DC-VAE, Fine-grained anomaly detection in multivariate time-series with dilated convolutions and variational auto encoders

García González, Gastón - Martínez Tagliafico, Sergio - Fernández, Alicia - Gómez, Gabriel - Acuña, José - Casas, Pedro

Resumen:

Due to its unsupervised nature, anomaly detection plays a central role in cybersecurity, in particular on the detection of unknown attacks. A major source of cybersecurity data comes in the form of multivariate time-series (MTS), representing the temporal evolution of multiple, usually correlated measurements. Despite the many approaches available in the literature for time-series anomaly detection, the automatic detection of abnormal events in MTS remains a complex problem. In this paper we introduce DC-VAE, a novel approach to anomaly detection in MTS, leveraging convolutional neural networks (CNNs) and variational auto encoders (VAEs). DC-VAE detects anomalies in time-series data, exploiting temporal information without sacrificing computational and memory resources. In particular, instead of using recursive neural networks, large causal filters, or many layers, DC-VAE relies on Dilated Convolutions (DC) to capture long and short term phenomena in the data, avoiding complex and less-efficient deep architectures, simplifying learning. We evaluate DC-VAE on the detection of anomalies on a large-scale, multi-dimensional network monitoring dataset collected at an operational mobile Internet Service Provider (ISP), where anomalous events were manually labeled during a time span of 7-months, at a five-minutes granularity. Results show the main properties and advantages introduced by VAEs for time-series anomaly detection, as well as the out-performance of dilated convolutions as compared to standard VAEs for time-series modeling.


Detalles Bibliográficos
2022
Este trabajo ha sido parcialmente financiado por la ANII-FMV, proyecto con referencia FMV-1-2019-1-155850 Detección de anomalías en sistemas de telecomunicaciones mediante métodos de aprendizaje continuo, por Telefónica, y por la Austrian FFG ICTof- the-Future project DynAISEC – Adaptive AI/ML for Dynamic Cybersecurity Systems. Gastón García fue apoyado por la beca ANII POS-FMV-2020-1-1009239, y por CSIC, en el marco del programa Movilidad e Intercambios Académicos 2022.
Anomaly Detection
Deep Learning
Multivariate Time-Series
Dilated Convolution
VAE
Inglés
Universidad de la República
COLIBRI
https://wtmc.info/index.html
https://hdl.handle.net/20.500.12008/31392
Acceso abierto
Licencia Creative Commons Atribución - No Comercial - Sin Derivadas (CC - By-NC-ND 4.0)