S$^3$ADNet: Sequential Anomaly Detection with Pessimistic Contrastive Learning

Anomalies are commonly found in sequential data generated by real-world applications , such as cyberattacks in network traffic , human activity changes in wearable sensors . Thanks to the development of computing technology , many impressive results have been obtained from deep learning-based anomaly detection approaches in recent years . This paper proposes a simple neural network framework for detecting anomalies on sequential data , called Self-Supervised Sequential Anomaly Detection Network ( S3ADNet ) . S3ADNet first extracts the representations from each data point by performing feature augmentation for contrastive learning ; then captures the contextual information from the sequential data points for estimating anomaly probabilities by optimizing the context-adaptive objective . Here , we design a novel loss function based on a pessimistic policy , considering that only anomalies can affect the contextual relationships in sequences . Our proposed method outperformed other state-of-the-art approaches on the benchmark datasets by F1-score with a more straightforward architecture . 1 INTRODUCTION . Sequential anomaly detection ( SAD ) , a subtask of anomaly detection ( AD ) , focuses on detecting outliers or change points for sequential data . Sequential data are produced at a sub-millisecond rate by multifarious real-world applications , usually being of high dimensionality and high noise . Besides the complex nature of data , the sequential data points can have shifting distributions and relationships in different contexts , resulting in the concept drift problem ( Žliobaitė , 2010 ; Gama et al. , 2014 ) . Because anomalies can imply certain occurrences that endanger public safety , life , and property , such as intrusions in network connections ( Jyothsna et al. , 2011 ; Samrin & Vasumathi , 2017 ; Moustafa et al. , 2019 ) , activity changes and health irregularities in human sensing ( Nweke et al. , 2018 ; 2019 ; Serhani et al. , 2020 ) , abnormal events in video surveillance systems ( Popoola & Wang , 2012 ; Mabrouk & Zagrouba , 2018 ) , and risky signals in space technology ( Hundman et al. , 2018 ; Tariq et al. , 2019 ; Yairi et al. , 2017 ; Shin et al. , 2020 ) , SAD is a challenging but crucial task ( Pang et al. , 2021 ; Ruff et al. , 2021 ) . Learning meaningful representations from the data and capturing the contextual relationships is the key to solving SAD tasks . Generally , AD methods are in the unsupervised scheme because anomalies are considered to be much less than normal instances and hard to model . The approaches that train the models exclusively on the normal samples to identify the anomalies are one-class classification methods , such as one-class support vector machine ( OC-SVM ) ( Schölkopf et al. , 1999 ) . Since deep neural networks are expert at extracting representative features from high-dimensional and high-noise data , more and more methods leverage deep learning to handle AD tasks . Especially , autoencoders ( AEs ) ( Hinton & Zemel , 1994 ; Kingma & Welling , 2013 ) and generative adversarial networks ( GANs ) ( Goodfellow et al. , 2020 ) are frequently used as they are suitable for unsupervised learning , such as deep autoencoding Gaussian mixture model ( DAGMM ) ( Zong et al. , 2018 ) , and AnoGAN ( Schlegl et al. , 2017 ) . However , these methods could be weak in capturing the contextual information from sequences , so that some other approaches introduce recurrent neural networks ( RNNs ) ( Rumelhart et al. , 1986 ) to learn the sequential relationships . For example , the multi-scale convolutional recurrent encoder-decoder ( MSCRED ) ( Zhang et al. , 2019 ) , OmniAnomaly ( Su et al. , 2019 ) , and the temporal hierarchical one-class network ( THON ) ( Shen et al. , 2020 ) apply RNNs for time-series data modeling . Nevertheless , most of these methods still require picking out the normal data from the mess to train the one-class classifiers or generative models in practice . This paper proposes a self-supervised sequential anomaly detection network ( S3ADNet ) to learn the representations of sequential data points and extract the contextual relationships for anomaly detection . Inspired by the simple framework for contrastive learning of visual representations ( SimCLR ) ( Chen et al. , 2020 ) , we make the network generate two similar embeddings for input data points with feature augmentation , and the feature extraction layers capture the essential identities of the data points by minimizing the contrastive loss . By optimizing the contextual contrastive loss based on a pessimistic assumption system , the multi-conceptual context ( MCC ) layer estimates anomaly probabilities with the sequential relationships modeled by the learned representations for each data point . We can use arbitrary parameter-shared neural networks for the representative feature extraction . Additionally , we employ the MCC layer rather than RNN structures for a more intuitive context learning . The proposed model does not require any label information or even selecting the normal data for training one-class classifiers , yet makes the data points compare with each other to recognize anomalies . In the experiment , we compared our model ’ s estimation results to the state-of-the-art approaches using a widely used network traffic dataset and a human activity sensing dataset . Our proposed S3ADNet obtained competitive F1-score results to those methods with a simpler network architecture . 2 RELATED WORK . In this section , we review existing research endeavors related to our work . We first overview the approaches for AD and SAD tasks . Then , we outline recent contrastive learning methods for representation learning . 2.1 ANOMALY DETECTION . In a narrow sense , AD indicates outlier detection ( OD ) , where the target is the data points with extraordinary properties from most of the rest . Other than outliers , people are more concerned with change point detection ( CPD ) on sequential data since the abrupt characteristic shifts can intimate valuable and crucial information for the temporal trends . OD methods can be grouped into three categories based on the main principle of modeling : 1 ) boundary-based , 2 ) density-based , and 3 ) reconstruction-based approaches . Boundary-based methods use certain distance indexes in the model optimization or the anomaly score calculation . OCSVM is a typical boundary-based method that learns a kernel-based boundary surrounding normal data points on a hyperplane ( Schölkopf et al. , 1999 ) . Isolation Forest ( IF ) , another widely used approach , constructs trees by randomly splitting branches throughout randomly selected features and considers that the average feature path length of an anomaly to the root is larger than that of a normal instance ( Liu et al. , 2008 ) . The main idea of classic density-based methods is performing probability density estimation to maximize the likelihood for normal samples , such as using Gaussian mixture model ( GMM ) for parametric estimation or kernel density estimation ( KDE ) for nonparametric estimation ( Laxhammar et al. , 2009 ; Kim & Scott , 2012 ) . The online algorithm employed a discounting strategy to update the density for sequences ( Yamanishi et al. , 2004 ) . With the development of deep learning , deep structured energy-based models ( DSEBMs ) were proposed to model the distribution of normal data points by using deep architectures ( Zhai et al. , 2016 ) . Another deep method , DAGMM , applies autoencoder to learning data ’ s representations and predict the likelihood based on GMM ( Zong et al. , 2018 ) . Reconstruction-based methods aim to well restore data from compressed feature space for normal data points but not anomalies . Principal component analysis ( PCA ) and its variants are traditional ways for data reconstruction ( Hawkins , 1974 ; Schölkopf et al. , 1997 ; Tharrault et al. , 2008 ) , while variational AE is of deep style without handcrafted features for the sake ( An & Cho , 2015 ) . Methods using GANs can be considered to be hybrid approaches , for they model the distribution by regenerating data points in the zero-sum-game scheme , such as AnoGAN ( Schlegl et al. , 2017 ) , adversarially learned anomaly detection ( ADLD ) ( Zenati et al. , 2018 ) , Mahalanobis distance-based adversarial network ( MDAN ) ( Hou et al. , 2020 ) . For CPD , there is a similar taxonomy to OD . Fast low-cost online semantic segmentation ( FLOSS ) calculates the contextual boundaries based on the shapes of sequential patterns to eject change points ( Gharghabi et al. , 2019 ) . The autoregressive model updates the parametric probability density function across sequential data points ( Yamanishi & Takeuchi , 2002 ) . Relative unconstrained leastsquares importance fitting ( RuLSIF ) identifies whether two contiguous subsequences are from different distributions using the nonparametric divergence estimation ( Liu et al. , 2013 ) . KL-CPD gives the distribution discrepancy by using a learnable deep kernel function and reconstructing samples from two sequential segments with RNNs ( Chang et al. , 2019 ) . Entropy and shape aware time-series segmentation ( ESPRESSO ) is a hybrid approach that combines the temporal density and distance to detect changes and obtained better performance than employing one principle ( Deldari et al. , 2020 ) . Another self-supervised contrastive learning method TS-CP2 takes the subsequences which are not contiguous with the current subsequence as the negative samples for the training and then predicts whether the two subsequences are from the same distribution ( Deldari et al. , 2021 ) . TS-CP2 employs temporal convolutional networks ( TCNs ) ( Bai et al. , 2018 ) to learn contextual representations , while ours introduces the MCC layer to capture the contextual information and allows using arbitrary feature extraction networks for each data point . 2.2 CONTRASTIVE LEARNING . Recently , contrastive learning ( CL ) has grabbed much attention due to the benefit of avoiding the high cost of labeling large-scale datasets for deep representation learning in an unsupervised/selfsupervised manner ( Jaiswal et al. , 2021 ) . CL has been used for various data formats , including images ( Chen et al. , 2020 ; He et al. , 2020 ) , time series ( van den Oord et al. , 2018 ; Franceschi et al. , 2019 ) , videos ( Sermanet et al. , 2018 ; Qian et al. , 2021 ) , texts ( van den Oord et al. , 2018 ; Gao et al. , 2021 ) , and graphs ( You et al. , 2020 ; Zhu et al. , 2020 ) . The basic strategy of CL is to train a model that makes the feature distances between similar instances closer but the ones between diverse instances as far as possible . For this sake , CL methods design pretext tasks to optimize the distances and use contrastive loss or triplet loss as the learning objective ( Chen et al. , 2020 ) . Recently , data augmentation has been commonly introduced into the pretext tasks to help the feature extraction . While image data are relatively easy to augment by using conventional computer vision techniques ( Shorten & Khoshgoftaar , 2019 ) , there are several word-level ( Wei & Zou , 2019 ) and sentence-level ( Kobayashi , 2018 ) approaches for textual data augmentation . For other data formats , some domain-agnostic methods were proposed , such as adding Gaussian noise ( GN ) to embeddings ( DeVries & Taylor , 2019 ) or dropout noise ( DN ) in representation layers ( Gao et al. , 2021 ; Liang et al. , 2021 ) . GN and DN are not only easy to implement but also have low computational costs for CL tasks . In SimCLR , given a cluster of augmentation Λ and an input x , two augmentation operator λa ∼ Λ and λb ∼ Λ generate two similar instances xa = λa ( x ) and xb = λb ( x ) . Then , the feature extraction network f encodes xa and xb into two representations ha = f ( xa ) and hb = f ( xb ) . Next , the head network g projects ha and hb into two embeddings za = g ( ha ) and zb = g ( hb ) , whose similarity is maximized by minimizing a contrastive loss , the NT-Xent loss : ` NTX ( a , b ) = − log exp ( sim ( za , zb ) /T ) ∑2N n=1 exp ( sim ( za , zn ) /T ) [ n 6= a ] ( 1 ) sim ( u , v ) = u > v ‖u‖‖v‖ , ( 2 ) where T is temperature , and N denotes the minibatch size . Since the value range of Equation 2 is [ −1 , 1 ] , it is usual to set 0 < T < 1 for an efficient learning . Here , we can regard the similarity as state energy E. According to the Boltzmann distribution , the probability of a state ρ satisfies ρ ∝ exp ( −E/kT ) , where the right hand side is called the Boltzmann factor , and k is a constant ( Kittel , 2004 ) . If we use similarity to represent a sequential relationship , we can model the probability of the relationships . Also , we can adapt the temperature to control the sensitivity of the relationship ’ s strength to the probability . This finding motivated the objective function design in our method , which we will describe in Section 3.2.2 .

Summary: The paper tackles the anomaly detection of time series data. The main idea is to exploit both the sequential relation between data and the normality of the data itself. The model is learned with two stages. First, the model is learned with the sequential contrastive loss to learn data representations. Then the model is learned by minimizing the distribution between normality and exceptional relationship probability. The learning process is a self-supervised way without any supervision. The model is validated with KDDCup99 and HASC datasets.