Abstract:Discrete event sequences are ubiquitous, such as an ordered event series of process interactions in Information and Communication Technology systems. Recent years have witnessed increasing efforts in detecting anomalies with discrete-event sequences. However, it still remains an extremely difficult task due to several intrinsic challenges including data imbalance issues, the discrete property of the events, and sequential nature of the data. To address these challenges, in this paper, we propose OC4Seq, a multi-scale one-class recurrent neural network for detecting anomalies in discrete event sequences. Specifically, OC4Seq integrates the anomaly detection objective with recurrent neural networks (RNNs) to embed the discrete event sequences into latent spaces, where anomalies can be easily detected. In addition, given that an anomalous sequence could be caused by either individual events, subsequences of events, or the whole sequence, we design a multi-scale RNN framework to capture different levels of sequential patterns simultaneously. Experimental results on three benchmark datasets show that OC4Seq consistently outperforms various representative baselines by a large margin. Moreover, through both quantitative and qualitative analysis, the importance of capturing multi-scale sequential patterns for event anomaly detection is verified.

What problem does this paper attempt to address?

This paper attempts to solve the problem of anomaly detection in discrete event sequences. Specifically: 1. **Data imbalance problem**: In anomaly detection tasks, normal sequences are far more numerous than abnormal sequences, resulting in a highly unbalanced data distribution. This makes it difficult for traditional binary classification models to be effectively applied to anomaly detection. 2. **Characteristics of discrete events**: Unlike continuous sequences, discrete event sequences are composed of discrete symbols, and it is difficult to capture the relationships between events. 3. **Nature of sequences**: In order to determine whether a discrete event sequence is abnormal, information about individual events, subsequences, and the entire sequence must be considered simultaneously. This places higher requirements on the design of the model. To solve these problems, the author proposes a multi - scale one - class recurrent neural network framework named OC4Seq. OC4Seq addresses the above challenges in the following ways: - **Multi - scale modeling**: OC4Seq designs a multi - scale RNN framework that can simultaneously capture sequence patterns at different levels, including individual events, subsequences, and the entire sequence. - **One - class classification objective**: OC4Seq combines the anomaly detection objective with a deep - sequence model, embedding discrete event sequences into a latent space where it is easier to detect anomalies. - **End - to - end training**: OC4Seq can be trained in an end - to - end manner, directly optimizing the deep - sequence model to achieve anomaly detection. Through experimental verification, OC4Seq significantly outperforms a variety of representative baseline methods on three benchmark datasets, demonstrating its effectiveness in anomaly detection in discrete event sequences. ### Formula summary - **GRU update formula**: \[ h_t = z_t\odot h_{t - 1}+(1 - z_t)\odot\tilde{h}_t \] where, \[ z_t=\sigma(W_zx_t + U_zh_{t - 1}) \] \[ \tilde{h}_t=\tanh(Wx_t + U(r_t\odot h_{t - 1})) \] \[ r_t=\sigma(W_rx_t + U_rh_{t - 1}) \] - **Global loss function**: \[ L_{\text{global}}=\min_{\Theta}\frac{1}{N}\sum_{i = 1}^{N}\|h_{N_i}-c\|^2+\lambda\|\Theta\|_F^2 \] - **Local loss function**: \[ L_{\text{local}}=\min_{\Theta_L}\frac{1}{N}\sum_{i = 1}^{N}\sum_{j = 1}^{N_i - M}\|h_j^{(i)}-c_L\|^2+\lambda\|\Theta_L\|_F^2 \] - **Overall loss function**: \[ L = L_{\text{global}}+\alpha L_{\text{local}} \] These formulas show how OC4Seq detects anomalies in discrete event sequences by combining global and local perspectives.

Multi-Scale One-Class Recurrent Neural Networks for Discrete Event Sequence Anomaly Detection

Anomalous Event Sequence Detection

Detecting anomalous sequences in electronic health records using higher-order tensor networks

Attention Based CNN-LSTM Network for Anomaly Pattern Classification of Multivariate Time Series

An Anomaly Detection Approach of Part-of-Speech Log Sequence Via Population Based Training

A Sequential Monte Carlo Approach To Anomaly Detection In Tracking Visual Events

Multi-Scale Time Series Ensemble Learning for Information System Anomaly Detection

ADSAD: An unsupervised attention-based discrete sequence anomaly detection framework for network security analysis

Arbitrary Discrete Sequence Anomaly Detection with Zero Boundary LSTM

Video Anomaly Detection with Sparse Coding Inspired Deep Neural Networks

Unsupervised and Semi-supervised Anomaly Detection with LSTM Neural Networks

Anomaly Rule Detection in Sequence Data

Anomalies cannot materialize or vanish out of thin air: A hierarchical multiple instance learning with position-scale awareness for video anomaly detection

Multiple Hypothesis Testing for Anomaly Detection in Multi-type Event Sequences

Anomaly Detection using One-Class Neural Networks

GraphSubDetector: Time Series Subsequence Anomaly Detection via Density-Aware Adaptive Graph Neural Network

Multi-scale Siamese prediction network for video anomaly detection

Anomaly Event Detection in Security Surveillance Using Two-Stream Based Model

MultiRC: Joint Learning for Time Series Anomaly Prediction and Detection with Multi-scale Reconstructive Contrast

A Deep Learning Approach to Anomaly Sequence Detection for High-Resolution Monitoring of Power Systems

An Anomaly Detection Approach Based on Bidirectional Temporal Convolutional Network and Multi-Head Attention Mechanism