Intrinsic Anomaly Detection for Multi-Variate Time Series
This addresses a practical problem in domains like DevOps and IoT for detecting system failures under environmental influence, but it is incremental as it builds on existing anomaly detection methods.
The paper tackles the problem of intrinsic anomaly detection in multi-variate time series, focusing on identifying failures in systems influenced by their environment, and presents an unsupervised method combining adversarial and representation learning to address label sparsity and subjectivity.
We introduce a novel, practically relevant variation of the anomaly detection problem in multi-variate time series: intrinsic anomaly detection. It appears in diverse practical scenarios ranging from DevOps to IoT, where we want to recognize failures of a system that operates under the influence of a surrounding environment. Intrinsic anomalies are changes in the functional dependency structure between time series that represent an environment and time series that represent the internal state of a system that is placed in said environment. We formalize this problem, provide under-studied public and new purpose-built data sets for it, and present methods that handle intrinsic anomaly detection. These address the short-coming of existing anomaly detection methods that cannot differentiate between expected changes in the system's state and unexpected ones, i.e., changes in the system that deviate from the environment's influence. Our most promising approach is fully unsupervised and combines adversarial learning and time series representation learning, thereby addressing problems such as label sparsity and subjectivity, while allowing to navigate and improve notoriously problematic anomaly detection data sets.