Journal of Intelligence and Information Systems (지능정보연구)

Korea Intelligent Information System Society (한국지능정보시스템학회)
권호 표지
DOI QR코드

DOI QR Code

A Study of Anomaly Detection for ICT Infrastructure using Conditional Multimodal Autoencoder

ICT 인프라 이상탐지를 위한 조건부 멀티모달 오토인코더에 관한 연구

  • Received : 2021.05.21
  • Accepted : 2021.06.30
  • Published : 2021.09.30
Download PDF
⟨ Previous Next ⟩

Abstract

Maintenance and prevention of failure through anomaly detection of ICT infrastructure is becoming important. System monitoring data is multidimensional time series data. When we deal with multidimensional time series data, we have difficulty in considering both characteristics of multidimensional data and characteristics of time series data. When dealing with multidimensional data, correlation between variables should be considered. Existing methods such as probability and linear base, distance base, etc. are degraded due to limitations called the curse of dimensions. In addition, time series data is preprocessed by applying sliding window technique and time series decomposition for self-correlation analysis. These techniques are the cause of increasing the dimension of data, so it is necessary to supplement them. The anomaly detection field is an old research field, and statistical methods and regression analysis were used in the early days. Currently, there are active studies to apply machine learning and artificial neural network technology to this field. Statistically based methods are difficult to apply when data is non-homogeneous, and do not detect local outliers well. The regression analysis method compares the predictive value and the actual value after learning the regression formula based on the parametric statistics and it detects abnormality. Anomaly detection using regression analysis has the disadvantage that the performance is lowered when the model is not solid and the noise or outliers of the data are included. There is a restriction that learning data with noise or outliers should be used. The autoencoder using artificial neural networks is learned to output as similar as possible to input data. It has many advantages compared to existing probability and linear model, cluster analysis, and map learning. It can be applied to data that does not satisfy probability distribution or linear assumption. In addition, it is possible to learn non-mapping without label data for teaching. However, there is a limitation of local outlier identification of multidimensional data in anomaly detection, and there is a problem that the dimension of data is greatly increased due to the characteristics of time series data. In this study, we propose a CMAE (Conditional Multimodal Autoencoder) that enhances the performance of anomaly detection by considering local outliers and time series characteristics. First, we applied Multimodal Autoencoder (MAE) to improve the limitations of local outlier identification of multidimensional data. Multimodals are commonly used to learn different types of inputs, such as voice and image. The different modal shares the bottleneck effect of Autoencoder and it learns correlation. In addition, CAE (Conditional Autoencoder) was used to learn the characteristics of time series data effectively without increasing the dimension of data. In general, conditional input mainly uses category variables, but in this study, time was used as a condition to learn periodicity. The CMAE model proposed in this paper was verified by comparing with the Unimodal Autoencoder (UAE) and Multi-modal Autoencoder (MAE). The restoration performance of Autoencoder for 41 variables was confirmed in the proposed model and the comparison model. The restoration performance is different by variables, and the restoration is normally well operated because the loss value is small for Memory, Disk, and Network modals in all three Autoencoder models. The process modal did not show a significant difference in all three models, and the CPU modal showed excellent performance in CMAE. ROC curve was prepared for the evaluation of anomaly detection performance in the proposed model and the comparison model, and AUC, accuracy, precision, recall, and F1-score were compared. In all indicators, the performance was shown in the order of CMAE, MAE, and AE. Especially, the reproduction rate was 0.9828 for CMAE, which can be confirmed to detect almost most of the abnormalities. The accuracy of the model was also improved and 87.12%, and the F1-score was 0.8883, which is considered to be suitable for anomaly detection. In practical aspect, the proposed model has an additional advantage in addition to performance improvement. The use of techniques such as time series decomposition and sliding windows has the disadvantage of managing unnecessary procedures; and their dimensional increase can cause a decrease in the computational speed in inference.The proposed model has characteristics that are easy to apply to practical tasks such as inference speed and model management.

ICT 인프라의 이상탐지를 통한 유지보수와 장애 예방이 중요해지고 있다. 장애 예방을 위해서 이상탐지에 대한 관심이 높아지고 있으며, 지금까지의 다양한 이상탐지 기법 중 최근 연구들에서는 딥러닝을 활용하고 있으며 오토인코더를 활용한 모델을 제안하고 있다. 이는 오토인코더가 다차원 다변량에 대해서도 효과적으로 처리가 가능하다는 것이다. 한편 학습 시에는 많은 컴퓨터 자원이 소모되지만 추론과정에서는 연산을 빠르게 수행할 수 있어 실시간 스트리밍 서비스가 가능하다. 본 연구에서는 기존 연구들과 달리 오토인코더에 2가지 요소를 가미하여 이상탐지의 성능을 높이고자 하였다. 먼저 다차원 데이터가 가지고 있는 속성별 특징을 최대한 부각하여 활용하기 위해 멀티모달 개념을 적용한 멀티모달 오토인코더를 적용하였다. CPU, Memory, network 등 서로 연관이 있는 지표들을 묶어 5개의 모달로 구성하여 학습 성능을 높이고자 하였다. 또한, 시계열 데이터의 특징을 데이터의 차원을 늘리지 않고 효과적으로 학습하기 위하여 조건부 오토인코더(conditional autoencoder) 구조를 활용하는 조건부 멀티모달 오토인코더(Conditional Multimodal Autoencoder, CMAE)를 제안하였다. 제안한 CAME 모델은 비교 실험을 통해 검증했으며, 기존 연구들에서 많이 활용된 오토인코더와 비교하여 AUC, Accuracy, Precision, Recall, F1-score의 성능 평가를 진행한 결과 유니모달 오토인코더(UAE)와 멀티모달 오토인코더(Multimodal Autoencoder, MAE)의 성능을 상회하는 결과를 얻어 이상탐지에 있어 효과적이라는 것을 확인하였다.

Keywords

References

  1. A. Arning, R. Agrawal, and P. Raghavan. A Linear Method for Deviation Detection in Large Databases. ACM KDD Conference, 1996.
  2. B. Jin, Y. Tan, A. Nettekoven, Y. Chen, U. Topcu, Y. Yue and A. Sangiovanni-Vincentelli, "An encoder-decoder based approach for anomaly detection with application in additive manufacturing", 18th IEEE International Conference On Machine Learning And Applications (ICMLA), 2019.
  3. C. C. Aggarwal, Outlier analysis, 2nd, Springer, New York, 2017.
  4. D. Bank, N. Koenigstein and R. Giryes, "Autoencoders", arXiv eprints, March, 2020.
  5. D. E. Rumelhart, G. E. Hinton and R. J. Williams, "Learning Internal Representations by Error Propagation", MIT Press, 1987.
  6. D. Pokrajac, A. Lazarevic, and L. Latecki, Incremental Local Outlier Detection for Data Streams. CIDM Conference, 2007.
  7. D. Lee, "Anomaly detection in multivariate nonstaionary time series for automatic DBMS diagnosis", 16th IEEE International Conference on Machine Learning and Applications (ICMLA), 2017.
  8. G. E. Hinton and R. R. Salakhutdinov, "Reducing the dimensionality of data with neural networks", Science, vol. 313, Issue 5786(2006), 503-507.
  9. G. E. Hinton and Simon Osindero, "A fast learning algorithm for deep belief nets", Neural Computation, 18(7), 2006, 1527-1554. https://doi.org/10.1162/neco.2006.18.7.1527
  10. H. P. Kriegel, M. Schubert, and A. Zimek. "Angle-based Outlier Detection in High-Dimensional Data", ACM KDD Conference, 2008.
  11. H. Ren, B. Xu, Y. Wang, C. Yi, C. Huang, X. Kou, T. Xing, M. Yang, J. Tong and Q. Zhang, "Time-series anomaly detection service at Microsoft", Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2019.
  12. H. Xu, W. Chen, N. Zhao, Z. Li, J. Bu, Z. Li, Y. Liu, Y. Zhao and D. Pei, "Unsupervised anomaly detection via variational auto-encoder for seasonal KPIs in web applications", Proceedings of the 2018 World Wide Web Conference, 2018.
  13. I. Ruts and P. Rousseeuw, "Computing Depth Contours of Bivariate Point Clouds", Computational Statistics and Data Analysis, 23, pp. 153-168, 1996. https://doi.org/10.1016/S0167-9473(96)00027-8
  14. J. Laurikkala, M. Juholal, and E. Kentala. Informal Identification of Outliers in Med- ical Data. Fifth International Workshop on Intelligent Data Analysis in Medicine and Pharmacology, Journal of systems and software, vol. 63(1), 2000.
  15. J. J. Jiang, G. Klein and R. Discenza, "Perception differences of software success: provider and user views of system metrics", Journal of Systems and Software, 2002.
  16. M. Radovanovic, A. Nanopoulos, and M. Ivanovic. "On the Existence of Obstinate Results in Vector Space Models", ACM SIGIR Conference, 2010.
  17. M.-L. Shyu, S.-C. Chen, K. Sarinnapakorn, and L. Chang, "A Novel Anomaly Detection Scheme based on Principal Component Classifier", ICDM Conference, 2003.
  18. N. Abe, B. Zadrozny, J. Langford, "Outlier detection by active learning", 2006
  19. N. Laptev, S. Amizadeh and I. Flint, "Generic and scalable framework for automated time-series anomaly detection", Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2015, 1939-1947.
  20. P. Billingsley. Probability and Measure, Second Edition. Wiley, 1986.
  21. P. Rousseeuw and A. Leroy, "Robust Regression and Outlier Detection", Wiley, 2003.
  22. P. Baldi, "Autoencoders, Unsupervised Learning, and Deep Architectures", 27, JMLR, 2012, 37-50
  23. Pastcal Vincent, Hugo Larochelle, Isabelle Lajoie, Yoshua Bengio and Pierre-Antoine Manzagol, "Stacked denoising autoencoders: learning useful representations in a deep network with a local denoising criterion", JMLR, 2010.
  24. Q. P. Nguyen, K. W. Lim, D. M. Divakaran, K. H. Low and M. C. Chan, "GEE: A gradient-based explainable variational autoencoder for network anomaly detection", IEEE Conference on Communications and Network Security (CNS), 2019
  25. R. De Maesschalck, D. Jouan-Rimbaud, D.L. Massart, "The Mahalanobis Distance", Chemometrics and Intelligent Laboratory Systems, 2000. 1-18
  26. S. Roberts. Novelty "Detection using Extreme Value Statistics", IEEE Proceedings on Vision, 146(3). pp. 124-129, 1999.
  27. S. Sarawagi, R. Agrawal, and N. Megiddo. "Discovery-driven Exploration of OLAP Data Cubes", EDBT Conference, 1998.
  28. T. Baltrusaitis, C. Ahuja, and L. Morency, "Multimodal Machine Learning: A Survey and Taxonomy", IEEE Transactions on Pattern Analysis and Machine Intelligence, 2017
  29. T. Johnson, I. Kwok, and R. Ng. "Fast Computation of 2-dimensional Depth Contours", ACM KDD Conference, 1998.
  30. V. Barnett and T. Lewis, "Outliers in Statistical Data", Wiley, 1994.
  31. V. H. Son, U. Daisuke, H. Kiyoshi, M. Kazuki, S. Pranata and S. M. Shen, "Anomaly detection with adversarial dual autoencoders", arXiv eprint, 2019.
  32. Y. Bengio and Y. LeCun, "Scaling learning algorithms towards AI", MIT Press, 2007, 321-359.
  33. Y. Pei and O. zaiane, "Synthetic data generator for clustering and outlier analysis", 2006.
  34. Y. Su, Y. Zhao, C. Niu, R. Liu, W. Sun and D. Pei, "Robust anomaly detection for multivariate time series through stochastic recurrent neural network", Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2019, 2828 - 2837.
  35. Y. Guo, W. Liao, Q. Wang, L. Yu, T. Ji and P. Li, "Multidimensional Time Series Anomaly Detection: A GRU-based Gaussian Mixture Variational Autoencoder Approach", Proceedings of the 10th Asian Conference on Machine Learning, PMLR, 2018, 97-112.
  36. Y. Ikeda, K. Ishibashi, Y. Nakano, K. Watanabe, and R. Kawahara, "Anomaly detection and interpretation using multimodal autoencoder and sparse optimization", arXiv eprint, 2018.