Deep Generative model with Hierarchical Latent Factors for Timeseries Anomaly Detection
Abstract
Multivariate time-series anomaly detection has become an active area of research in recent years, with Deep Learning models outperforming previous approaches on benchmark datasets.
Among reconstruction-based models, almost all previous work has focused on Variational Autoencoders and Generative Adversarial Networks.
This work presents DGHL, a new family of generative models for timeseries anomaly detection, trained by maximizing the observed likelihood directly by posterior sampling and alternating gradient-descent.
A top-down Convolution
Network maps time-series windows to a novel hierarchical latent space, exploiting temporal dynamics to encode information efﬁciently.
Despite relying on posterior sampling, it is computationally more efﬁcient than current approaches, with up to 10x shorter training times than RNN based models.
Our method outperformed other state-of-the-art models on four popular benchmark datasets. Finally, DGHL is robust to variable features between entities and accurate even with large proportions of missing values, settings with increasing relevance with IoT. We demonstrate the superior robustness of DGHL with novel occlusion experiments in this literature.
Introduction
Recent advancements in Deep Learning such as Recurrent Neural Networks (RNN), Temporal Convolution Networks (TCN) and Graph Networks (GN) have been successfully incorporated by recent models to outperform previous approaches such as out-of-limits, clustering-based, distance-based, and dimensionality reduction.
[2] [14] present comprehensive reviews of current state-of-the-art methods for time-series anomaly detection.
In this work we propose DGHL a novel Deep Generative model based on a top-down Convolution
Network (ConvNet) which maps multivariate time-series windows to a novel hierarchical latent space.
The model is trained by maximizing the observed likelihood directly with the Alternating
Back-Propagation algorithm, so it does not rely on auxiliary networks such as encoders or discriminators as VAEs and GANs do.
DGHL, therefore, comprehends a separate family of generative models, previously unexplored for time-series anomaly detection.
We perform experiments on several popular datasets and show the proposed model outperforms the recent state-of-the-arts while reducing training times against previous reconstruction-based and generative models.
With IoT, we believe that settings with corrupted or missing data have increasing relevance.
For example, faulty sensors can cause missing values, privacy issues on consumer electronics devices, or heterogeneous hardware can lead to variable features.
We present the ﬁrst extensive analysis on the robustness of current state-of-the-art models on datasets with missing inputs and variable features with novel occlusion experiments.
DGHL achieved superior performance on this setting, maintaining state-of-the-art performance with up to 90% of missing data, without modiﬁcation to the architecture or training procedure.
We perform additional qualitative experiments of our model to assess desirable properties of lower-dimensional representations such as continuity and extrapolation capabilities.
Finally, we show how DGHL can be used as a forecasting model, demonstrating its versatility on various time-series tasks.
The main contributions of our paper are:
• Short-run MCMC .
First time-series anomaly detection generative model based on shortrun MCMC for estimating posterior of latent variables and inferring latent vectors.
In particular, ﬁrst application of Alternating Back-Propagation algorithm for learning generative model for time-series data.
• Hierarchical latent factors .
We present a novel hierarchical latent space representation to generate windows of arbitrary length.
We demonstrate with ablation studies how DGHL achieves state-of-the-art performance by leveraging this representation on four benchmark datasets.
• Robustness to missing data .
We present the ﬁrst experiments on robustness to missing inputs of state-of-the-art anomaly detection models, and demonstrate DGHL achieves superior performance in this setting.
• Open-source implementation .
We publish an open implementation of our model and full experiments for reproducibility of the results of the paper.
Related Work 2.1 Reconstruction-based models
Reconstruction-based models learn representations for the time-series by reconstructing the input based on latent variables.
The reconstruction error or the likelihood are commonly used as anomaly scores.
Among these models, variational auto-encoders (VAE) are the most popular.
The LSTMVAE, proposed in [13], uses LSTM both as encoders and decoders and models the reconstruction error with support vector regression (SVR) to have a dynamic threshold based on the latent space vector.
OmniAnomaly [17] improves on the LSTM-VAE by adding normalizing planar ﬂows to increase the expressivity and including a dynamic model for the latent space.
Generative Adversarial Networks (GANs) were also adapted for anomaly detection as alternatives to VAE, with models such as AnoGAN [15], MAD-Li [7], and MAD-GAN [8].
For instance, in
MAD-GAN, a GAN is used to generate short windows of time-series with LSTM Generator and
Discriminator networks.
The anomaly score considers both the reconstruction error of the reconstructed window by the Generator network and the score of the Discriminator network.
Most recent models propose to detect anomalies directly on the latent representation and embeddings.
THOC [16] proposed to use one-class classiﬁers based on multiple hyperspheres on the representations on all intermediate layers of a dilated RNN.
NCAD [1] uses a TCN to map context windows and suspect windows into a neural representation and detect anomalies in the suspect window on the latent space with a contextual hypersphere loss.
Virtually all current models, including our proposed approach, rely on mapping the original timeseries input into embeddings or a lower-dimensional latent space.
DGHL, however, is trained with the Alternating Back-Propagation (ABP) algorithm, presented in [4].
ABP maximizes the observed likelihood directly; it does therefore not rely on variational inference approximations or auxiliar networks such as discriminators.
Instead, our approach uses MCMC sampling methods to sample from the true posterior to approximate the likelihood gradient.
Several generative models which rely on MCMC sampling, and in particular Langevin Dynamics, have shown state-of-the-art performance on computer vision [11] and NLP [12] tasks.
To our knowledge, this algorithm has not been used for time-series forecasting and time-series anomaly detection.
We present the ABP algorithm in the next subsection.
2.2 Alternating Back-Propagation
Let y ∈
R D be a data vector such as a time-series window or an image, and z ∈ R d a latent vector.
Let { y ( i ) , i = 1 , ..., n } be a training set.
Consider the following generative model,
[Equation]
with z ∼ N (0 , I d ) , " ∼ N (0 , σ 2 I D ) , D > d and θ the learnable parameters of the Generator model f .
For instance, the classic factor analysis model corresponds to f
= θ z .
In this work, we consider top-down Convolution Networks (ConvNet), however, this framework allows for other types of Generator functions such as fully-connected networks (MLP) or Recurrent Neural Networks (RNN).
The proposed Alternating Back-Propagation algorithm learns parameters θ by maximizing the observed log-likelihood directly, given by,
[Equation]
The observed likelihood L ( θ ) is analytically intractable.
However, the gradients L ′ ( θ ) can be simpliﬁed to,
[Equation]
where p θ ( z | y )
= p θ ( y , z ) /p
θ ( y ) is the posterior.
The expectation in the previous equation can be approximated with the Monte Carlo average by taking samples using MCMC.
In particular, Alternating Back-Propagation takes a single sample of the posterior using Langevin Dynamics [9], a
Hamiltonian Monte Carlo algorithm, which iterates,
[Equation]
where " t ∼ N (0 , I D ) , t is the time step of the dynamics, s is the step size, and σ z controls the relative size of the injected noise.
This iteration is an explain-away process where latent factors are chosen such that the current residual on the reconstruction, y − f ( z t , θ ) , is minimized.
With large values of σ z , the posterior will be close to the prior, while small σ z allows for a richer posterior.
The iterative process is truncated to a predeﬁned number of iterations, and the rejection step is not considered.
As explained in [9], for an observation y ( i ) , the resulting vector is a sample from an approximated posterior, p θ ( z | y ( i ) ) . The Monte Carlo approximation of the gradient then becomes,
[Equation]
Algorithm 1 presents the alternating back-propagation algorithm with mini-batches.
Analogous to the EM algorithm [3], it iterates two distinct steps: (1) inferential back-propagation and (2) learning input : training examples { y ( i ) , i = 1 , ..., n } , Langevin steps l , learning iterations T output: learned parameters θ , inferred latent vectors { z ( i ) , i = 1 , ..., n }
Let t ← 0 , initialize θ
Initialize z
( i ) , for i
= 1 , ..., n while t <
T do
Take a random mini-batch { y ( j ) , j = 1 , ...b } .
Inferential back-propagation: For each j , run l steps of Langevin dynamics to sample z ( j ) ∼ p ( z | y ( j ) , θ ) following equation 4.
Learning back-propagation: Update θ ← θ + γ t L ′ ( θ ) , following equationt ← t + 1 end back-propagation . During (1), the latent vectors { z ( i ) } are inferred for a sample { y ( i ) , i = 1 , ..., b s } . In step (2), { z ( i ) } are used as input of the Generator model f and parameters θ are updated with SGD.
One disadvantage of MCMC methods is the computational cost.
Langevin Dynamics, however, relies on the gradients of the Generator function, which can be efﬁciently computed with modern automatic differentiation packages such as Tensorﬂow and Pytorch.
Moreover, back-propagation on ConvNet is easily parallelizable in GPU.
Several recent works, have shown models trained with alternating back-propagation [4], [20] and short-run MCMC [10] achieved state-of-the-art performance in computer vision and NLP tasks while remaining computationally efﬁcient and comparable in training time to methods relying solely on SGD.
We discuss training and inference times on section 4.
DGHL 3.1 Hierarchical Latent Factors
The model described in Equation 1 generates observations independently.
We extend this model with a novel hierarchical latent factor space.
Let Y ∈
R m × s w be a window of size s w of a multivariate time-series with m features.
The window Y is further divided in sub-windows of equal length
Y j ∈ R m × swaL , j = 0 , ..., a L .
The structure of the hierarchy is speciﬁed by a =
[ a 1 , ..., a L ] , where
L is the number of levels, and a l determines the number of consecutive sub-windows with shared latent vector on level l , with a l | a L .
Our model for each sub-window Y j of Y is given by,
[Equation]
where F α is the Encoder model parametrized by α , G β is the Generator model , parametrized by β , s j ∈ R
d is the state vector, and e j ∼ N (0 , I D ) , and
[Equation]
is the hierarchical latent factor space for window Y .
For the Encoder model we used a concatenation layer.
For the Generator model we used a classic top-down Convolution Network (ConvNet), which maps an input state vector to a multivariate time-series window.
The Encoder model for each subwindow has L latent vectors inputs.
On each level l , the latent vectors of a l consecutive sub-windows are tied.
For instance, the latent vector on the highest layer, L , is shared by all sub-windows of Y .
Figure 1 shows an example of a hierarchical latent space with a = [1 , 3 , 6] .
The key idea of the hierarchical latent space is to leverage dynamics on the time-series, such as seasonalities, to encode the information on the latent space more efﬁciently, i.e., with lower-dimensional vectors.
The hierarchical latent space allows generating realistic time-series of arbitrary length while preserving long-term dynamics of the time-series.
The hierarchical structure can be incorporated as hyper-parameters to be tuned or pre-deﬁned based on domain knowledge.
For instance, hierarchies can correspond to the multiple known seasonalities on the time-series.
The hierarchical latent space Z is jointly inferred using Langevin Dynamics.
The relative size of the lowest level state vector and the upper levels controls the ﬂexibility of the model.
Larger lower hierarchy level vectors make the model more ﬂexible, making it robust to normal changes or randomness in long-term dependencies of the time-series and therefore reducing false positives by reducing the reconstruction error.
Larger tied vectors will make the model more strict, better for detecting contextual anomalies.
The independent model described in the previous subsection can be seen as a single level hierarchical latent space model, with a = [1] , in the current framework.
Previous work such as OmniAnomaly incorporates transition models to learn dynamics in the latent space.
We believe our proposed hierarchical latent factors structure has several advantages over transition models.
First, the computational cost and training time is lower for the proposed model since it does not rely on sequential computation and therefore on back-propagation through time for training parameters.
Second, transition models implicitly assume the dynamics are constant over time, a non-realistic assumption in many settings.
Our solution allows the model to share information across windows to model long-term dynamics without relying on a parametric model which assumes constant dynamics.
3.2 Training
The parameters α and β of DGHL are learned with the Alternating Back-Propagation algorithm described in the previous subsection.
First, the training multivariate time-series Y ∈ R m × T with m features and T timestamps, is divided in consecutive windows of size s w and step size s in a rolling-window fashion.
In each iteration, the algorithm ﬁrst randomly samples b windows.
During the inference step, the hierarchical latent vectors are inferred simultaneously with Langevin Dynamics.
The inferred vectors are the inputs to the Encoder and Generator models, and parameters are updated during the learning step .
We use Adam optimizer for learning parameters with default parameters [6].
As described in [18], Bayesian posterior sampling provides inbuilt protection against overﬁtting.
The MCMC sampling allows DGHL to model complex multivariate time-series, while reducing the risk of overﬁtting.
This is particularly helpful on problems with small training sets.
3.3 Online Anomaly Detection
By learning how to generate time-series windows based on the training data Y , DGHL implicitly learns normal (non-anomalous) temporal dynamics and correlations between the multiple timeseries.
In this subsection, we explain the proposed approach to reconstruct windows on unseen test data Y test to detect anomalies.
In Online Anomaly Detection we consider the test set
Y test ∈
R m × T test to be a stream of m timeseries.
The goal is to detect anomalies (the evaluation is equivalent to a supervised setting with two classes) as soon as possible.
As with the training set, Y test is ﬁrst divided in consecutive windows with the same parameters s w and s .
We propose to reconstruct and compute anomalies scores one window at a time.
Let Y t ∗ be the current window of interest.
The latent space Z t ∗ is jointly inferred to reconstruct the target window, namely ˆ Y t ∗ .
The anomaly score for a particular timestamp t in the window is computed as the Mean Square Error (MSE) considering all m time-series, given by[-
 [Equation]-]
[Equation]
The size of the window s w and step size s control how sooner anomalies can be detected.
With a smaller s , anomaly scores for newer values in the stream are computed sooner.
When s < s w , consecutive windows have overlapping timestamps.
In this case, scores are updated by considering the average reconstruction.
In datasets with multiple entities (for instance, machines in SMD), we divide the scores by the accumulated standard deviation of scores before window t ∗ .
One main difference with the inference step during training is the removal of the Gaussian noise, $ t , of the Langevin Dynamics update equation.
The inferred factors then correspond to the maximum a posteriori mode, which in turn minimizes the reconstruction error conditional on the learned models
F and G .
This novel strategy makes DGHL unique among reconstruction-based models: it avoids overﬁtting during training by sampling from the posterior with Langevin Dynamics and minimizes the reconstruction error to reduce false positives by MAP estimation. Many previous models rely on complex and unusual speciﬁc scores, but DGHL uses the simple MSE.
The anomaly scores of our approach are interpretable, since they can be desegregated by the m features.
Users can rank the contribution to the anomaly score of each feature to gather insights of the anomaly.
Experiments 4.1 Datasets
Server Machine Dataset (SMD) − Introduced in [17], SMD is a multivariate time-series dataset with 38 features for 28 server machines, monitored during 5 weeks.
The time-series include common activity metrics in servers such as CPU load, network and memory usage, among others.
Both training and testing sets contain around 50k timestamps each, with 5 % of anomalous cases.
We trained separate models for each machine as suggested by the authors but with the same hyperparameters.
Soil Moisture Active Passive satellite (SMAP) and Mars Science Laboratory rover (MSL) − Published by NASA in [5], they contain real telemetric data of the SMAP satellite and MSL rover.
SMAP includes 55 multivariate time-series datasets, each containing one anonymized channel and 24 variables encoding information sent to the satellite.
MSL includes 27 datasets, each with one telemetry channel and 54 additional variables.
Again, we train separate models for each telemetry channel, considering additional variables as exogenous, ie.
only the anomaly score of the telemetry channel was used for detecting anomalies.
Secure Water Treatment (SWaT) − Is a public dataset with information of a water treatment testbed meant for cyber-security and anomaly detection research.
It contains network trafﬁc and data from 51 sensors for 11 days, 7 days of normal operation (train set) and 4 days with cyber attacks (test set).
4.2 Evaluation
We evaluate the performance of DGHL and benchmark models on the four datasets with the F 1score, considering the anomaly detection problem as a binary classiﬁcation task where the positive class corresponds to anomalies.
Anomalies often occur continuously over a period of time creating anomalous segments.
[21] proposed an adjustment approach, where the predicted output is relabeled as an anomaly for the whole continuous anomalous segment if the model correctly identiﬁes the anomaly in at least one timestamp.
We use this adjustment technique for SMAP, MSL and SMD datasets to make results comparable with existing literature.
Moreover, we followed the common practice of comparing the performance using the best F 1 -score, by choosing the best threshold on the test set.
For SMAP, MSL and SMD we use a single threshold through the entire dataset (not different thresholds for each machine or channel).
To make our results comparable with previous work, we follow the train, validation and test split described in [16] for SMAP, MSL and SWaT.
For SMD we use the train and test splits described in [17].
All architecture hyper-parameters of the Generator model, training hyper-parameters such as batch size and learning rate, and all hyper-parameters of the Langevin Dynamics were kept constant across the four datasets.
We compare DGHL to current state-of-the art models, such as THOC,
NCAD, and MTAD-GAT; and previous widely used models such as OmniAnomaly, MAD-GAN and LSTM-VAE.
Following [19], we add simple one-line and non Deep Learning approaches such as Mean deviation and Nearest Neighbors.
4.3 Online Anomaly Detection
Table 1 shows the F 1 scores for DGHL, and the benchmark models for SMAP, MSL, SWaT, and
SMD datasets.
Our methods consistently achieves the Top-2 F 1 scores, with overall performance superior to state-of-the-art such as MTAD-GAT [22], THOC and NCAD.
Moreover, our approach achieved the highest performance between all reconstruction based and generative models on all datasets.
DGHL signiﬁcantly outperformed simple baselines in all datasets. The one-line solution ranked worst consistently.
Nearest Neighbors, however, achieved a better performance than several complex models in all datasets with a fraction of the computational cost, demonstrating how simple models need to be considered to understand the beneﬁts of recent models as suggested in [19].
DGHL outperforms other pure reconstruction-based models because inferring latent vectors for computing anomaly scores provides several advantages.
First, it provides additional ﬂexibility and generalization capabilities to prevent false positives, which is instrumental in noisy or non-constant temporal dynamics datasets.
Second, it helps to reduce the lasting impact of anomalies on the reconstruction error over time, reducing false positives once anomalies end.
DGHL took an average of 2 minutes to train for each entity (e.g. one machine of SMD or one chanel of SMAP) consistently across datasets.
For instance, the training time was around 60 minutes for SMD and MSL, and 100 minutes for SMAP.
This is comparable to other state-of-the-art models self-reported training times such as NCAD and faster than RNN based models.
For instance, OmniAnomaly took an average of 20 minutes to train each model for each machine on the SMD dataset.
The inference time varies depending on the length of the test set.
The average time to infertimestamps (average downsampled SMD test set), with s w = 32 , was lower than 5 seconds.
4.4 Online Anomaly Detection with missing data
All current benchmark datasets in the time-series anomaly detection literature assume perfect data.
However, this is not usually the case in real scenarios, with issues like missing values, corrupted data, and variable features.
This section presents the ﬁrst experiments to assess the robustness of current state-of-the-art models to common data issues such as missing values.
In particular, we [Table] adapt the popular occlusion experiments from computer vision literature for training models with incomplete data.
As detailed in section [Table] the ﬁrst step of the ABP algorithm is to infer latent vectors with Langevin
Dynamics.
This is an explain-away process where latent factors are chosen such that the current residual on the reconstruction, Y − f
( Z t , θ ) , is minimized.
The model can intrinsically deal with missing data by inferring Z computing the residuals only on the observed signal Y o .
The inferred vectors then correspond to samples from the posterior distribution conditional on the available signal, p θ ( Z | Y o ) .
Since no explicit learnable parameters map inputs to the latent space, the model is more robust to missing values and outliers (masked as missing data).
Generative models trained with ABP algorithm outperformed VAEs and GANs on experiments with missing information on computer vision and NLP tasks [4].
We deﬁne the occlusion experiments with two parameters.
First, the original time-series Y ∈
R m × T , is divided in r segments of equal length, Y i ∈
R m ×
Tr .
Second, each feature m in each segment is occluded for model training or inference with probability p .
Figure 3 shows an example of occluded data, for a subset of features of one machine of the SMD dataset, with r = 5 and p = 0 . 5 .
Occluded segments are marked in gray.
First, DGHL is able to precisely reconstruct the observed data (white region), even when most features are missing.
This is most relevant for the anomaly detection task, since only the observed features are used to compute the anomaly score.
Second, the model is able to recover missing data with great precision, which can be helpful in complete pipelines with downstream applications.
We assess the robustness of models to incomplete training data with occluding experiments on the
SMD dataset, for different levels of r and p , and using F 1 scores to evaluate performance.
Figure 4 shows the F 1 score for DGHL , LSTM-VAE, and OmniAnomaly.
DGHL achieves the highest scores consistently, with an increasing relative performance on higher data occlusion probability.
Moreover, DGHL maintained high F 1 scores even with up to 90% of missing information, without any changes to the hyperparameters, architecture or training procedure.
4.5 Time-series generation
DGHL is trained to generate time-series windows from a latent space representation.
We examine how DGHL learns the representation by interpolating and extrapolating between two latent vectors,
Z l and Z u , inferred from two windows of a real time-series from the SMD.
The trained Generator network is then used to generate new windows across the interpolation subspace.
Figure 5 presents the generated windows for interpolated and extrapolated vectors for a subset of the original features.
The generated time-series smoothly transition between clear patterns on both shape and scale.
Moreover, DGHL is able to generate meaningful time-series on the extrapolation region.
This experiment shows how our approach maps similar time-series windows into close points of the latent space, which is a desirable property of latent representations.
4.6 Time-series forecasting
This subsection shows how DGHL can be used as a forecasting model without any changes to the training procedure or architecture.
We will perform quantitative analysis on forecasting datasets in future work.
DGHL can forecast future values by masking them during the inference of latent vectors, analogous to how the model handles missing data.
The observed timestamps (left to the forecasting starting timestamp as represented with the vertical line of Figure 6) are used to infer the current latent vector, which then is used to generate the whole window, producing the forecasts.
Figure 6 shows an example of the forecasts produced for a subset of machine-1-1 of the SMD dataset.
In this example, the model is trained to reconstruct and generate windows of size 128.
The ﬁrsttimestamps are available during the inference of the latent vector, and the last 64 corresponds to the forecasted region.
Conclusion
In this paper, we introduced DGHL, a state-of-the-art Deep Generative model for time-series anomaly detection.
The proposed model maps time-series windows to a novel hierarchical latent space representation, which leverages the time-series dynamics to encode information more efﬁciently.
A classic ConvNet is used as the Generator .
DGHL does not rely on auxiliary networks, such as encoders or discriminators; instead, it is trained by maximizing the likelihood directly with the Alternating Back-Propagation algorithm.
Our model has several advantages over existing methods: i. shorter training times, ii. demonstrated superior performance on several benchmark datasets, and iii. better robustness to missing values and variable features.
We will explore how our model performs on the time-series forecasting task in future work.
We do not believe the paper’s contribution can be directly misused to have a negative societal impact.
We recommend performing additional thorough experiments on healthcare before using the proposed approach in applications in this domain.
DGHL required signiﬁcantly less computational resources and training time than most current state-of-the-art models, but it still uses high-performance hardware and more resources than simple non-Deep Learning models.
These additional costs should be considered on applications compared to the improved performance beneﬁts.