Abstract
Various interconnected devices and sensors of cyber-physical systems interact with each other in time and space, and the multiple time series generated have interdependent implicit correlations and highly nonlinear relationships. Determining how to model the multiple time series and search anomaly measures through feature selection is the key to anomaly detection. Aiming at the complex interdependence between multi-time series, this paper proposes an anomaly detection model GNF, which applies a Bayesian network to model the structural relationships of multiple time series, and introduces a dependency encoder to obtain the representations of interdependency between multiple time series. Assuming that the anomalies are distributed in the low density area, the joint probability density of the time series can be decomposed into the product of conditional densities, and the data corresponding to the final low density is judged as abnormal. We have conducted experiments on real world datasets and demonstrated the effectiveness of GNF in anomaly detection.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Wu, C.: Enhancing intrusion detection with feature selection and neural network. Int. J. Intell. Syst. 36, 3087–3105 (2021)
Breunig, M.M.: LOF: identifying density-based local outliers. In: Proceedings of the 2000 ACM SIGMOD International Conference on Management of Data, pp. 93–104 (2000)
Shyu, M.: A novel anomaly detection scheme based on principal component classifier. In: Proc Icdm Foundation & New Direction of Data Mining Workshop. IEEE (2003)
Angiulli, F., Pizzuti, C.: Fast outlier detection in high dimensional spaces. In: Elomaa, T., Mannila, H., Toivonen, H. (eds.) PKDD 2002. LNCS, vol. 2431, pp. 15–27. Springer, Heidelberg (2002). https://doi.org/10.1007/3-540-45681-3_2
Sch¨olkopf, B.: Estimating the support of a high-dimensional distribution. Neural Comput. 13(7), 1443–1471 (2001)
Defferrard, M.: Convolutional neural networks on graphs with fast localized spectral filtering. In: Advances in Neural Information Processing Systems, pp. 3844–3852 (2016)
Kipf, T.N.: Semi-Supervised Classification with Graph Convolutional Networks. arXiv preprint arXiv:1609.02907 (2016)
Veliˇckovi´c, P.: Graph Attention Networks. arXiv preprint arXiv:1710.10903 (2017)
Pearl, J.: Bayesian networks: a model of self-activated memory for evidential reasoning. In: Proceedings of the 7th Conference of the Cognitive Science Society (1985)
Zong, B.: Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In: International Conference on Learning Representations (2018)
Tax, D.M.J.: Support vector data description. Mach. Learn. (2004)
Ruff, L.: Deep one-class classification. In: International Conference on Machine Learning (2018)
Park, D.: A multimodal anomaly detector for robot-assisted feeding using an LSTM-based variational autoencoder. IEEE Robot. Autom. Lett. (2018)
Su, Y.: Robust anomaly detection for multivariate time series through stochastic recurrent neural network. In: Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining (2019)
Li, Z.: Multivariate time series anomaly detection and interpretation using hierarchical inter-metric and temporal embedding. In: Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pp. 3220–3230 (2021)
Pearl, J.: Bayesian networks: a model of self-activated memory for evidential reasoning. In: Proceedings of the 7th Conference of the Cognitive Science Society, pp. 329–334 (1985)
Dinh, L.: Density estimation using Real NVP. arXiv preprint arXiv:1605.08803 (2016)
Papamakarios, G.: Masked autoregressive flow for density estimation. In: Advances in Neural Information Processing Systems (2017)
Rasul, K.: Multivariate Probabilistic Time Series Forecasting via Conditioned Normalizing Flows. ArXiv (2020)
Mathur, A.P., Tippenhauer, N.O.: SWaT: a water treatment test bed for research and training on ICS security. In: 2016 International Workshop on Cyber-physical Systems for Smart Water Networks (CySWater). IEEE, pp. 31–36 (2016)
Pankaj, M.: Lstm-based encoder-decoder for Multi-sensor Anomaly Detection. arXiv preprint arXiv:1607.00148 (2016)
Mohammad, S.: Deep end-to-end one class classifier. IEEE Trans. Neural Netw. Learn. Syst. 32(2), 675–684 (2020)
Sachin, G.: Drocc: deep robust one-class classification. In: International Conference on Machine Learning, pp. 3711–3721. PMLR (2020)
Ruff, L.: Deep semi-supervised anomaly detection. In: International Conference on Learning Representations (2020)
Acknowledgments
This paper is supported by the National Natural Science Foundation of China, under Grant No. 62162026, the Science and Technology Key Research and Development Program of Jiangxi Province, under Grant No. 20202BBEL53004 and the Science and Technology Project supported by the Education Department of Jiangxi Province, under Grant No. GJJ210611.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Ning, W., Xie, X., Huang, Y., Yu, S., Li, Z., Yang, H. (2023). Anomaly Detection for Multi-time Series with Normalizing Flow. In: Xu, Y., Yan, H., Teng, H., Cai, J., Li, J. (eds) Machine Learning for Cyber Security. ML4CS 2022. Lecture Notes in Computer Science, vol 13655. Springer, Cham. https://doi.org/10.1007/978-3-031-20096-0_9
Download citation
DOI: https://doi.org/10.1007/978-3-031-20096-0_9
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-20095-3
Online ISBN: 978-3-031-20096-0
eBook Packages: Computer ScienceComputer Science (R0)