Double-Adversarial Activation Anomaly Detection: Adversarial Autoencoders are Anomaly Generators

J.-P. Schulze,P. Sperl,K. Böttinger
DOI: https://doi.org/10.1109/IJCNN55064.2022.9892896
2024-01-15
Abstract:Anomaly detection is a challenging task for machine learning algorithms due to the inherent class imbalance. It is costly and time-demanding to manually analyse the observed data, thus usually only few known anomalies if any are available. Inspired by generative models and the analysis of the hidden activations of neural networks, we introduce a novel unsupervised anomaly detection method called DA3D. Here, we use adversarial autoencoders to generate anomalous counterexamples based on the normal data only. These artificial anomalies used during training allow the detection of real, yet unseen anomalies. With our novel generative approach, we transform the unsupervised task of anomaly detection to a supervised one, which is more tractable by machine learning and especially deep learning methods. DA3D surpasses the performance of state-of-the-art anomaly detection methods in a purely data-driven way, where no domain knowledge is required.
Machine Learning,Cryptography and Security
What problem does this paper attempt to address?
The problem that this paper attempts to solve is that in the Anomaly Detection (AD) task, due to the inherent class imbalance between normal samples and abnormal samples, it is difficult for machine learning methods to effectively detect anomalies. In particular, in practical applications, manually analyzing data to find anomalies is both time - consuming and expensive, so usually only a small number of known abnormal samples are available. To address this challenge, the paper proposes a novel unsupervised anomaly detection method named DA3D. ### Main contributions: 1. **Introduction of DA3D**: This is a data - driven unsupervised anomaly detection method based on Generative Adversarial Networks (GAN), which generates artificial abnormal samples by analyzing the activations of Adversarial Autoencoders (AAE). 2. **Generation of non - trivial synthetic anomalies**: A method for generating non - trivial synthetic anomalies useful for detecting real anomalies is proposed. 3. **Performance evaluation**: DA3D was evaluated on ten datasets, and the code is planned to be open - sourced. ### Method overview: - **Adversarial Autoencoder (AAE)**: DA3D uses AAE to generate artificial abnormal samples based on normal data. These synthetic abnormal samples are used during the training process to help detect real, unseen anomalies. - **Dual - adversarial mechanism**: DA3D consists of two parts: the Anomaly Detector (fAD) and the Anomaly Generator (fAG). The Anomaly Detector maps input samples to anomaly scores, while the Anomaly Generator generates non - trivial abnormal samples. - **Anomaly Detector**: Consists of the encoder, decoder of AAE, and an alarm network. The alarm network analyzes the activations of the decoder and outputs the anomaly score. - **Anomaly Generator**: Consists of a generator, a critic network, an alarm network, and the decoder of AAE. The generator generates non - trivial abnormal samples, and the critic network and alarm network provide feedback to help the generator improve the generated abnormal samples. - **Training process**: The generated abnormal samples are balanced through two adversarial goals: one is to deceive the Anomaly Detector and cause it to misclassify; the other is to avoid imitating known normal samples, forcing the generator to explore new areas. ### Experimental results: - **Performance under ideal conditions**: When all samples are normal, DA3D performs well on multiple datasets, with an average AUC reaching 81%, which is 9% higher than the second - best baseline method GANomaly. - **Noise resistance**: When 1% of the training data is contaminated, DA3D still performs well, with an average AUC of 74%, which is comparable to a simple anomaly generator and slightly better than GANomaly. ### Conclusion: DA3D successfully transforms the unsupervised anomaly detection task into a more tractable supervised task by generating synthetic abnormal samples, thereby significantly improving the detection performance. This method performs well on various types of datasets and has broad application prospects.