Adversarially learned anomaly detection for time series data

1 INTRODUCTION . With recent proliferation of devices collecting temporal observations , there has been an increasing demand for anomaly detection in time series . The main goal is to identify any behavior in the time series that is unusual , flag it and bring it for analysis . In many real world settings a continuous time series collected over long periods is provided , and the goal is to isolate anomalous sub sequences of varied lengths . One usually does not know where those sub sequences may exist , or how long or short each one would be and how many there are . In a classical setting , it is possible to segment the time series into many subsequences ( overlapping or otherwise ) of a certain length and apply methods focused on generating an anomaly score for each sequence in order to show how certain sequences are compared to others . Chandola et al . ( 2008 ) present a comparative study for several time series anomaly detection methods . They categorize the techniques into kernel-based , window-based and Markovian techniques . Practitioners who don ’ t know how to segment may resort to less complex techniques , such as simple thresholding , to detect any data points that exceed the normal range ( Chandola et al. , 2009 ) . However , many anomalies do not exceed any boundaries – for example , they may have values that are purportedly ” normal , ” but are actually unusual at the specific time that they occur . These contextual anomalies are naturally harder to identify , since the context of a signal is often not clear ( Chandola et al. , 2009 ; Ahmad et al. , 2017 ) . In recent years , Deep Learning-based methods have been developed to deal with such issues ( Kwon et al. , 2017 ) . These methods make use of the increased availability of data in order to learn the underlying structure of a time series , and to identify unusual changes in behavior using prediction or reconstruction errors ( Malhotra et al. , 2015 ) . Within this framework – learning a model , predicting and reconstructing sequences , and using reconstruction errors to detect anomalies – multiple variants have been developed ( Malhotra et al. , 2015 ; Hundman et al. , 2018 ; Goh et al. , 2017 ) . At the same time , recent years have also seen the introduction of adversarially trained networks , which can learn the underlying distributions of data sets and generate impressive synthetic data from this information . Generative Adversarial Networks ( GANs ) , which were introduced by Goodfellow et al . ( 2014 ) in 2014 , have been very successful , especially in the area of image processing . Without direct access to real data , Generators in GANs attempt to synthesize real-looking data by implicitly learning the structure of a dataset . Seeing this success has motivated us to explore whether GANs can also learn the structure of a time series . To the best of our knowledge , only one other work by Li et al . ( 2018 ) uses GANs in time series anomaly detection . Building on this approach , this paper aims to give more thorough insight into this domain , and to demonstrate how adversarially learned networks could be used for anomaly detection in time series data . Our key contribution is the development of a cycle-consistent GAN for sequential data that can be used for anomaly detection . Because we analyze time series data , which naturally comes with shortor long-term dependencies , our encoding and generating networks are based on Long Short Term Memory ( LSTM ) cells . In order to achieve cycle consistency during training , we use a reconstruction loss for the Encoder and Generator training , and a second Critic network to support the correct bidirectional mappings . Furthermore , we propose that the point-wise reconstruction error between original time series points and the reconstructed points , which is often used for anomaly detection , regularly fails to give the best error function for time series data . Instead , we introduce two similarity measures , which try to evaluate the local similarity between the original and the reconstructed sequences . We then combine this similarity measure and the Critic output into a function that gives robust anomaly scores for the time series . To provide further insights into anomaly detection with GANs and to demonstrate our proposed model , we provide an evaluation which investigates how each component of our model contributes to anomaly detection performance . Finally , we provide several benchmarks on well-known time series data sets and show how our approach exceeds the performance of current state-of-the-art methods . The paper is structured as follows : First , we give an overview of related literature in section 2 . Next , we introduce our model in section 3 . We then describe the anomaly detection method in section 4 , and give a evaluation of our proposed model in section 5 . 2 RELATED WORK . Anomaly detection is a broad area of study , and several methods have been developed over the course of years , if not decades . To limit the scope of related work , we focus on instances where generative adversarial networks have been used for anomaly detection . GANs are most often used to generate images and a few studies have used them to detect anomalies in them . For example , Schlegl et al . ( 2019 ) and Deecke et al . ( 2018 ) use GAN based architectures to detect anomalies in images . However , only a few studies have used GANs for time series data . For example , Esteban et al . ( 2017 ) use recurrent conditional GANs to generate medical time series data . More recently , ( Luo et al. , 2018 ) used them to impute missing values in multivariate time series . In order to use GANs for anomaly detection in time series , Li et al . ( 2018 ) proposed a GAN model to capture the distribution of a multivariate time series . The Critic is then used to detect anomalies . They also attempt to use the reconstruction loss as an additional anomaly detection method , so they find the inverse mapping from the data space to the latent space . This mapping , which tries to infer z from X , is done in a second step after the GAN is trained . The same two-step approach is used in a more recent preprint by Li et al . ( 2019 ) as well as by Schlegl et al . ( 2017 ) to detect anomalies in medical images . However , as Zenati et al . ( 2018 ) mention in their paper , this method is impractical for large data sets or real-time applications . They propose a bidirectional GAN for anomaly detection in tabular and image data sets , which allows to train the inverse mapping through an encoding network simultaneously . The idea of training both encoder and decoder networks was originally developed by Donahue et al . ( 2017 ) and Dumoulin et al . ( 2017 ) , who show how to get bidirectional GANs by trying to match joint distributions . In the optimum situation , the joint distributions are the same and the Encoder and Decoder must be inverses of each other . A similar cycle consistent GAN was introduced in Zhu et al . ( 2017 ) , where two networks try to map into opposite dimensions , such that samples can be mapped from one space to the other and vice versa . Also , Zhou et al . ( 2019 ) are using a Encoder and Decoder GAN architecture that allows to use the reconstruction error for anomaly detection in ECG data . 3 ADVERSARIAL LEARNING FOR TIME SERIES . While our time series anomaly detection model builds heavily on the bidirectional concepts introduced in the works mentioned above , we are introducing some changes to the loss and objective functions . Therefore we will describe the details of our model in this section . The standard GAN can be used to generate time series . It consists of two components , the Generator G and the Critic ( or Discriminator ) Cx . Typically , both are implemented through neural networks . G maps z drawn from an assumed latent distribution PZ - typically a standard multivariate normal distribution , i. e. z ∼ PZ = N ( 0 , I ) . The input data domain X is described by the given training samples { ( x1 ... ti ) } Ni=1 , x1 ... ti ∈ X and X represents the possible time series sequences of length t. For convenience of notation we use xi to imply a time sequence of length t. The goal of Cx is to distinguish between real time series sequences from X and the generated time series sequences from G ( z ) , whereas G is trying to fool Cx by generating real-looking sequences . Therefore , we have a saddle-point problem , where G and Cx are competing against each other . In our implementation we use a Wasserstein loss , first introduced by Arjovsky et al . ( 2017 ) , which makes use of the Wasserstein-1 distance when training the Critic network . Formally , let PX be the distribution over X , then we have the following problem : min G max Cx∈Cx VX ( Cx , G ) ( 1 ) with VX ( Cx , G ) = Ex∼PX [ Cx ( x ) ] − Ez∼PZ [ Cx ( G ( z ) ) ) ] ( 2 ) where Cx denotes the set of 1-Lipschitz functions . We use a LSTM based neural network for G and a 1-D convolutional neural network for Cx in our implementation . In order to match samples with representations in the latent space , we train an encoding network E for the mapping E : X → PZ . Therefore , we compute another loss term with the intention to minimize the L2 norm of the difference between the original and the reconstructed samples : VL2 ( E , G ) = Ex∼PX [ ‖x− G ( E ( x ) ) ‖2 ] ( 3 ) This gives the following objective we try to solve : min G , E max Cx∈Cx VX ( Cx , G ) + VL2 ( E , G ) ( 4 ) In this objective function , the Critic for the Generator is optimized by approximating the Wasserstein-1 distance , and the Generator and the Encoder are optimized to minimize this distance and the additional L2 objective function . To support the correct mapping into the latent distribution PZ , we add a second Critic Cz . The resulting architecture becomes similar to the one due to the CycleGAN proposal of Zhu et al . ( 2017 ) , although with a different loss . Its purpose is to try to distinguish between random latent samples z ∼ PZ and encoded samples E ( x ) with x ∼ PX . Thus , we have the following additional objective using the Wasserstein-1 loss again : min E max Cz∈Cz VZ ( Cz , E ) ( 5 ) with VZ ( Cz , E ) = Ez∼PZ [ Cz ( z ) ] − Ex∼PX [ Cz ( E ( x ) ) ) ] ( 6 ) Combining all of the objectives given in ( 2 ) , ( 3 ) and ( 6 ) leads to the final MinMax problem : min { E , G } max { Cx∈Cx , Cz∈Cz } VX ( Cx , G ) + VL2 ( E , G ) + VZ ( Cz , E ) ( 7 ) In order to enforce the 1-Lipschitz constraint during training , we apply a gradient penalty regularization term as introduced in Gulrajani et al . ( 2017 ) , which penalizes gradients not equal to 1 . The full architecture of our model can be seen in Figure 1 .

Summary: This paper proposes a GAN model with cycle-consistent loss function for anomaly detection on timeseries. The loss function is the combination of reconstruction error (L2 norm) and both discriminators (generator and decoder) loss. Once trained, the anomaly score is computed as the mean-var-normalized product of the reconstruction score and the discriminator score. The framework is adapted to timeseries by using LSTM networks for the generator and the encoder and 1D CNN for the discriminators (critics). For the calculation of the reconstruction error, the authors study three approaches: point-wise, dynamic time warping and area difference. The method is applied to two datasets (NASA Spacecraft telemetry, Yahoo traffic) and is compared to simple baselines (LSTM, ARIMA, DenseAE). The results shows an improvement over the baselines. Variations of the models are also studied (with and without critic, different similarity measures for the reconstruction errors). The results show that the discrimination score (critic) does overall provide an improvement over the reconstruction error alone. And for the reconstruction score, the area differences is best, followed by DTW and point-wise.