Abstract. Generative adversarial networks are a class of generative algorithms that have been widely used to produce state-of-the-art samples. In this paper, we investigate GAN to perform anomaly detection on time series dataset. In order to achieve this goal, a bibliography is made focusing on theoretical properties of GAN and GAN used for anomaly detection. A Wasserstein GAN has been chosen to learn the representation of normal data distribution and a stacked encoder with the generator performs the anomaly detection. W-GAN with encoder seems to produce state of the art anomaly detection scores on MNIST dataset and we investigate its usage on multi-variate time series. Keywords: Wasserstein GAN Anomaly Detection Time Series Airbus platforms are more and more connected. Newer aircraft are already equipped with data concentrators and connectivity to transmit sensor data collected during the whole flight to the ground, usually when at the gate. Older aircraft are currently retrofitted to install boxes that are able to do the same job. For military and heavy helicopters, HUMS (Health and Usage Monitoring System) also allows the collection of sensor data. Finally, satellites send regularly to the ground data collected from sensors, called telemetries. Most of the time, the platforms behave normally and faults and failures are rare. To go beyond corrective and preventive maintenance, and anticipate future faults and failures, we have to look for any drift, any change in systems' behavior, in data that is normal almost all the time. Moreover, sensor data we collect is time series data. The problem we have is then anomaly detection in time series data. Generative Adversarial Networks are a popular technique to generate data from an original dataset, which can be of high dimension. In our case, generate new data could be useful to generate abnormal data when they are spotted, but we are more interested in the potential of such techniques to do anomaly detection for high dimensional data, as time series data we are dealing with. Our study will be illustrated by three use cases of increasing complexity, in order to well understand what we do with GAN. One use case is a simple two-dimensional distribution, the second is the classical image database MNIST and the third is a time series problem coming from UCI database. They will be further described in the next section. The third section will be dedicated to the description of GAN, classical and Wasserstein-GAN. The section will mix theoretical formalization and illustrations with the use cases. The fourth section will be dedicated to the usage of GAN for anomaly detection in the literature. It will help to show where our contribution, described in the last section, stands. We will conclude and present potential way forward. The goal of this article is to study the feasibility of performing anomaly detection with generative adversarial networks. We chose three different use cases to better understand how GAN work and their limitations in this field. The first one is a simple 2-dimensional multimodal dataset, the second one deals with high dimensional data such as MNIST images, the last one is a multivariate sensor dataset. First, we chose to study how GAN perform on a simple dataset. We try to learn a simple 2-dimensional distribution charaterized by a mixture of 7 gaussians with centers positioned on the unit circle. This use case have been used in several GAN papers investigating how well GAN perform on multi-modal datasets [7] [10]. The dataset can be seen in Figure 1 In this context, an anomaly is considered as being every point outside the level set of the gaussian centers. We also study the well known MNIST digits dataset shown in Figure 2 . The goal is to build a GAN that generates good visual representations of digits from 0 to 9. The dataset has 60 000 digits for training and 10 000 for testing. Each digit is an image of 28x28 pixels and represents the first step towards the study of high dimensional data. We perform anomaly detection considering one class of digits as being abnomal and train the GAN on the other digits of the training dataset. Testing is performed on the test dataset plus all the anomalous samples. This procedure have been used in [15] and [1] and to investigate the performance of GAN in the field of anomaly detection. To compare results, we compute the Area Under Precision Recall Curve (AUPRC) for each digit. Fig. 2: MNIST Digits This dataset is constituted of mutivariate time series of smartphone sensor data. The movement data recorded was the x, y, and z accelerometer data (linear acceleration) and gyroscopic data (angular velocity) from the smart phone. Observations were recorded at 50 Hz (i.e. 50 data points per second). There are three main signal types in the raw data: total acceleration, body acceleration, and body gyroscope. Each has three axes of data. This means that there are a total of nine variables for each time step. The data is acquired in 6 labeled different situations, the subject carrying the smartphone is whether walking, standing, walking upstairs, walking downstairs or laying. As for the MNIST dataset, we train the GAN and perform anomaly detection considering one class as being abnormal and the others as being normal. Figure 3 shows an example of time series acquisition of 9 sensors for a walking individual on 128 time steps:  Generative Adversarial networks have been proposed by [6] as a new framework for estimating generative models via an adversarial process. Two models are trained simultaneously: a generative model G that captures the data distribution and a discriminative model D that estimates the probability that a sample came from the training data rather than from G. Figure 4 describes the training procedure. The generative model can be thought of as analogous to a team of counterfeiters, trying to produce fake currency and use it without detection, while the discriminative model is analogous to the police, trying to detect the counterfeit currency. Competition in this game drives both teams to improve their methods until the counterfeits are indistinguishable from the genuine articles. Even if this framework can be applied to many kinds of models, the approach is mostly performed with two neural networks for G and D. To learn the generators distribution P g over data x, a prior is defined on input noise variables p z (z), and its mapping to data space as G(z; θ g ). The discriminator D(x; θ d ) is defined to output a single scalar. D(x) represents the probability that x came from the data rather than the generator. G and D play the following two-player minimax game with value function V (G, D): Anomaly detection with Wasserstein GAN 5 We train D to maximize the probability of assigning the correct label to both training examples and samples from G. We simultaneously train G to minimize log[1 − D(G(z)).The algorithm proposed by [14] is presented in Algo.1. Algorithm 1 Minibatch stochastic gradient descent training of generative adversarial nets. The number of steps to apply to the discriminator, k, is a hyperparameter. k = 1 in most of GAN experiments. for number of training iterations do for k steps do Sample {x ∼ p(z) a batch of prior samples. Update the discriminator by ascending its stochastic gradient: ∼ p(z) a batch of prior samples Update the generator by ascending its stochastic gradient: The gradient-based updates can use any standard gradient-based learning rule During the past four years, GAN have been successfully used to produce state of the art samples in image generation. In the next subsection, we investigate in more details their mathematical properties. GAN properties , and is still subject to fundamental research. In this section, we describe some optimality characteristics of GAN convergence. • Let us consider the data space X as being a d-dimensional borelian subset of R d , dominated by a mesure µ, and (X 1 , .., X n ) ∼ P r on X . Each sample X i is a random variable that takes values on a high dimensional space (d >> 1). • The Generators are considered to be part of a parametric family of functions G = {G θ } θ∈Θ , where G θ : R d → X . The latent space R d is usually a much lower dimensional space than X (d << d). By having Z ∼ N (0, 1) d , we can define G θ (Z) ∼ P θ , where P θ ∈ {P θ } θ∈Θ is a potential candidate to represent P r . • The Discriminators are also part of a parametric family of functions D = {D α } α∈Λ , where To this point, we assume that the generator and the discriminator can actually be simulated by any parametric model (not necessarily neural networks). Also, we do not assume that the target distribution P r correspond to a specific parameterization θ, since we only have samples from P r . The goal of this section is to study the links and deviations between these two distributions at optimality. The standard objective function in GAN training is: We want to describe the following errors: 1. The error of the optimal distribution P θ due to the parameterization of the generator in θ 2. The error of the optimal distribution P θ due to the parameterization of the discriminator in α 3. The generalization error of the model due to the sample size n To compare probability distributions, we use the Jensen-Shannon divergence as in [3] . Figure 5 helps keep track of these error. To quantify the first error, we rewrite the objective relatively to P r only: If L is bounded, then: The optimal discriminator is :  Where D JS denotes for Jensen-Shannon divergence Theorem 2. Optimal parameterized generator: If ∃ m,M such that : m ≤ P r ≤ M and ∀θ ∈ Θ, P θ ≤ M , then: The above theorem demonstrated in [3] shows the existence of an optimal parametric generator independently from the discriminator parameterization and the sample size n. Figure 5 illustrates in green the Jensen-Shannon divergence between the true distribution P r and this optimal generator distribution P θ * . In order to perform optimization in practice, a parameterization of the discriminator is also needed and results in an additional approximation error on θ. In practice, the set of all possible discriminators is only a subset of Theorem 3. Error on discriminator parameterization: This second theorem shows that under certain conditions, the parameterization of the discriminator results in an error on the generator distribution P θ . Figure 5 shows in black the resulting Jensen-Shannon divergence between the true distribution P r and the optimal generator distribution after parameterization of the discriminator P θ Sample size and distribution convergence We are interested on evaluating the error between the true distribution of the dataset P r and the generator distribution P θ , knowing the parameterization of the generator in θ, the parameterization of the discriminator in α and the sample size n of the dataset. To do so, we go back to the original GAN formulation we want to minimize w.r.t θ and maximize w.r.t. α: Let's consider the following theorem from [3]: Suppose (H ): The above theorem tells us that under some reasonable conditions, the error on the generator convergences towards the true distribution P r is proportional to , which is illustrated in blue in Figure 5 . Actually, if the generator is C 2 w.r.t θ with bounded derivatives, the discriminator is bounded and C 2 w.r.t α and x with bounded derivatives, P θ is C 2 w.r.t θ also with bounded derivatives, then the larger the sample size the lower the generalization error and we can show thatθ → θ andα → α [3]. Anomaly detection with Wasserstein GAN 9 Summary In a nutshell, the Jensen-Shannon divergence seems to be a good metric to compare distributions during GAN training. Also, the parameterization of the discriminator part of the GAN results in an incompressible error that can only be mitigated by the choice of the discriminator. Finally, the larger sample size the better the convergence towards the data distribution. All these errors are described in Figure 5 where the space corresponds to all functions defined in X −→ [0, 1]. In addition, the results demonstrated in [3] are independent from the chosen parameterization. Most GAN training procedures use Neural Networks as parameterized functions which involves fine tuning of hyperparameters in order to achieve the desired convergence. To apply Generative Adversarial Networks, we use two fully connected neural networks as the generator and the discriminator in order to learn the distribution of the first use case. Both networks have two hidden layers of 128 neurons each. The latent space have a dimension of two and the noise is sampled from a gaussian distribution with 0 mean and 1 variance. We sample 100 000 2-dimensional points from the mixture of gaussians and constitute our dataset. We perform standard learning procedure on this dataset and obtain a loss curve
An auxiliary encoder is also needed in the Wasserstein GAN based framework proposed in REF , which only requires an additional training stage.
Anomaly detection with Wasserstein GAN
ArXiv
ArXiv
Computer Science Mathematics