## 2 System Model and Problem Formulation  
We consider the network anomaly detection and forecasting problem in 5G vertical applications, which consists of three essential components:  
* **Data process:** For the unlabeled network data, we express the set of time periods and that of data dimensions as \(\mathcal{T}=\{1,\ldots,T\}\) and \(\mathcal{M}=\{1,\ldots,M\}\), respectively. On this basis, the time series data of length \(T\) can be expressed as \(\mathcal{D}=\{\mathbf{d}_{t}\}_{t=1}^{T}\), where \(\mathbf{d}_{t}\in\mathbb{R}^{M}\) denotes the network data at a specific time point \(t\) with dimensions of \(M\). To capture the relationship between the current time point and its previous ones, a processing procedure is necessary for the network data. This procedure transforms the data into a series of window data, denoted by \(\mathcal{W}=\{\mathbf{w}_{t}\}_{t=1}^{T}\). Each window data at time point \(t\) is defined as a sequence of \(\mathbf{d}_{t}\) from \(t-K+1\) to \(t\), expressed as \(\mathbf{w}_{t}=\{\mathbf{d}_{t}\}_{t=t-K+1}^{T}\). It is worth noting that the length of each window data is \(K\).
* **Anomaly detection:** Anomaly detection is applied to the processed window data \(\mathcal{W}\) using an anomaly detection model. The underlying principle of anomaly detection involves training the model on known data samples and assessing the abnormality level of new data samples based on this learned representation. By establishing a threshold \(\eta\), when the abnormality level of a new data sample surpasses the threshold at a given time point, it is classified as an anomaly. Hence, to identify the presence of anomalies in the new data samples, it is crucial to obtain a series of anomaly labels, which can be represented as \(\mathcal{L}=\{l_{t}\}_{t=1}^{T}\), where \(l_{t}\) indicates whether there is an anomaly in the sample at time point \(t\).  
Figure 1: The illustration of the anomaly detection and forecasting problem.  
* **Anomaly forecasting:** In contrast to anomaly detection, anomaly forecasting focuses on identifying anomalies in future time data. To accomplish this, the processed window data \(\mathcal{W}\) is initially used as input for a prediction model, which generates the forecasts of the network data for the upcoming time points denoted by \(\mathcal{P}=\{\mathbf{p}_{t}\}_{t=1}^{T}\). Subsequently, an anomaly detection model is applied to the predicted data, enabling the detection of abnormal patterns and providing a series of anomaly labels. Consequently, this approach facilitates accurate anomaly forecasting.  
It is evident that the key aspect of both anomaly detection and anomaly forecasting problems revolves around identifying a suitable anomaly detection model, as anomaly forecasting essentially entails performing anomaly detection on the predicted data. With regard to the window data, assuming the historical data samples and new data samples are denoted by \(\mathcal{W}\) and \(\tilde{\mathcal{W}}\), respectively, the primary objective of the anomaly detection model is to determine the following anomaly scores, which enable the assessment of the abnormality level of the new data samples:  
\[\mathcal{Y}=f\big{(}\mathcal{W};\tilde{\mathcal{W}}\big{)} \tag{1}\]  
After obtaining the aforementioned anomaly scores, it is possible to determine the abnormality of a specific time point by comparing the anomaly score, denoted by \(\mathbf{t}_{t}\), with a threshold value \(\eta\).  
To achieve (1), traditional methods typically rely on sample classification and similar techniques. However, in the context of 5G vertical applications, network data often lack labeled information. To address this challenge, we propose a novel approach by combining autoencoder and generative adversarial network (GAN). Leveraging the reconstruction error from autoencoder and the adversarial framework of GAN, we successfully obtain anomaly scores.  
For clarity, the main notations are summarized in Table 1.