基于VAE-WGAN的多维时间序列异常检测方法

doi:10.11959/j.issn.1000-436x.2022050

摘要/Abstract

摘要：

针对传统半监督深度异常检测模型对非平衡多维数据分布学习能力不足及模型训练困难等问题，提出一种基于VAE-WGAN架构的多维时间序列异常检测方法，利用VAE作为WGAN的生成器，使用Wasserstein距离作为模型拟合分布与待测数据真实分布之间的度量，学习复杂的高维数据分布。利用滑动窗口划分时间序列，使用正常序列数据训练模型；根据待测序列在训练好的模型中的异常得分，结合自适应阈值技术进行异常判定。实验表明，该方法具有模型容易训练且稳定性强的特点，并且在精确率、召回率?F1值等异常检测性能指标上，比现有的生成式异常检测模型有明显提升。

关键词: 时间序列数据, 变分自编码器, Wasserstein生成对抗网络, 异常检测

Abstract:

As the deficiency of learning ability of traditional semi-supervised depth anomaly detection model to unbalanced multidimensional data distribution and the difficulty of model training, a multi-dimensional time series anomaly detection method based on VAE-WGAN architecture was proposed.VAE was used as a generator of WGAN.The Wasserstein distance was used as a measure between the model fitting distribution and the real distribution of the data to be measured, complex and high-dimensional data distributions could be learned.A sliding window was applied to divide the time series, the normal sequence data were used to train the model.According to the abnormal score of the waiting test sequence in the trained model, the anomaly was judged with adaptive threshold technology.The experimental results show that the model is easy to train and stable, and has obvious improvement over the existing generative anomaly detection model in accuracy, recall rate, F1 score and other anomaly detection performance indicators.

Key words: time series data, variational auto-encoder, Wasserstein generative adversarial network, anomaly detection

中图分类号:

TP391

段雪源, 付钰, 王坤. 基于VAE-WGAN的多维时间序列异常检测方法[J]. 通信学报, 2022, 43(3): 1-13.

Xueyuan DUAN, Yu FU, Kun WANG. Multi-dimensional time series anomaly detection method based on VAE-WGAN[J]. Journal on Communications, 2022, 43(3): 1-13.

图/表 17

图1

图2

图3

图4

图5

图6

表1

表2

图7

图8

图9

图10

图11

图12

图13

图14

表3

参考文献 28

[1]	AHMAD S , LAVIN A , PURDY S ,et al. Unsupervised real-time anomaly detection for streaming data[J]. Neurocomputing, 2017,262: 134-147.
[2]	KINGMA D P , WELLING M . Auto-encoding variational Bayes[J]. arXiv Preprint,arXiv:1312.6114, 2013.
[3]	GOODFELLOW I J , POUGET-ABADIE J , MIRZA M ,et al. Generative adversarial nets[C]// Proceedings of the 27th International Conference on Neural Information Processing Systems. Cambridge:MIT Press, 2014: 2672-2680.
[4]	CHANDOLA V , BANERJEE A , KUMAR V . Anomaly detection:a survey[J]. ACM computing surveys (CSUR), 2009,41(3): 1-58.
[5]	AN J , CHO S . Variational autoencoder based anomaly detection using reconstruction probability[J]. SUN Data Mining Center, 2015,2: 1-18.
[6]	XU H W , CHEN W X , ZHAO N W ,et al. Unsupervised anomaly detection via variational auto-encoder for seasonal KPIs in web applications[C]// Proceedings of the 2018 World Wide Web Conference. Republic and Canton of Geneva:International World Wide Web Conferences Steering Committee, 2018: 187-196.
[7]	CHEN W X , XU H W , LI Z Y ,et al. Unsupervised anomaly detection for intricate KPIs via adversarial training of VAE[C]// Proceedings of IEEE INFOCOM 2019 - IEEE Conference on Computer Communications. Piscataway:IEEE Press, 2019: 1891-1899.
[8]	POL A A , BERGER V , GERMAIN C ,et al. Anomaly detection with conditional variational autoencoders[C]// Proceedings of 2019 18th IEEE International Conference on Machine Learning and Applications. Piscataway:IEEE Press, 2019: 1651-1657.
[9]	杨宏宇, 王峰岩, 吕伟力 . 基于无监督生成推理的网络安全威胁态势评估方法[J]. 清华大学学报(自然科学版), 2020,60(6): 474-484.
	YANG H Y , WANG F Y , LYU W L . Network security threat assessment method based on unsupervised generation reasoning[J]. Journal of Tsinghua University (Science and Technology), 2020,60(6): 474-484.
[10]	MEMARZADEH M , MATTHEWS B , AVREKH I . Unsupervised anomaly detection in flight data using convolutional variational auto-encoder[J]. Aerospace, 2020,7(8): 115.
[11]	郭敏, 曾颖明, 于然 ,等. 基于对抗训练和VAE样本修复的对抗攻击防御技术研究[J]. 信息网络安全, 2019(9): 66-70.
	GUO M , ZENG Y M , YU R ,et al. Research on defense technology of adversarial attacks based on adversarial training and VAE-repairing[J]. Netinfo Security, 2019(9): 66-70.
[12]	BEULA RANI B J , SUMATHI M E L . Survey on applying GAN for anomaly detection[C]// Proceedings of 2020 International Conference on Computer Communication and Informatics (ICCCI). Piscataway:IEEE Press, 2020: 1-5.
[13]	THOMAS S , PHILIPP S , SEBASTIAN M W . Unsupervised anomaly detection with generative adversarial networks to guide marker discovery[C]// Proceedings of Information Processing in Medical Imaging. Berlin:Springer, 2017,39(2): 1703-1721.
[14]	BASHAR M A , NAYAK R . TAnoGAN:time series anomaly detection with generative adversarial networks[C]// Proceedings of 2020 IEEE Symposium Series on Computational Intelligence. Piscataway:IEEE Press, 2020: 1778-1785.
[15]	LI D , CHEN D C , JIN B H ,et al. MAD-GAN:multivariate anomaly detection for time series data with generative adversarial networks[C]// Artificial Neural Networks and Machine Learning - ICANN 2019. Berlin:Springer, 2019: 214-232.
[16]	CHEN X H , DENG L W , HUANG F T ,et al. DAEMON:unsupervised anomaly detection and interpretation for multivariate time series[C]// Proceedings of 2021 IEEE 37th International Conference on Data Engineering. Piscataway:IEEE Press, 2021: 2225-2230.
[17]	戴文倩 . 基于生成对抗网络的流量预测研究[D]. 上海:上海师范大学, 2019.
	DAI W Q . Traffic prediction method for network based on generative adversarial network[D]. Shanghai:Shanghai Normal University, 2019.
[18]	潘一鸣, 林家骏 . 基于生成对抗网络的恶意网络流生成及验证[J]. 华东理工大学学报(自然科学版), 2019,45(2): 344-350.
	PAN Y M , LIN J J . Generation and verification of malicious network flow based on generative adversarial networks[J]. Journal of East China University of Science and Technology, 2019,45(2): 344-350.
[19]	FERDOWSI A , SAAD W . Generative adversarial networks for distributed intrusion detection in the Internet of things[C]// Proceedings of 2019 IEEE Global Communications Conference. Piscataway:IEEE Press, 2019: 1-6.
[20]	刘芃 . 基于Text-GAN的加密流量识别关键技术研究[D]. 南京:南京邮电大学, 2020.
	LIU P . Research on encrypted traffic identification based on Text-Gan[D]. Nanjing:Nanjing University of Posts and Telecommunications, 2020.
[21]	邹福泰, 谭越, 王林 ,等. 基于生成对抗网络的僵尸网络检测[J]. 通信学报, 2021,42(7): 95-106.
	ZOU F T , TAN Y , WANG L ,et al. Botnet detection based on generative adversarial network[J]. Journal on Communications, 2021,42(7): 95-106.
[22]	CHEN N G , LI C M . Hyperspectral image classification approach based on Wasserstein generative adversarial networks[C]// Proceedings of 2020 International Conference on Machine Learning and Cybernetics (ICMLC). Piscataway:IEEE Press, 2020: 53-63.
[23]	WEI X , GONG B Q , LIU Z X ,et al. Improving the improved training of Wasserstein GANs:a consistency term and its dual effect[J]. arXiv Preprint,arXiv:1803.01541, 2018.
[24]	GEIGER A , LIU D Y , ALNEGHEIMISH S ,et al. TadGAN:time series anomaly detection using generative adversarial networks[C]// Proceedings of 2020 IEEE International Conference on Big Data (Big Data). Piscataway:IEEE Press, 2020: 33-43.
[25]	王星, 霍纬纲 . Wasserstein 自编码器异常检测模型[J]. 计算机工程与设计, 2020,41(11): 3249-3254.
	WANG X , HUO W G . Wasserstein autoencoder anomaly detection models[J]. Computer Engineering and Design, 2020,41(11): 3249-3254.
[26]	LARSEN A B L , S?NDERBY S K , WINTHER O ,et al. Autoencoding beyond pixels using a learned similarity metric[C]// Proceedings of the 33rd International Conference on Machine Learning.[S.l. ]:JMLR, 2016: 1558-1566.
[27]	NIU Z J , YU K , WU X F . LSTM-based VAE-GAN for time-series anomaly detection[J]. Sensors (Basel,Switzerland), 2020,20(13): 3738.
[28]	张璇, 程敏熙, 肖凤平 . 利用Origin对数据异常值的剔除方法进行比较[J]. 实验科学与技术, 2012,10(1): 74-76,118.
	ZHANG X , CHENG M X , XIAO F P . Origin used in comparison the methods of eliminating the excrescent data[J]. Experiment Science and Technology, 2012,10(1): 74-76,118.

数据集	特征维度	样本数	异常比
KDD99-sub	41	494 021	32.02%
SMAP	25	562 800	13.13%
MSL	55	132 046	10.72%
SWaT	51	946 719	11.98%

攻击类型	原特征数/种	降维后特征数/种
DoS	11	5
Probe	14	6
R2L	18	6
U2R	8	5

模型	数据集	精确率	召回率	F1值
	KDD99-sub	0.376 7	0.156 3	0.220 9
	SMAP	0.668 6	0.533 4	0.593 4
TadGAN	MSL	0.613 7	0.666 9	0.639 2
	SWaT	0.631 6	0.468 7	0.538 1
	总评	0.614 0	0.475 2	0.524 4
	KDD99-sub	0.236 7	0.442 9	0.308 5
	SMAP	0.263 8	0.283 7	0.273 4
MAD-GAN	MSL	0.567 9	0.354 3	0.436 4
	SWaT	0.897 8	0.723 2	0.801 1
	总评	0.450 2	0.432 2	0.428 3
	KDD99-sub	0.784 6	0.569 4	0.659 9
	SMAP	0.701 2	0.804 5	0.749 3
VAE-WGAN	MSL	0.741 2	0.609 9	0.669 2
	SWaT	0.823 1	0.686 4	0.748 6
	总评	0.762 5	0.667 6	0.706 7