Forecast-based Multi-aspect Framework for Multivariate Time-series Anomaly Detection
This addresses the need for more reliable anomaly detection in multivariate cyber-world metrics, though it appears incremental as it builds on existing forecast-based approaches.
The paper tackles the problem of inconsistent performance in forecast-based multivariate time-series anomaly detection by proposing FMUAD, a framework that separately captures spatial, temporal, and correlation changes, which consistently outperforms state-of-the-art methods.
Today's cyber-world is vastly multivariate. Metrics collected at extreme varieties demand multivariate algorithms to properly detect anomalies. However, forecast-based algorithms, as widely proven approaches, often perform sub-optimally or inconsistently across datasets. A key common issue is they strive to be one-size-fits-all but anomalies are distinctive in nature. We propose a method that tailors to such distinction. Presenting FMUAD - a Forecast-based, Multi-aspect, Unsupervised Anomaly Detection framework. FMUAD explicitly and separately captures the signature traits of anomaly types - spatial change, temporal change and correlation change - with independent modules. The modules then jointly learn an optimal feature representation, which is highly flexible and intuitive, unlike most other models in the category. Extensive experiments show our FMUAD framework consistently outperforms other state-of-the-art forecast-based anomaly detectors.