基于VAE-WGAN的多维时间序列异常检测方法

doi:10.11959/j.issn.1000-436x.2022050

Abstract

Abstract:

As the deficiency of learning ability of traditional semi-supervised depth anomaly detection model to unbalanced multidimensional data distribution and the difficulty of model training, a multi-dimensional time series anomaly detection method based on VAE-WGAN architecture was proposed.VAE was used as a generator of WGAN.The Wasserstein distance was used as a measure between the model fitting distribution and the real distribution of the data to be measured, complex and high-dimensional data distributions could be learned.A sliding window was applied to divide the time series, the normal sequence data were used to train the model.According to the abnormal score of the waiting test sequence in the trained model, the anomaly was judged with adaptive threshold technology.The experimental results show that the model is easy to train and stable, and has obvious improvement over the existing generative anomaly detection model in accuracy, recall rate, F1 score and other anomaly detection performance indicators.

Key words: time series data, variational auto-encoder, Wasserstein generative adversarial network, anomaly detection

CLC Number:

TP391

Xueyuan DUAN, Yu FU, Kun WANG. Multi-dimensional time series anomaly detection method based on VAE-WGAN[J]. Journal on Communications, 2022, 43(3): 1-13.

Figures/Tables 17

References 28

[1]	AHMAD S , LAVIN A , PURDY S ,et al. Unsupervised real-time anomaly detection for streaming data[J]. Neurocomputing, 2017,262: 134-147.
[2]	KINGMA D P , WELLING M . Auto-encoding variational Bayes[J]. arXiv Preprint,arXiv:1312.6114, 2013.
[3]	GOODFELLOW I J , POUGET-ABADIE J , MIRZA M ,et al. Generative adversarial nets[C]// Proceedings of the 27th International Conference on Neural Information Processing Systems. Cambridge:MIT Press, 2014: 2672-2680.
[4]	CHANDOLA V , BANERJEE A , KUMAR V . Anomaly detection:a survey[J]. ACM computing surveys (CSUR), 2009,41(3): 1-58.
[5]	AN J , CHO S . Variational autoencoder based anomaly detection using reconstruction probability[J]. SUN Data Mining Center, 2015,2: 1-18.
[6]	XU H W , CHEN W X , ZHAO N W ,et al. Unsupervised anomaly detection via variational auto-encoder for seasonal KPIs in web applications[C]// Proceedings of the 2018 World Wide Web Conference. Republic and Canton of Geneva:International World Wide Web Conferences Steering Committee, 2018: 187-196.
[7]	CHEN W X , XU H W , LI Z Y ,et al. Unsupervised anomaly detection for intricate KPIs via adversarial training of VAE[C]// Proceedings of IEEE INFOCOM 2019 - IEEE Conference on Computer Communications. Piscataway:IEEE Press, 2019: 1891-1899.
[8]	POL A A , BERGER V , GERMAIN C ,et al. Anomaly detection with conditional variational autoencoders[C]// Proceedings of 2019 18th IEEE International Conference on Machine Learning and Applications. Piscataway:IEEE Press, 2019: 1651-1657.
[9]	杨宏宇, 王峰岩, 吕伟力 . 基于无监督生成推理的网络安全威胁态势评估方法[J]. 清华大学学报(自然科学版), 2020,60(6): 474-484.
	YANG H Y , WANG F Y , LYU W L . Network security threat assessment method based on unsupervised generation reasoning[J]. Journal of Tsinghua University (Science and Technology), 2020,60(6): 474-484.
[10]	MEMARZADEH M , MATTHEWS B , AVREKH I . Unsupervised anomaly detection in flight data using convolutional variational auto-encoder[J]. Aerospace, 2020,7(8): 115.
[11]	郭敏, 曾颖明, 于然 ,等. 基于对抗训练和VAE样本修复的对抗攻击防御技术研究[J]. 信息网络安全, 2019(9): 66-70.
	GUO M , ZENG Y M , YU R ,et al. Research on defense technology of adversarial attacks based on adversarial training and VAE-repairing[J]. Netinfo Security, 2019(9): 66-70.
[12]	BEULA RANI B J , SUMATHI M E L . Survey on applying GAN for anomaly detection[C]// Proceedings of 2020 International Conference on Computer Communication and Informatics (ICCCI). Piscataway:IEEE Press, 2020: 1-5.
[13]	THOMAS S , PHILIPP S , SEBASTIAN M W . Unsupervised anomaly detection with generative adversarial networks to guide marker discovery[C]// Proceedings of Information Processing in Medical Imaging. Berlin:Springer, 2017,39(2): 1703-1721.
[14]	BASHAR M A , NAYAK R . TAnoGAN:time series anomaly detection with generative adversarial networks[C]// Proceedings of 2020 IEEE Symposium Series on Computational Intelligence. Piscataway:IEEE Press, 2020: 1778-1785.
[15]	LI D , CHEN D C , JIN B H ,et al. MAD-GAN:multivariate anomaly detection for time series data with generative adversarial networks[C]// Artificial Neural Networks and Machine Learning - ICANN 2019. Berlin:Springer, 2019: 214-232.
[16]	CHEN X H , DENG L W , HUANG F T ,et al. DAEMON:unsupervised anomaly detection and interpretation for multivariate time series[C]// Proceedings of 2021 IEEE 37th International Conference on Data Engineering. Piscataway:IEEE Press, 2021: 2225-2230.
[17]	戴文倩 . 基于生成对抗网络的流量预测研究[D]. 上海:上海师范大学, 2019.
	DAI W Q . Traffic prediction method for network based on generative adversarial network[D]. Shanghai:Shanghai Normal University, 2019.
[18]	潘一鸣, 林家骏 . 基于生成对抗网络的恶意网络流生成及验证[J]. 华东理工大学学报(自然科学版), 2019,45(2): 344-350.
	PAN Y M , LIN J J . Generation and verification of malicious network flow based on generative adversarial networks[J]. Journal of East China University of Science and Technology, 2019,45(2): 344-350.
[19]	FERDOWSI A , SAAD W . Generative adversarial networks for distributed intrusion detection in the Internet of things[C]// Proceedings of 2019 IEEE Global Communications Conference. Piscataway:IEEE Press, 2019: 1-6.
[20]	刘芃 . 基于Text-GAN的加密流量识别关键技术研究[D]. 南京:南京邮电大学, 2020.
	LIU P . Research on encrypted traffic identification based on Text-Gan[D]. Nanjing:Nanjing University of Posts and Telecommunications, 2020.
[21]	邹福泰, 谭越, 王林 ,等. 基于生成对抗网络的僵尸网络检测[J]. 通信学报, 2021,42(7): 95-106.
	ZOU F T , TAN Y , WANG L ,et al. Botnet detection based on generative adversarial network[J]. Journal on Communications, 2021,42(7): 95-106.
[22]	CHEN N G , LI C M . Hyperspectral image classification approach based on Wasserstein generative adversarial networks[C]// Proceedings of 2020 International Conference on Machine Learning and Cybernetics (ICMLC). Piscataway:IEEE Press, 2020: 53-63.
[23]	WEI X , GONG B Q , LIU Z X ,et al. Improving the improved training of Wasserstein GANs:a consistency term and its dual effect[J]. arXiv Preprint,arXiv:1803.01541, 2018.
[24]	GEIGER A , LIU D Y , ALNEGHEIMISH S ,et al. TadGAN:time series anomaly detection using generative adversarial networks[C]// Proceedings of 2020 IEEE International Conference on Big Data (Big Data). Piscataway:IEEE Press, 2020: 33-43.
[25]	王星, 霍纬纲 . Wasserstein 自编码器异常检测模型[J]. 计算机工程与设计, 2020,41(11): 3249-3254.
	WANG X , HUO W G . Wasserstein autoencoder anomaly detection models[J]. Computer Engineering and Design, 2020,41(11): 3249-3254.
[26]	LARSEN A B L , S?NDERBY S K , WINTHER O ,et al. Autoencoding beyond pixels using a learned similarity metric[C]// Proceedings of the 33rd International Conference on Machine Learning.[S.l. ]:JMLR, 2016: 1558-1566.
[27]	NIU Z J , YU K , WU X F . LSTM-based VAE-GAN for time-series anomaly detection[J]. Sensors (Basel,Switzerland), 2020,20(13): 3738.
[28]	张璇, 程敏熙, 肖凤平 . 利用Origin对数据异常值的剔除方法进行比较[J]. 实验科学与技术, 2012,10(1): 74-76,118.
	ZHANG X , CHENG M X , XIAO F P . Origin used in comparison the methods of eliminating the excrescent data[J]. Experiment Science and Technology, 2012,10(1): 74-76,118.

Metrics

Recommended 0

No Suggested Reading articles found!

数据集	特征维度	样本数	异常比
KDD99-sub	41	494 021	32.02%
SMAP	25	562 800	13.13%
MSL	55	132 046	10.72%
SWaT	51	946 719	11.98%

攻击类型	原特征数/种	降维后特征数/种
DoS	11	5
Probe	14	6
R2L	18	6
U2R	8	5

模型	数据集	精确率	召回率	F1值
	KDD99-sub	0.376 7	0.156 3	0.220 9
	SMAP	0.668 6	0.533 4	0.593 4
TadGAN	MSL	0.613 7	0.666 9	0.639 2
	SWaT	0.631 6	0.468 7	0.538 1
	总评	0.614 0	0.475 2	0.524 4
	KDD99-sub	0.236 7	0.442 9	0.308 5
	SMAP	0.263 8	0.283 7	0.273 4
MAD-GAN	MSL	0.567 9	0.354 3	0.436 4
	SWaT	0.897 8	0.723 2	0.801 1
	总评	0.450 2	0.432 2	0.428 3
	KDD99-sub	0.784 6	0.569 4	0.659 9
	SMAP	0.701 2	0.804 5	0.749 3
VAE-WGAN	MSL	0.741 2	0.609 9	0.669 2
	SWaT	0.823 1	0.686 4	0.748 6
	总评	0.762 5	0.667 6	0.706 7

Multi-dimensional time series anomaly detection method based on VAE-WGAN

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 17

References 28

Related Articles 15

Metrics

Recommended 0

[1]	Yifeng WANG, Yuanbo GUO, Qingli CHEN, Chen FANG, Renhao LIN, Yongliang ZHOU, Jiali MA. Method based on contrastive incremental learning for fine-grained malicious traffic classification [J]. Journal on Communications, 2023, 44(3): 1-11.
[2]	Weigang HUO, Rui LIANG, Yonghua LI. Anomaly detection model for multivariate time series based on stochastic Transformer [J]. Journal on Communications, 2023, 44(2): 94-103.
[3]	Yanwen WANG, Weimin LEI, Wei ZHANG, Huan MENG, Xinyi CHEN, Wenhui YE, Qingyang JING. Survey on video image reconstruction method based on generative model [J]. Journal on Communications, 2022, 43(9): 194-208.
[4]	Jianxin LIAO, Xiaoyuan FU, Qi QI, Jingyu WANG, Haifeng SUN. 6G-ADM: knowledge based 6G network management and control architecture [J]. Journal on Communications, 2022, 43(6): 3-15.
[5]	Ping WU, Chaowen CHANG, Zhibin ZUO, Yingying MA. Address overloading-based packet forwarding verification in SDN [J]. Journal on Communications, 2022, 43(3): 88-100.
[6]	Haili SUN, Xiang LONG, Lansheng HAN, Yan HUANG, Qingbo LI. Overview of anomaly detection techniques for industrial Internet of things [J]. Journal on Communications, 2022, 43(3): 196-210.
[7]	Zhuo CHEN, Miao ZHU, Junwei DU. Multi-view graph neural network for fraud detection algorithm [J]. Journal on Communications, 2022, 43(11): 225-232.
[8]	Yifeng WANG, Yuanbo GUO, Qingli CHEN, Chen FANG, Renhao LIN. Method based on contrastive learning for fine-grained unknown malicious traffic classification [J]. Journal on Communications, 2022, 43(10): 12-25.
[9]	Xueyuan DUAN, Yu FU, Kun WANG, Taotao LIU, Bin LI. Network traffic anomaly detection method based on multi-scale characteristic [J]. Journal on Communications, 2022, 43(10): 65-76.
[10]	Tieming CHEN,Chengqiang JIN,Mingqi LYU,Tiantian ZHU. Intelligent detection method on network malicious traffic based on sample enhancement [J]. Journal on Communications, 2020, 41(6): 128-138.
[11]	Qi QI,Runye SHEN,Jingyu WANG. GAD:topology-aware time series anomaly detection [J]. Journal on Communications, 2020, 41(6): 152-160.
[12]	Xiaohui YANG,Shengchang ZHANG. Anomaly detection model based on multi-grained cascade isolation forest algorithm [J]. Journal on Communications, 2019, 40(8): 133-142.
[13]	Yi-wei GAO,Rui-kang ZHOU,Ying-xu LAI,Ke-feng FAN,Xiang-zhen YAO,Lin LI. Research on industrial control system intrusion detection method based on simulation modelling [J]. Journal on Communications, 2017, 38(7): 186-198.
[14]	Zhi-jun WU,Jing-an ZHANG,Meng YUE,Cai-feng ZHANG. Approach of detecting low-rate DoS attack based on combined features [J]. Journal on Communications, 2017, 38(5): 19-30.
[15]	Ying-xu LAI,Zeng-hui LIU,Xiao-tian CAI,Kai-xiang YANG. Research on intrusion detection of industrial control system [J]. Journal on Communications, 2017, 38(2): 143-156.