Abstract:In a large-scale cloud environment, many key performance indicators (KPIs) of entities are monitored in real time. These multivariate time series consist of high-dimensional, high-noise, random and time-dependent data. As a common method implemented in artificial intelligence for IT operations (AIOps), time series anomaly detection has been widely studied and applied. However, the existing detection methods cannot fully consider the influence of multiple factors and cannot quickly and accurately detect anomalies in multivariate KPIs of entities. Concurrently, fine-grained root cause locations cannot be determined for detected anomalies and often require abundant normal data that are difficult to obtain for model training. To solve these problems, we propose a long short-term memory (LSTM)-based semisupervised variational autoencoder (VAE) anomaly detection strategy called LR-SemiVAE. First, LR-SemiVAE uses VAE to perform feature dimension reduction and reconstruction of multivariate time series data and judges whether the entity is abnormal by calculating the reconstruction probability score. Second, by introducing an LSTM network into the VAE encoder and decoder, the model can fully learn the time dependence of multivariate time series. Then, LR-SemiVAE predicts the data labels by introducing a classifier to reduce the dependence on the original labeled data during model training. Finally, by proposing a new evidence lower bound (ELBO) loss function calculation method, LR-SemiVAE pays attention to the normal pattern and ignores the abnormal pattern during training to reduce the time cost of removing random anomaly and noise data. However, due to the limitations of LSTM in learning the long-term dependence of time series data, based on LR-SemiVAE, we propose a transformer-based semisupervised VAE anomaly detection and location strategy called RT-SemiVAE for cluster systems with complex service dependencies. This method learns the long-term dependence of multivariate time series by introducing a parallel multihead attention mechanism transformer, while LSTM is used to capture short-term dependence, and the introduction of parallel computing also markedly reduces model training time. After RT-SemiVAE detects entity anomalies, it traces the root entities according to the obtained service dependence graph and locates the root causes at the indicator level. We verify the strategies by using public data sets and constructing a system prototype. Experimental results show that compared with existing baseline methods, the LR-SemiVAE and RT-SemiVAE strategies can detect anomalies more quickly and accurately and perform fine-grained and accurate localization of the root causes of anomalies.

Self-Adaptive Server Anomaly Detection Using Ensemble Meta-Reinforcement Learning

A Novel System Anomaly Prediction System Based on Belief Markov Model and Ensemble Classification

Multi‐model Ensemble for Short‐term Traffic Flow Prediction under Normal and Abnormal Conditions

Robust and accurate performance anomaly detection and prediction for cloud applications: a novel ensemble learning-based framework

LARA: A Light and Anti-overfitting Retraining Approach for Unsupervised Time Series Anomaly Detection

Application of Improved Asynchronous Advantage Actor Critic Reinforcement Learning Model on Anomaly Detection

Towards Experienced Anomaly Detector Through Reinforcement Learning.

Signature-based Adaptive Cloud Resource Usage Prediction Using Machine Learning and Anomaly Detection

SALAD: Self-Adaptive Lightweight Anomaly Detection for Real-time Recurrent Time Series

Adaptive Memory Broad Learning System for Unsupervised Time Series Anomaly Detection

Efficient Multivariate Time Series Anomaly Detection Through Transfer Learning for Large-Scale Web Services

Network Abnormal Traffic Detection Model Based on Semi-Supervised Deep Reinforcement Learning

Interactive Learning for Network Anomaly Monitoring and Detection with Human Guidance in the Loop

Automated financial time series anomaly detection via curiosity-guided exploration and self-imitation learning

A network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing

S2DEVFMAP: Self-Supervised Learning Framework with Dual Ensemble Voting Fusion for Maximizing Anomaly Prediction in Timeseries

Semisupervised anomaly detection of multivariate time series based on a variational autoencoder

Memory-augmented Adversarial Autoencoders for Multivariate Time-series Anomaly Detection with Deep Reconstruction and Prediction

Situation-Aware Multivariate Time Series Anomaly Detection Through Active Learning and Contrast VAE-Based Models in Large Distributed Systems

Time Series Anomaly Detection Based on CEEMDAN and LSTM.

Recurrent auto-encoder with multi-resolution ensemble and predictive coding for multivariate time-series anomaly detection