Unsupervised Anomaly Detection via Variational Auto-Encoder for Seasonal KPIs in Web Applications

By Haowen Xu, Wenxiao Chen, Nengwen Zhao, Zeyan Li, Jiahao Bu, Zhihan Li, Ying Liu, Youjian Zhao, Dan Pei, Yang Feng and 2 more. The Web Conference, 2018

1,045 citations recorded by the source corpus.

To ensure undisrupted business, large Internet companies need to closely monitor various KPIs (e.g., Page Views, number of online users, and number of orders) of its Web applications, to accurately detect anomalies and trigger timely troubleshooting/mitigation. However, anomaly detection for these seasonal KPIs with various patterns and data quality has been a great challenge, especially without labels. In this paper, we proposed Donut, an unsupervised anomaly detection algorithm based on VAE. Thanks to a few of our key techniques, Donut greatly outperforms a state-of-arts supervised ensemble approach and a baseline VAE approach, and its best F-scores range from 0.75 to 0.9 for the studied KPIs from a top global Internet company. We come up with a novel KDE interpretation of reconstruction for Donut, making it the first VAE-based anomaly detection algorithm with solid theoretical explanation.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/ca04f6fb87815426e1bec8f7fc0dcbbaf9f35814

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Robust Anomaly Detection for Multivariate Time Series through Stochastic Recurrent Neural Network (2019, methodology): “[24] shows that univariate time series in an online shopping website can present complex temporal relationships.”
Multivariate Time-series Anomaly Detection via Graph Attention Network (2020, methodology): “DONUT [21] is an unsupervised anomaly detection method based on Variational Auto-Encoder (VAE), and SR-CNN [1] combines the benefits of Spectral Residual (SR) and convolutional neural network to achieve state-of-the-art performance on univariate time-series anomaly detection.”
Anomaly Detection in Time Series: A Comprehensive Evaluation (2022, methodology): “…[79] HealthESN [32] MTAD-GAT [161] MoteESN[30] RADM[40] MSCRED [159] LSTM-VAE [106] OmniAnomaly [125] OceanWNN [143] Image-embedding-CAE [44] Donut [150] MAD-GAN[77] TAnoGAN [8] PAD[33] Torsk [60] SSA [155] NumentaHTM [3] Telemanom [64] SR-CNN [112] Outlier Detection LOCI/aLOCI[103] MCOD[73]…”
DCdetector: Dual Attention Contrastive Representation Learning for Time Series Anomaly Detection (2023, methodology): “) are proposed to complement their deficiencies [31, 49, 61, 63, 70, 71].”
Deep Learning for Time Series Anomaly Detection: A Survey (2022, neutral): “Donut’s Modified ELBO, Missing Data Injection, and MCMC Imputation make it excellent at detecting anomalies in the seasonal KPI dataset.”
Timeseries Anomaly Detection using Temporal Hierarchical One-Class Network (2020, methodology): “On the MSL and SMAP data sets, we follow [30, 28] and adjust the anomaly detection results as follows: If a point in a contiguous anomalous segment is detected correctly, all anomalies in the same segment are also considered to have been correctly detected.”
A Unifying Review of Deep and Shallow Anomaly Detection (2020, methodology): “used in various forms for anomaly detection [268], [270], [381], for instance on multimodal sequential data with LSTM networks for anomaly detection in robot-assisted feeding [382] and for new physics mining at the Large Hadron Collider [74].”
Time-Series Anomaly Detection Service at Microsoft (2019, methodology): “On the other hand, SPOT, DSPOT and DONUT need additional data to train their models.”
MOMENT: A Family of Open Time-series Foundation Models (2024, background): “…series analysis is an important field encompassing a wide range of applications ranging from forecasting weather patterns (Schneider & Dickinson, 1974) or detecting irregular heartbeats using Electrocardiograms (Goswami et al., 2021), to identifying anomalous software deployments (Xu et al., 2018).”
Practical Approach to Asynchronous Multivariate Time Series Anomaly Detection and Localization (2021, background): “Thus, the authors in [2, 28] adopted a point-adjust approach [32], which adjusts FN intoTP by assuming that it is acceptable if an alert is triggered within any subset of a ground truth anomaly segment.”
Multivariate Time Series Anomaly Detection and Interpretation using Hierarchical Inter-Metric and Temporal Embedding (2021, methodology): “Thus, we adopt the point-adjust approach, which is proposed by [33] and widely used in the evaluation of detection tasks [2, 23, 27, 30].”
FITS: Modeling Time Series with 10k Parameters (2023, methodology): “To handle consecutive abnormal segments, we adopt a widely-used adjustment strategy (Su et al., 2019; Xu et al., 2018; Shen et al., 2020), considering all anomalies within a specific successive abnormal segment as correctly detected when one anomalous time point is identified.”