Unsupervised real-time anomaly detection for streaming data

By Subutai Ahmad, Alexander Lavin, Scott Purdy, Zuha Agha. Neurocomputing, 2017

953 citations recorded by the source corpus.

Abstract We are seeing an enormous increase in the availability of streaming, time-series data. Largely driven by the rise of connected real-time data sources, this data presents technical challenges and opportunities. One fundamental capability for streaming analytics is to model each stream in an unsupervised fashion and detect unusual, anomalous behaviors in real-time. Early anomaly detection is valuable, yet it can be difficult to execute reliably in practice. Application constraints require systems to process data in real-time, not batches. Streaming data inherently exhibits concept drift, favoring algorithms that learn continuously. Furthermore, the massive number of independent streams in practice requires that anomaly detectors be fully automated. In this paper we propose a novel anomaly detection algorithm that meets these constraints. The technique is based on an online sequence memory algorithm called Hierarchical Temporal Memory (HTM). We also present results using the Numenta Anomaly Benchmark (NAB), a benchmark containing real-world data streams with labeled anomalies. The benchmark, the first of its kind, provides a controlled open-source environment for testing anomaly detection algorithms on streaming data. We present results and analysis for a wide range of algorithms on this benchmark, and discuss future challenges for the emerging field of streaming analytics.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/3dd9ddf2594d7d63af5d361154992ef2abf6d593

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

An Evaluation of Anomaly Detection and Diagnosis in Multivariate Time Series (2021, methodology): “Gauss-D: In the dynamic gaussian scoring function, we replace the static mean and variance of Gauss-S in equation 2 with dynamic mean and variance, μ̂t and σ̂ i t, in order to adapt better to long-term changes occurring during the testing phase [19].”
Compressing RNNs for IoT devices by 15-38x using Kronecker Products (2019, background): “As a result, RNNs can beneﬁt important Internet-of-Things (IoT) applications like wake-word detection (Zhang et al., 2017), human activity recognition (Hammerla et al., 2016; Roggen et al., 2010; Ordonez & Roggen, 2016), and predictive maintenance (Ahmad et al., 2017; Susto et al., 2015).”
Detecting Spacecraft Anomalies Using LSTMs and Nonparametric Dynamic Thresholding (2018, methodology): “complex methodologies such as LSTMs or Hierarchical Temporal Memory (HTM) approaches to detect (contextual anomalies)[2].”
Anomaly Detection in Time Series: A Comprehensive Evaluation (2022, methodology): “1% 1 0 NAB [3] real/synthetic uni 6,302 8.”
Anomaly Detection for IoT Time-Series Data: A Survey (2020, methodology): “The technique is further applied to the anomaly detection problem in [81], [82], [83], [84] of note is the noise resistance of the approach”
TranAD: Deep Transformer Networks for Anomaly Detection in Multivariate Time Series Data (2022, background): “(1) Numenta Anomaly Benchmark (NAB): is a dataset of multiple real-world data traces, including readings from temperature sensors, CPU utilization of cloud machines, service request latencies and taxi demands in New York city [2].”
Smart Anomaly Detection in Sensor Systems (2020, methodology): “[32] uses Hierarchical Temporal Memory to develop an anomaly detection technique suited for unsupervised online anomaly detection.”
A Review on Outlier/Anomaly Detection in Time Series Data (2020, methodology): “(2017) Prediction 7 7 X X O/A Ahmad et al. (2017) Prediction 7 X X* X A Hochenbaum et al.”
Multi-head CNN-RNN for multi-time series anomaly detection: An industrial case study (2019, background): “As a consequence, there has been a proliferation of machine learning techniques for time series anomaly detection [6, 13, 14, 15].”
Deep Learning for Time Series Forecasting: Tutorial and Literature Survey (2020, background): “For instance, one may have only one time series but many thousands of observations, as in the case of a time series from a real-time sensor where measurements happen every second for a year, allowing to fit a complex NN [2].”
Deep Learning for Time Series Anomaly Detection: A Survey (2022, neutral): “• Capturing Hierarchical and Multi-Scale Contexts: HTM models are designed to capture hierarchical and multi-scale contexts in time series data.”
Current Time Series Anomaly Detection Benchmarks are Flawed and are Creating the Illusion of Progress (2020, background): “ld identify visual inspection. 4 RECOMMENDATIONS We conclude with some recommendations for the community. 4.1 Existing Datasets should be Abandoned The community should abandon the Yahoo [5], Numenta [6], NASA [2] and OMNI [3] benchmark datasets. As we have demonstrated, they are irretrievably flawe”
Learning to Classify With Incremental New Class (2021, neutral): “The original model’s performance will suffer decay if novel classes are not detected and the decision boundary stays unchanged. streaming data, namely the emergence of unknown category instances [4]–[8], e.g., in news topic classiﬁcation, new topics will arise [9]; in sneaker identiﬁcation, new…”
A Unifying Review of Deep and Shallow Anomaly Detection (2020, background): “[420] Medical: CAMELYON16 [61], [421], NIH Chest Xray [61], [422], MOOD [423], HCP/BRATS [52], Neuropathology [60], [424] Security: Credit-card-fraud [425], URL [426], UNSWNB15 [427] Time series: NAB [428], Yahoo [429] Misc.: Emmott [418], ELKI [430], ODDS [431], UCI [432], [433] In a second step, w”