Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Unsupervised Anomaly Detection in Multivariate Time Series across Heterogeneous Domains

Vincent Jacob, Yanlei Diao

TL;DR

The paper tackles unsupervised anomaly detection in high-dimensional multivariate time series under domain shift common in AIOps. It formulates AD as a domain generalization problem and introduces DIVAD, a Domain-Invariant VAE that disentangles domain-specific and domain-invariant factors, with flexible anomaly scoring based on a prior or aggregated posterior. Empirical results on Exathlon show DIVAD-GM achieving up to $0.79$ max peak F1 compared to $0.66$ for strong baselines, demonstrating improved domain generalization; ASD experiments confirm broader applicability. The work provides a unified benchmarking framework, novel DG-based modeling for time series AD, and practical insights into scoring strategies and hyperparameter effects, with code available for reproducibility.

Abstract

The widespread adoption of digital services, along with the scale and complexity at which they operate, has made incidents in IT operations increasingly more likely, diverse, and impactful. This has led to the rapid development of a central aspect of "Artificial Intelligence for IT Operations" (AIOps), focusing on detecting anomalies in vast amounts of multivariate time series data generated by service entities. In this paper, we begin by introducing a unifying framework for benchmarking unsupervised anomaly detection (AD) methods, and highlight the problem of shifts in normal behaviors that can occur in practical AIOps scenarios. To tackle anomaly detection under domain shift, we then cast the problem in the framework of domain generalization and propose a novel approach, Domain-Invariant VAE for Anomaly Detection (DIVAD), to learn domain-invariant representations for unsupervised anomaly detection. Our evaluation results using the Exathlon benchmark show that the two main DIVAD variants significantly outperform the best unsupervised AD method in maximum performance, with 20% and 15% improvements in maximum peak F1-scores, respectively. Evaluation using the Application Server Dataset further demonstrates the broader applicability of our domain generalization methods.

Unsupervised Anomaly Detection in Multivariate Time Series across Heterogeneous Domains

TL;DR

The paper tackles unsupervised anomaly detection in high-dimensional multivariate time series under domain shift common in AIOps. It formulates AD as a domain generalization problem and introduces DIVAD, a Domain-Invariant VAE that disentangles domain-specific and domain-invariant factors, with flexible anomaly scoring based on a prior or aggregated posterior. Empirical results on Exathlon show DIVAD-GM achieving up to max peak F1 compared to for strong baselines, demonstrating improved domain generalization; ASD experiments confirm broader applicability. The work provides a unified benchmarking framework, novel DG-based modeling for time series AD, and practical insights into scoring strategies and hyperparameter effects, with code available for reproducibility.

Abstract

The widespread adoption of digital services, along with the scale and complexity at which they operate, has made incidents in IT operations increasingly more likely, diverse, and impactful. This has led to the rapid development of a central aspect of "Artificial Intelligence for IT Operations" (AIOps), focusing on detecting anomalies in vast amounts of multivariate time series data generated by service entities. In this paper, we begin by introducing a unifying framework for benchmarking unsupervised anomaly detection (AD) methods, and highlight the problem of shifts in normal behaviors that can occur in practical AIOps scenarios. To tackle anomaly detection under domain shift, we then cast the problem in the framework of domain generalization and propose a novel approach, Domain-Invariant VAE for Anomaly Detection (DIVAD), to learn domain-invariant representations for unsupervised anomaly detection. Our evaluation results using the Exathlon benchmark show that the two main DIVAD variants significantly outperform the best unsupervised AD method in maximum performance, with 20% and 15% improvements in maximum peak F1-scores, respectively. Evaluation using the Application Server Dataset further demonstrates the broader applicability of our domain generalization methods.

Paper Structure

This paper contains 43 sections, 33 equations, 19 figures, 1 table.

Table of Contents

  1. Introduction
  2. Related Work
  3. General AD Framework
  4. Unsupervised Anomaly Detection
  5. Unifying Anomaly Detection Framework
  6. Domain Shift in Exathlon
  7. Background on Exathlon
  8. Analysis of Domain Shift
  9. Problem of Domain Shift
  10. The DIVAD Method
  11. Modeling
  12. Model Training
  13. Model Inference
  14. Scoring from Prior
  15. Scoring from Aggregated Posterior Estimate
  16. ...and 28 more sections

Figures (19)

  • Figure 1: t-SNE scatter plots of application 2's normal data, undersampled to 10,000 data records balanced by context.
  • Figure 2: Generative models. For (b), constructing $f_y$ amounts to inferring$\mathbf z_y$ from $\mathbf x$ (dashed arrow).
  • Figure 3: Illustration of the (a) reconstruction and (b) regularization terms in the ELBO objective (Eq. \ref{['equation:elbo']}).
  • Figure 4: Multi-encoder architecture of our DIVAD-GM models, with $N_{\text{dom}}$ the number of source domains (DIVAD-G models use a similar architecture, with the learned Gaussian Mixture parameters replaced with fixed Gaussian parameters).
  • Figure 5: Box plots of peak F1-scores achieved by the existing and DIVAD methods, separated by modeling strategy (point vs. sequence) and colored by method category (from Schmidl et al. tsad-eval plus DIVAD).
  • ...and 14 more figures

Theorems & Definitions (4)

  • Definition 1
  • Definition 2
  • Definition 3: Domain Shift Challenge
  • Definition 4: Anomaly Detection with Domain Generalization