Anomaly Detection in Multivariate Non-stationary Time Series for Automatic DBMS Diagnosis

Anomaly detection in database management systems (DBMSs) is difficult because of increasing number of statistics (stat) and event metrics in big data system. In this paper, I propose an automatic DBMS diagnosis system that detects anomaly periods with abnormal DB stat metrics and finds causal events in the periods. Reconstruction error from deep autoencoder and statistical process control approach are applied to detect time period with anomalies. Related events are found using time series similarity measures between events and abnormal stat metrics. After training deep autoencoder with DBMS metric data, efficacy of anomaly detection is investigated from other DBMSs containing anomalies. Experiment results show effectiveness of proposed model, especially, batch temporal normalization layer. Proposed model is used for publishing automatic DBMS diagnosis reports in order to determine DBMS configuration and SQL tuning.Comment: 8 page

A Study of Representational Properties of Unsupervised Anomaly Detection in Brain MRI

Anomaly detection in MRI is of high clinical value in imaging and diagnosis. Unsupervised methods for anomaly detection provide interesting formulations based on reconstruction or latent embedding, offering a way to observe properties related to factorization. We study four existing modeling methods, and report our empirical observations using simple data science tools, to seek outcomes from the perspective of factorization as it would be most relevant to the task of unsupervised anomaly detection, considering the case of brain structural MRI. Our study indicates that anomaly detection algorithms that exhibit factorization related properties are well capacitated with delineatory capabilities to distinguish between normal and anomaly data. We have validated our observations in multiple anomaly and normal datasets.Comment: Accepted at MICCAI Medical Applications with Disentanglements (MAD) Workshop 2022 https://mad.ikim.nrw

Graph Neural Networks based Log Anomaly Detection and Explanation

Event logs are widely used to record the status of high-tech systems, making log anomaly detection important for monitoring those systems. Most existing log anomaly detection methods take a log event count matrix or log event sequences as input, exploiting quantitative and/or sequential relationships between log events to detect anomalies. Unfortunately, only considering quantitative or sequential relationships may result in low detection accuracy. To alleviate this problem, we propose a graph-based method for unsupervised log anomaly detection, dubbed Logs2Graphs, which first converts event logs into attributed, directed, and weighted graphs, and then leverages graph neural networks to perform graph-level anomaly detection. Specifically, we introduce One-Class Digraph Inception Convolutional Networks, abbreviated as OCDiGCN, a novel graph neural network model for detecting graph-level anomalies in a collection of attributed, directed, and weighted graphs. By coupling the graph representation and anomaly detection steps, OCDiGCN can learn a representation that is especially suited for anomaly detection, resulting in a high detection accuracy. Importantly, for each identified anomaly, we additionally provide a small subset of nodes that play a crucial role in OCDiGCN's prediction as explanations, which can offer valuable cues for subsequent root cause diagnosis. Experiments on five benchmark datasets show that Logs2Graphs performs at least on par with state-of-the-art log anomaly detection methods on simple datasets while largely outperforming state-of-the-art log anomaly detection methods on complicated datasets.Comment: Preprint submitted to Engineering Applications of Artificial Intelligenc

FABLE : Fabric Anomaly Detection Automation Process

Unsupervised anomaly in industry has been a concerning topic and a stepping stone for high performance industrial automation process. The vast majority of industry-oriented methods focus on learning from good samples to detect anomaly notwithstanding some specific industrial scenario requiring even less specific training and therefore a generalization for anomaly detection. The obvious use case is the fabric anomaly detection, where we have to deal with a really wide range of colors and types of textile and a stoppage of the production line for training could not be considered. In this paper, we propose an automation process for industrial fabric texture defect detection with a specificity-learning process during the domain-generalized anomaly detection. Combining the ability to generalize and the learning process offer a fast and precise anomaly detection and segmentation. The main contributions of this paper are the following: A domain-generalization texture anomaly detection method achieving the state-of-the-art performances, a fast specific training on good samples extracted by the proposed method, a self-evaluation method based on custom defect creation and an automatic detection of already seen fabric to prevent re-training.Comment: 7th International Conference on Control, Automation and Diagnosis (ICCAD'23), 6 page

Maat: Performance Metric Anomaly Anticipation for Cloud Services with Conditional Diffusion

Ensuring the reliability and user satisfaction of cloud services necessitates prompt anomaly detection followed by diagnosis. Existing techniques for anomaly detection focus solely on real-time detection, meaning that anomaly alerts are issued as soon as anomalies occur. However, anomalies can propagate and escalate into failures, making faster-than-real-time anomaly detection highly desirable for expediting downstream analysis and intervention. This paper proposes Maat, the first work to address anomaly anticipation of performance metrics in cloud services. Maat adopts a novel two-stage paradigm for anomaly anticipation, consisting of metric forecasting and anomaly detection on forecasts. The metric forecasting stage employs a conditional denoising diffusion model to enable multi-step forecasting in an auto-regressive manner. The detection stage extracts anomaly-indicating features based on domain knowledge and applies isolation forest with incremental learning to detect upcoming anomalies. Thus, our method can uncover anomalies that better conform to human expertise. Evaluation on three publicly available datasets demonstrates that Maat can anticipate anomalies faster than real-time comparatively or more effectively compared with state-of-the-art real-time anomaly detectors. We also present cases highlighting Maat's success in forecasting abnormal metrics and discovering anomalies.Comment: This paper has been accepted by the Research track of the 38th IEEE/ACM International Conference on Automated Software Engineering (ASE 2023

DTAAD: Dual Tcn-Attention Networks for Anomaly Detection in Multivariate Time Series Data

Anomaly detection techniques enable effective anomaly detection and diagnosis in multi-variate time series data, which are of major significance for today's industrial applications. However, establishing an anomaly detection system that can be rapidly and accurately located is a challenging problem due to the lack of outlier tags, the high dimensional complexity of the data, memory bottlenecks in the actual hardware, and the need for fast reasoning. We have proposed an anomaly detection and diagnosis model -- DTAAD in this paper, based on Transformer, and Dual Temporal Convolutional Network(TCN). Our overall model will be an integrated design in which autoregressive model(AR) combines autoencoder(AE) structures, and scaling methods and feedback mechanisms are introduced to improve prediction accuracy and expand correlation differences. Constructed by us, the Dual TCN-Attention Network (DTA) only uses a single layer of Transformer encoder in our baseline experiment, that belongs to an ultra-lightweight model. Our extensive experiments on six publicly datasets validate that DTAAD exceeds current most advanced baseline methods in both detection and diagnostic performance. Specifically, DTAAD improved F1 scores by $8.38\%$, and reduced training time by $99\%$ compared to baseline. The code and training scripts are publicly on GitHub at https://github.com/Yu-Lingrui/DTAAD

MULTIVARIATE TIME SERIES UNSUPERVISED ANOMALY DETECTION AND DIAGNOSIS IN 5G NETWORKS

For a variety of reasons (including, for example, increasing cyber security threats, increased network heterogeneity, the increased use of virtualization technologies, etc.) maintaining the fifth generation (5G) networks of tomorrow will be challenging. To address such challenges techniques are presented herein that support a multivariate time series unsupervised method for anomaly detection using Key Performance Indicators (KPIs) that are derived from various infrastructure level metrics collected from all kinds of networking nodes deployed in 5G networks. Multivariate time series unsupervised anomaly detection is the future of anomaly detection with systems generating real-time time series data but this is an area that has not yet been explored with 5G. This invention introduces anomaly detection in 5G networks at the node level or deployment level instead of simply monitoring anomalous behavior in a particular KPI on a particular node. Additionally, aspects of the techniques presented herein provide a semi-automated method for anomaly diagnosis and deep-dive anomaly analytics in support of better systems of the future. The main focus herein lies in anomaly detection in modern 5G network deployments at the complete node or deployment level using infrastructure level data from 5G nodes to detect and prevent network failures. We present a multivariate time-series unsupervised AI algorithm to solve this problem which helps detect anomalous behavior and in turn facilitates better network troubleshooting and capacity forecasting

MULTIVARIATE TIME SERIES UNSUPERVISED ANOMALY DETECTION AND DIAGNOSIS IN 5G NETWORKS

For a variety of reasons (including, for example, increasing cyber security threats, increased network heterogeneity, the increased use of virtualization technologies, etc.) maintaining the fifth generation (5G) networks of tomorrow will be challenging. To address such challenges techniques are presented herein that support a multivariate time series unsupervised method for anomaly detection using Key Performance Indicators (KPIs) that are derived from various infrastructure level metrics collected from all kinds of networking nodes deployed in 5G networks. Multivariate time series unsupervised anomaly detection is the future of anomaly detection with systems generating real-time time series data but this is an area that has not yet been explored with 5G. This invention introduces anomaly detection in 5G networks at the node level or deployment level instead of simply monitoring anomalous behavior in a particular KPI on a particular node. Additionally, aspects of the techniques presented herein provide a semi-automated method for anomaly diagnosis and deep-dive anomaly analytics in support of better systems of the future. The main focus herein lies in anomaly detection in modern 5G network deployments at the complete node or deployment level using infrastructure level data from 5G nodes to detect and prevent network failures. We present a multivariate time-series unsupervised AI algorithm to solve this problem which helps detect anomalous behavior and in turn facilitates better network troubleshooting and capacity forecasting