PP: Robust Anomaly Detection for Multivariate Time Series through Stochastic Recurrent Neural Network

PROBLEM:

anomaly detection

input: multivariate time series to RNN ------> capture the normal patterns -----> reconstruct input data by the representations ------> use the reconstruction probabilities to determine anomalies. 

INTRODUCTION: 

Anomaly detection in different fields (graph, log messages, time series); 说明不同信息载体（图，文本，时序数据）的方法有很大的差异，可能在某些方面又是共通的。

?? The definition of multivariate: Multiple univariate time series from the same device (or more generally, an entity) forms a multivariate time series. ?? if they are not from the same device, are they multivariate? 这个device/entity是指一个大的东西，比如电脑，而不是一个单纯的设备。

the level of anomalies: entity anomalies or metric-level anomalies.

EVIDENCE: In general, it is preferred to detect entity anomalies at the entity level directly using multivariate time series [6, 11, 16, 17], rather than at the metric-level using univariate time series.

Reasons: 1. requirement: they concern more about the overall status of entities. 2. it's labor-intensive to train and maintain an individual anomaly detection model for each metric. 3.  an incident at an entity typically causes anomalies in multiple metrics. 4. modeling the expected value of one time series can benefit from the more information in multivariate time series. 

unsupervised method: due to anomaly diversities and without labels.

??if it is unsupervised methods, how they measure their performance. 

How: learn robust latent representations of normal patterns, if one observation is different from normal patterns, it would be considered as an anomaly.

Challenge: 1. capture long-term dependence. 2. capture probability distributions of multivariate time series. 3. how to interpret your results (unsupervised learning)

 

EVIDENCE: literature 5 shown that explicitly modeling the temporal dependence are better. 

We propose stochastic RNN.  

RELATED WORK: 

 

PRELIMINARIES:

 Problem statement: 以时序数据的个数作为维度，M个TS, 

 gru, vae, and stochastic gradient variational bayes

DESIGN

1. use GRU to capture complex temporal dependence in x-space. 

2. apply VAE to map observations to stochastic variables.

3. explicitly model temporal dependence among latent space, they propose the stochastic variable connection technique. 

4. adopt planar NF. 

 

 

 

SUPPLEMENTARY KNOWLEDGE:

1. what does temporal dependency mean?

2. GRU: gate recurrent unit

Reference

1. 人人都能看懂的GRU
2. 变分自编码器VAE：原来是这么一回事 | 附开源代码