Anomaly Detection with Generative Adversarial Networks for Multivariate Time Series

By Dan Li, Dacheng Chen, Jonathan Goh, See-Kiong Ng. arXiv.org, 2018

329 citations recorded by the source corpus.

Today's Cyber-Physical Systems (CPSs) are large, complex, and affixed with networked sensors and actuators that are targets for cyber-attacks. Conventional detection techniques are unable to deal with the increasingly dynamic and complex nature of the CPSs. On the other hand, the networked sensors and actuators generate large amounts of data streams that can be continuously monitored for intrusion events. Unsupervised machine learning techniques can be used to model the system behaviour and classify deviant behaviours as possible attacks. In this work, we proposed a novel Generative Adversarial Networks-based Anomaly Detection (GAN-AD) method for such complex networked CPSs. We used LSTM-RNN in our GAN to capture the distribution of the multivariate time series of the sensors and actuators under normal working conditions of a CPS. Instead of treating each sensor's and actuator's time series independently, we model the time series of multiple sensors and actuators in the CPS concurrently to take into account of potential latent interactions between them. To exploit both the generator and the discriminator of our GAN, we deployed the GAN-trained discriminator together with the residuals between generator-reconstructed data and the actual samples to detect possible anomalies in the complex CPS. We used our GAN-AD to distinguish abnormal attacked situations from normal working conditions for a complex six-stage Secure Water Treatment (SWaT) system. Experimental results showed that the proposed strategy is effective in identifying anomalies caused by various attacks with high detection rate and low false positive rate as compared to existing methods.

Subfields: Aerospace Engineering, Artificial Intelligence, Control and Systems Engineering

View Paper: https://www.semanticscholar.org/paper/c92ee6ff32fa4833fa1c2bdf29284e2a58ddb640

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Aerospace Engineering

In Artificial Intelligence

In Control and Systems Engineering

Citations in the corpus

Deep Learning for Anomaly Detection: A Survey (2019, background): “SWaT and WADI Secure Water Treatment (SWaT) and the Water Distribution (WADI) Li et al. [2019]”
GIDS: GAN based Intrusion Detection System for In-Vehicle Network (2018, methodology): “Proposed method achieved state-of-the-art performance on standard image benchmark datasets [15].”
Uncertainty-Aware Deep Classifiers Using Generative Models (2020, methodology): “…autoencoder as described in (Golan and El-Yaniv 2018), (d) ADGAN is the anomaly detection method based on generative adversarial networks in (Deecke et al. 2018), (e) DAGMM is the deep autoencoding Gaussian mixture model in (Zong et al. 2018), (f) DSEBM is the deep structured energy-based…”
Practical Approach to Asynchronous Multivariate Time Series Anomaly Detection and Localization (2021, methodology): “For example, cybersecurity attacks [10, 16] or an internal code bug, which could result in service downtime, immediate tangible business losses, and intangible losses from the loss of customer trust, if not detected and remediated promptly.”
Multivariate Time-series Anomaly Detection via Graph Attention Network (2020, methodology): “GAN-Li [10], MAD-GAN [11] and LSTM-VAE [12].”
A Less Biased Evaluation of Out-of-distribution Sample Detectors (2018, background): “There are also ideas that rely on GANs [6, 19, 24, 32] to detect anomalies or novelty in the data.”
Does Your Model Know the Digit 6 Is Not a Cat? A Less Biased Evaluation of "Outlier" Detectors (2018, background): “These methods provide an abstract idea which depends on the successful training of GANs.”
Deep Anomaly Detection Using Geometric Transformations (2018, methodology): “Deecke et al. [7] employ a variation of this model called ADGAN, reporting slightly superior results on CIFAR-10 [18] and MNIST [19].”
Review of Bridge Structural Health Monitoring Aided by Big Data and Artificial Intelligence: From Condition Assessment to Damage Detection (2020, unknown): “To assess the cable condition in a cable-stayed bridge, Li et al. (2018b) calculated the ratio of vehicle-induced cable tension between a cable pair as the low-level feature, and found the feature was only influenced by cable condition and passing vehicles, thus high-level features can be…”
Sub-Image Anomaly Detection with Deep Pyramid Correspondences (2020, methodology): “Another recent development, adversarial training, was also applied to anomaly detection e.g. ADGAN [8].”
Generative Adversarial Active Learning for Unsupervised Outlier Detection (2018, background): “[44] initialize multiple latent vectors from multiple areas in the latent space.”
Unsupervised Deep Anomaly Detection for Multi-Sensor Time-Series Signals (2021, background): “extraction and predictive model building are separated [25],”
Classification-Based Anomaly Detection for General Data (2020, methodology): “We compare our method with the deep one-class method of Ruff et al. (2018) as well as Golan & El-Yaniv (2018) without and with Dirichlet weighting.”
HRN: A Holistic Approach to One Class Learning (2020, background): “They almost exclusively use the neural network representation learning capability to generate a latent representation of the given class [1, 14, 16, 25, 51, 65, 68, 71, 83, 92, 95, 69, 73, 26, 82].”
Anomaly Detection for IoT Time-Series Data: A Survey (2020, methodology): “An unsupervised generative adversarial network is presented in [92] where LSTM is used to capture the temporal nature of the system in both the generator and discriminator portions of the network.”
Learning Graph Structures With Transformer for Multivariate Time-Series Anomaly Detection in IoT (2021, unknown): “on reconstruction [20], [6] and RNN-based forecasting approaches [8], [17] have also reported promising performance for multivariate anomaly detection.”