Abstract:In a large-scale cloud environment, many key performance indicators (KPIs) of entities are monitored in real time. These multivariate time series consist of high-dimensional, high-noise, random and time-dependent data. As a common method implemented in artificial intelligence for IT operations (AIOps), time series anomaly detection has been widely studied and applied. However, the existing detection methods cannot fully consider the influence of multiple factors and cannot quickly and accurately detect anomalies in multivariate KPIs of entities. Concurrently, fine-grained root cause locations cannot be determined for detected anomalies and often require abundant normal data that are difficult to obtain for model training. To solve these problems, we propose a long short-term memory (LSTM)-based semisupervised variational autoencoder (VAE) anomaly detection strategy called LR-SemiVAE. First, LR-SemiVAE uses VAE to perform feature dimension reduction and reconstruction of multivariate time series data and judges whether the entity is abnormal by calculating the reconstruction probability score. Second, by introducing an LSTM network into the VAE encoder and decoder, the model can fully learn the time dependence of multivariate time series. Then, LR-SemiVAE predicts the data labels by introducing a classifier to reduce the dependence on the original labeled data during model training. Finally, by proposing a new evidence lower bound (ELBO) loss function calculation method, LR-SemiVAE pays attention to the normal pattern and ignores the abnormal pattern during training to reduce the time cost of removing random anomaly and noise data. However, due to the limitations of LSTM in learning the long-term dependence of time series data, based on LR-SemiVAE, we propose a transformer-based semisupervised VAE anomaly detection and location strategy called RT-SemiVAE for cluster systems with complex service dependencies. This method learns the long-term dependence of multivariate time series by introducing a parallel multihead attention mechanism transformer, while LSTM is used to capture short-term dependence, and the introduction of parallel computing also markedly reduces model training time. After RT-SemiVAE detects entity anomalies, it traces the root entities according to the obtained service dependence graph and locates the root causes at the indicator level. We verify the strategies by using public data sets and constructing a system prototype. Experimental results show that compared with existing baseline methods, the LR-SemiVAE and RT-SemiVAE strategies can detect anomalies more quickly and accurately and perform fine-grained and accurate localization of the root causes of anomalies.

A joint model for IT operation series prediction and anomaly detection

An Anomaly Detection Algorithm for the Power Industrial Terminal Security Monitoring

Anomaly Detection Algorithm Based on Electric Equipment

LARA: A Light and Anti-overfitting Retraining Approach for Unsupervised Time Series Anomaly Detection

StackVAE-G: an Efficient and Interpretable Model for Time Series Anomaly Detection

Equipment anomaly detection method under cloud-edge collaboration model based bi-directional long short-term memory and variational autoencoder

Memory-augmented Adversarial Autoencoders for Multivariate Time-series Anomaly Detection with Deep Reconstruction and Prediction

Operational time-series data modeling via LSTM network integrating principal component analysis based on human experience

AER: Auto-Encoder with Regression for Time Series Anomaly Detection

Anomaly Detection for Time Series Using VAE-LSTM Hybrid Model

VELC: A New Variational AutoEncoder Based Model for Time Series Anomaly Detection

RePAD: Real-time Proactive Anomaly Detection for Time Series

Situation-Aware Multivariate Time Series Anomaly Detection Through Active Learning and Contrast VAE-Based Models in Large Distributed Systems

Semisupervised anomaly detection of multivariate time series based on a variational autoencoder

Towards a General Time Series Anomaly Detector with Adaptive Bottlenecks and Dual Adversarial Decoders

Anomaly Detection of Power Plant Equipment Using Long Short-Term Memory Based Autoencoder Neural Network

Deep probabilistic time series forecasting using augmented recurrent input for dynamic systems

A Combination of Temporal Sequence Learning and Data Description for Anomaly-based NIDS

VESC: a new variational autoencoder based model for anomaly detection

HybridAD: A Hybrid Model-Driven Anomaly Detection Approach for Multivariate Time Series

A deep learning approach for anomaly detection based on SAE and LSTM in mechanical equipment