anomalies, and discords in time series data. In contrast to the anomaly detection methods where anomalies are learned, DeepAnT uses unlabeled data to capture and learn the data distribution that is used to forecast the normal behavior of a time series. DeepAnT consists of two modules: time series predictor and anomaly detector. The time series predictor module uses deep convolutional neural network (CNN) to predict the next time stamp on the defined horizon. This module takes a window of time series (used as a context) and attempts to predict the next time stamp. The predicted value is then passed to the anomaly detector module, which is responsible for tagging the corresponding time stamp as normal or abnormal. DeepAnT can be trained even without removing the anomalies from the given data set. Generally, in deep learning-based approaches, a lot of data are required to train a model. Whereas in DeepAnT, a model can be trained on relatively small data set while achieving good generalization capabilities due to the effective parameter sharing of the CNN. As the anomaly detection in DeepAnT is unsupervised, it does not rely on anomaly labels at the time of model generation. Therefore, this approach can be directly applied to real-life scenarios where it is practically impossible to label a big stream of data coming from heterogeneous sensors comprising of both normal as well as anomalous points. We have performed a detailed evaluation of 15 algorithms on 10 anomaly detection benchmarks, which contain a total of 433 real and synthetic time series. Experiments show that DeepAnT outperforms the state-of-the-art anomaly detection methods in most of the cases, while performing on par with others.