MAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks

Abstract

The prevalence of networked sensors and actuators in many real-world systems such as smart buildings, factories, power plants, and data centers generate substantial amounts of multivariate time series data for these systems. The rich sensor data can be continuously monitored for intrusion events through anomaly detection. However, conventional threshold-based anomaly detection methods are inadequate due to the dynamic complexities of these systems, while supervised machine learning methods are unable to exploit the large amounts of data due to the lack of labeled data. On the other hand, current unsupervised machine learning approaches have not fully exploited the spatial-temporal correlation and other dependencies amongst the multiple variables (sensors/actuators) in the system for detecting anomalies. In this work, we propose an unsupervised multivariate anomaly detection method based on Generative Adversarial Networks (GANs). Instead of treating each data stream independently, our proposed MAD-GAN framework considers the entire variable set concurrently to capture the latent interactions amongst the variables. We also fully exploit both the generator and discriminator produced by the GAN, using a novel anomaly score called DR-score to detect anomalies by discrimination and reconstruction. We have tested our proposed MAD-GAN using two recent datasets collected from real-world CPS: the Secure Water Treatment (SWaT) and the Water Distribution (WADI) datasets. Our experimental results showed that the proposed MAD-GAN is effective in reporting anomalies caused by various cyber-intrusions compared in these complex real-world systems.

This is a pre-print of an on-going work. arXiv admin note: text overlap with arXiv:1809.04758

References in corpus (6)

• Unsupervised Representation Learning with Deep Convolutional Generative Adversarial Networks
• Evaluation: from precision, recall and F-measure to ROC, informedness, markedness and correlation
• Efficient GAN-Based Anomaly Detection
• MMD GAN: Towards Deeper Understanding of Moment Matching Network
• Adversarial Feature Selection against Evasion Attacks
• Efficient augmentation and relaxation learning for individualized treatment rules using observational data

Cited by in corpus (26)

• Artificial Intelligence based Anomaly Detection of Energy Consumption in Buildings: A Review, Current Trends and New Perspectives
• An Evaluation of Anomaly Detection and Diagnosis in Multivariate Time Series
• A Review on Generative Adversarial Networks: Algorithms, Theory, and Applications
• A Survey on Device Behavior Fingerprinting: Data Sources, Techniques, Application Scenarios, and Datasets
• Generative Adversarial Networks for Spatio-temporal Data: A Survey
• MOCCA: Multi-Layer One-Class ClassificAtion for Anomaly Detection
• Deep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and Opportunities
• Generative adversarial networks in time series: A survey and taxonomy
• Adversarial Attacks on Time-Series Intrusion Detection for Industrial Control Systems
• Multivariate Time-series Anomaly Detection via Graph Attention Network
• Unsupervised Deep Anomaly Detection for Multi-Sensor Time-Series Signals
• Learning Graph Structures with Transformer for Multivariate Time Series Anomaly Detection in IoT
• A Time-Temperature Dataset for the Strawberry Cold Chain Across Multiple Shipments and Locations
• NVAE-GAN Based Approach for Unsupervised Time Series Anomaly Detection
• Memory-augmented Adversarial Autoencoders for Multivariate Time-series Anomaly Detection with Deep Reconstruction and Prediction
• Double-Adversarial Activation Anomaly Detection: Adversarial Autoencoders are Anomaly Generators
• Augmenting Monte Carlo Dropout Classification Models with Unsupervised Learning Tasks for Detecting and Diagnosing Out-of-Distribution Faults
• H-VGRAE: A Hierarchical Stochastic Spatial-Temporal Embedding Method for Robust Anomaly Detection in Dynamic Networks
• Defending Water Treatment Networks: Exploiting Spatio-temporal Effects for Cyber Attack Detection
• A Novel Framework for Selection of GANs for an Application
• Autoencoder-based Representation Learning from Heterogeneous Multivariate Time Series Data of Mechatronic Systems
• A Semi-Supervised Approach for Abnormal Event Prediction on Large Operational Network Time-Series Data
• Anomaly Detection and Sampling Cost Control via Hierarchical GANs
• Ensemble neuroevolution based approach for multivariate time series anomaly detection
• Unsupervised Learning Based Robust Multivariate Intrusion Detection System for Cyber-Physical Systems using Low Rank Matrix
• Generative Optimization Networks for Memory Efficient Data Generation