GAD：基于拓扑感知的时间序列异常检测

doi:10.11959/j.issn.1000-436x.2020113

通信学报 ›› 2020, Vol. 41 ›› Issue (6): 152-160.doi: 10.11959/j.issn.1000-436x.2020113

GAD：基于拓扑感知的时间序列异常检测

戚琦,申润业,王敬宇

北京邮电大学网络与交换国家重点实验室，北京 100876

修回日期:2020-05-24 出版日期:2020-06-25 发布日期:2020-07-04
作者简介:戚琦（1982– ），女，河北廊坊人，博士，北京邮电大学副教授、博士生导师，主要研究方向为智能边缘计算、业务网络智能化、网络资源优化等|申润业（1996- ），男，安徽六安人，北京邮电大学硕士生，主要研究方向为智能运维、软件定义网络等|王敬宇（1978- ），男，吉林长春人，博士，北京邮电大学教授、博士生导师，主要研究方向为智能网络、人工智能、云计算、多媒体通信、多路径传输、流量工程等
基金资助:
国家重点研发计划基金资助项目(2018YFB1800502);国家自然科学基金资助项目(61671079);国家自然科学基金资助项目(61771068);北京市自然科学基金资助项目(4182041)

GAD:topology-aware time series anomaly detection

Qi QI,Runye SHEN,Jingyu WANG

State Key Laboratory of Networking and Switching Technology,Beijing University of Posts and Telecommunications,Beijing 100876,China

Revised:2020-05-24 Online:2020-06-25 Published:2020-07-04
Supported by:
The National Key Research and Development Program of China(2018YFB1800502);The National Natural Science Foundation of China(61671079);The National Natural Science Foundation of China(61771068);The Natural Science Foundation of Beijing(4182041)

摘要/Abstract

摘要：

为了解决网络中节点设备异常检测、智能运维、根因分析等问题，针对链路时延、网络吞吐率、设备内存使用率等时序数据，提出了一种基于图的门控卷积编解码异常检测模型。考虑网络场景的实时性需求以及网络拓扑连接关系对时序数据的影响，基于门控卷积对时序数据并行提取时间维度特征并通过图卷积挖掘空间依赖关系。基于时空特征提取模块组成的编码器对原始输入时序数据编码后，卷积模块组成的解码器用于重构时序数据。原始数据和重构数据间的残差进一步用于计算异常分数并检测异常。在公开数据和模拟仿真平台上的实验表明，所提模型相对于目前的时间序列异常检测基准模型具有更高的识别准确率。

关键词: 智能运维, 异常检测, 时间序列, 时空卷积

Abstract:

To solve the problems of anomaly detection,intelligent operation,root cause analysis of node equipment in the network,a graph-based gated convolutional codec anomaly detection model was proposed for time series data such as link delay,network throughput,and device memory usage.Considering the real-time requirements of network scenarios and the impact of network topology connections on time series data,the time dimension features of time series were extracted in parallel based on gated convolution and the spatial dependencies were mined through graph convolution.After the encoder composed of the spatio-temporal feature extraction module encoded the original input time series data,the decoder composed of the convolution module was used to reconstruct the time series data.The residuals between the original data and the reconstructed data were further used to calculate the anomaly score and detect anomalies.Experiments on public data and simulation platforms show that the proposed model has higher recognition accuracy than the current time series anomaly detection benchmark algorithm.

Key words: AIOps, anomaly detection, time series, spatio-temporal convolution

中图分类号:

TP393

戚琦,申润业,王敬宇. GAD：基于拓扑感知的时间序列异常检测[J]. 通信学报, 2020, 41(6): 152-160.

Qi QI,Runye SHEN,Jingyu WANG. GAD:topology-aware time series anomaly detection[J]. Journal on Communications, 2020, 41(6): 152-160.

图/表 10

图1

图2

图3

图4

表1

图5

图6

图7

图8

表2

参考文献 16

[1]	DANG Y , LIN Q , HUANG P . AIOps:real-world challenges and research innovations[C]// 2019 IEEE/ACM 41st International Conference on Software Engineering:Companion Proceedings. Piscataway:IEEE Press, 2019: 4-5.
[2]	KAUR K , GARG S , AUJLA G S ,et al. Edge computing in the industrial internet of things environment:software-defined-networks-based edge-cloud interplay[J]. IEEE Communications Magazine, 2018,56(2): 44-51.
[3]	CHOU J S , TELAGA A S . Real-time detection of anomalous power consumption[J]. Renewable and Sustainable Energy Reviews, 2014(33): 400-411.
[4]	LIU D , ZHAO Y , XU H ,et al. Opprentice:towards practical and automatic anomaly detection through machine learning[C]// Proceedings of the 2015 Internet Measurement Conference. New York:ACM Press, 2015: 211-224.
[5]	WANG J , JING Y , QI Q ,et al. ALSR:an adaptive label screening and relearning approach for interval-oriented anomaly detection[J]. Expert Systems with Applications, 2019(136): 94-104.
[6]	MALHOTRA P , VIG L , SHROFF G ,et al. Long short term memory networks for anomaly detection in time series[C]// Proceedings of Presses Universitaires de Louvain.[S.n.:s.l]. 2015:89.
[7]	HUNDMAN K , CONSTANTINOU V , LAPORTE C ,et al. Detecting spacecraft anomalies using LSTMs and nonparametric dynamic thresholding[C]// Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery ＆ Data Mining. New York:ACM Press, 2018: 387-395.
[8]	HAWKINS S , HE H , WILLIAMS G ,et al. Outlier detection using replicator neural networks[C]// International Conference on Data Warehousing and Knowledge Discovery. Berlin:Springer, 2002: 170-180.
[9]	MALHOTRA P , RAMAKRISHNAN A , ANAND G ,et al. LSTM-based encoder-decoder for multi-sensor anomaly detection[J]. arXiv Preprint,arXiv:1607.00148, 2016
[10]	XU H , CHEN W , ZHAO N ,et al. Unsupervised anomaly detection via variational auto-encoder for seasonal KPIs in Web applications[C]// Proceedings of the 2018 World Wide Web Conference. New York:ACM Press, 2018: 187-196.
[11]	DAUPHIN Y N , FAN A , AULI M ,et al. Language modeling with gated convolutional networks[C]// Proceedings of the 34th International Conference on Machine Learning. New York:ACM Press, 2017: 933-941.
[12]	GUO S , LIN Y , FENG N ,et al. Attention based spatial-temporal graph convolutional networks for traffic flow forecasting[C]// Proceedings of the AAAI Conference on Artificial Intelligence. Palo Alto:AAAI Press, 2019: 922-929.
[13]	BRUNA J , ZAREMBA W , SZLAM A ,et al. Spectral networks and deep locally connected networks on graphs[J]. arXiv Preprint,arXiv:1312.6203, 2013
[14]	HAMMOND D K , VANDERGHEYNST P , GRIBONVAL R . Wavelets on graphs via spectral graph theory[J]. Applied and Computational Harmonic Analysis, 2011,30(2): 129-150.
[15]	ZONG B , SONG Q , MIN M R ,et al. Deep autoencoding gaussian mixture model for unsupervised anomaly detection[C]// IEEE International Conference on Learning Representations. Piscataway:IEEE Press, 2018: 45-64.
[16]	JAGADISH H V , GEHRKE J , LABRINIDIS A ,et al. Big data and its technical challenges[J]. Communications of the ACM, 2014,57(7): 86-94.

模型	精确率（P）	召回率（R）	F1-score	AUCPR
AutoEncoder	0.288 1	0.636 5	0.352 2	0.267 5
EncDec-AD	0.995 7	0.905 7	0.941 3	0.921 9
DAGMM	0.734 0	0.858 7	0.723 2	0.699 2
LSTM-NDT	0.999 9	0.914 7	0.948 8	0.920 7
GAD	0.983 3	0.962 0	0.969 8	0.972 2

模型	F1-score	AUCPR	响应时间/s
AutoEncoder	0.567 2	0.554 0	0.19
EncDec-AD	0.964 0	0.948 2	1.94
DAGMM	0.689 5	0.680 3	14.45
LSTM-NDT	0.964 8	0.941 9	3.13
GAD	0.974 9	0.981 0	0.25

GAD：基于拓扑感知的时间序列异常检测

GAD:topology-aware time series anomaly detection

在线阅读

PDF下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 10

参考文献 16

相关文章 15

Metrics

推荐阅读 0

[1]	霍纬纲, 梁锐, 李永华. 基于随机Transformer的多维时间序列异常检测模型[J]. 通信学报, 2023, 44(2): 94-103.
[2]	廖建新, 付霄元, 戚琦, 王敬宇, 孙海峰. 6G-ADM：基于知识空间的6G网络管控体系[J]. 通信学报, 2022, 43(6): 3-15.
[3]	段雪源, 付钰, 王坤. 基于VAE-WGAN的多维时间序列异常检测方法[J]. 通信学报, 2022, 43(3): 1-13.
[4]	吴平, 常朝稳, 左志斌, 马莹莹. 基于地址重载的SDN分组转发验证[J]. 通信学报, 2022, 43(3): 88-100.
[5]	孙海丽, 龙翔, 韩兰胜, 黄炎, 李清波. 工业物联网异常检测技术综述[J]. 通信学报, 2022, 43(3): 196-210.
[6]	陈卓, 朱淼, 杜军威. 基于多视角图神经网络的欺诈检测算法[J]. 通信学报, 2022, 43(11): 225-232.
[7]	段雪源, 付钰, 王坤, 刘涛涛, 李彬. 基于多尺度特征的网络流量异常检测方法[J]. 通信学报, 2022, 43(10): 65-76.
[8]	陆彦辉, 柳寒, 李航, 朱光旭. 基于多鉴别器生成对抗网络的时间序列生成模型[J]. 通信学报, 2022, 43(10): 167-176.
[9]	朱会娟, 陈锦富, 李致远, 殷尚男. 基于多特征自适应融合的区块链异常交易检测方法[J]. 通信学报, 2021, 42(5): 41-50.
[10]	陈铁明,金成强,吕明琪,朱添田. 基于样本增强的网络恶意流量智能检测方法[J]. 通信学报, 2020, 41(6): 128-138.
[11]	王竹荣, 薛伟, 牛亚邦, 崔颖安, 孙钦东, 黑新宏. 基于注意力机制的泊位占有率预测模型研究[J]. 通信学报, 2020, 41(12): 182-192.
[12]	杨晓晖,张圣昌. 基于多粒度级联孤立森林算法的异常检测模型[J]. 通信学报, 2019, 40(8): 133-142.
[13]	李佳,云晓春,李书豪,张永铮,谢江,方方. 基于混合结构深度神经网络的HTTP恶意流量检测方法[J]. 通信学报, 2019, 40(1): 24-33.
[14]	吴志军,张景安,岳猛,张才峰. 基于联合特征的LDoS攻击检测方法[J]. 通信学报, 2017, 38(5): 19-30.
[15]	熊文君,徐正全,王豪. 基于滤波原理的时间序列差分隐私保护强度评估[J]. 通信学报, 2017, 38(5): 172-181.