# Labeling Expert: A New Multi-Network Anomaly Detection Architecture Based on LNN-RLSTM
## 3 Problem and Goal  
In big data anomaly detection, the KPI data tagged by business operators are called \"underlying facts\" [36]. The primary goal of anomaly detection is accuracy, followed by timeliness. The aim is identifying anomalies that are similar to the \"underlying facts\" in a short enough time to eliminate false alarms.  
Recall\(\left(\frac{\text{number of true anomalous points detected}}{\text{number of true anomalous points}}\right)\) and precision \(\left(\frac{\text{number of true anomalous points detected}}{\text{number of anomalous points detected}}\right)\) are used to measure the accuracy of anomaly detection in this paper.  
For business operators, _Precision_ describes something more important than _false-positive rate_ (FPR) [37], because most anomalous data points are rare. According to [PERSON] et al. [38], operators not only understand the concept of _recall rate_ and _precision_ but can also express their tendency to detect anomalous data with accuracy using \"_recall_ \(\geq x\) and _precision_ \(\geq y\), which comes from the operator's experience with other detectors.  
In this paper, the different accuracy criteria of the business operators will determine the size of the hidden layers and training update frequency of the LNN-RLSTM neural network. The LNN-RLSTM neural network will modify the configuration parameters by the accuracy preference of the business operator. Of course, for the training of the network, the lower the accuracy, the lower the required detection time and complexity will be. For conventional detectors, it is relatively difficult for these detectors to obtain high recall and precision due to the relatively small amount of anomaly data.  
For the problem of few samples, [PERSON] [39] et al. proposed VAEGEN oversampling to augment anomalous samples for the problem of few anomalous samples, but it did not increase the data characteristics of the anomalous data, but only augmented the samples from the original anomalous data. Overall, the problem of less identification of anomalous data has not been well solved. In fact, the requirements of recall and precision are usually adjusted according to the actual needs. For example, busy operators are more concerned with accuracy because they do not want to be constantly distracted by many false alarms, while the labeling neural network (LNN) proposed in this paper would be good at filtering out false alarms and allowing operators to focus only on \"individual anomalies\". On the other hand, if the operator's task is to focus only on a single KPI or on a major KPI, he will care more about the value of recall.  
In addition, traditional unsupervised machine learning algorithms (e.g., isolated forest, LOF, etc.) will fail when faced with the problem of \"clustering of anomalies\", as shown in Figure 2, where the set of anomalies may form an aggregated cluster, making it difficult to distinguish from normal clusters. Based on this, the concept of \"anomaly cycle detection\" is introduced and tries to solve the anomaly clustering problem using LNN-RLSTM neural networks.  
This paper focuses on identifying anomalous behaviors in the KPI time series of user-aware class networks. This is the first solution to the anomaly detection problem using a semi-supervised dual neural network algorithm and the first approach to label data at the business and data layers using labeled neural networks. However, the user-aware class of network KPIs discussed in this paper is somewhat seasonal, and other forms of KPI data types are not reflected in the practice of the algorithm in this paper, but this does not mean that our proposed LNN-RLSTM neural network model is not applicable to the unstable big data environment. On the contrary, it is also possible to make our model applicable to other data types by adjusting the window parameters and other methods, but we do not elaborate on them in this paper.