2023/05/07 by Len Feremans, Feremans, Len, Boris Čule +3
Computer Science · #Anomaly Detection Techniques and Applications #Artificial Intelligence (cs.AI) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Network Security and Intrusion Detection #Networking and Internet Architecture (cs.NI) #Social and Information Networks (cs.SI) #Time Series Analysis and Forecasting
paper · pdf · doi:10.48550/arxiv.2305.05538
openalex publication_date 2023/05/07 · openalex created_date 2023/05/12 · openalex updated_date 2026/07/28
Many organisations manage service quality and monitor a large set devices and servers where each entity is associated with telemetry or physical sensor data series. Recently, various methods have been proposed to detect behavioural anomalies, however existing approaches focus on multivariate time series and ignore communication between entities. Moreover, we aim to support end-users in not only in locating entities and sensors causing an anomaly at a certain period, but also explain this decision. We propose a scalable approach to detect anomalies using a two-step approach. First, we recover relations between entities in the network, since relations are often dynamic in nature and caused by an unknown underlying process. Next, we report anomalies based on an embedding of sequential patterns. Pattern mining is efficient and supports interpretation, i.e. patterns represent frequent occurring behaviour in time series. We extend pattern mining to filter sequential patterns based on frequency, temporal constraints and minimum description length. We collect and release two public datasets for international broadcasting and X from an Internet company. BAD achieves an overall F1-Score of 0.78 on 9 benchmark datasets, significantly outperforming the best baseline by 3%. Additionally, BAD is also an order-of-magnitude faster than state-of-the-art anomaly detection methods.