Local Trend Inconsistency: A Prediction-driven Approach to Unsupervised Anomaly Detection in Multi-seasonal Time Series

Abstract--Online detection of anomalies in time series is a key technique in various event-sensitive scenarios such a s robotic system monitoring, smart sensor networks and data center security. However, the increasing diversity of data sources and demands are making this task more challenging than ever . First, the rapid increase of unlabeled data makes supervise d learning no longer suitable in many cases. Second, a great po rtion of time series have complex seasonality features. Third, on -line anomaly detection needs to be fast and reliable. In view of this, we in this paper adopt an unsupervised prediction-dri ven approach on the basis of a backbone model combining a series decomposition part and an inference part. We then propose a novel metric, Local Trend Inconsistency (L TI), along with a detection algorithm that efficiently computes L TI chronolo gically along the series and marks each data point with a score indica ting its probability of being anomalous. The result shows that our scheme outperforms several representative anomaly detection alg orithms in Area Under Curve (AUC) metric with decent time efficiency. While time series data has been ubiquitous before the coming of big data era, a large number of recently emerging technical scenarios like autonomous driving, edge computi ng and Internet of Things (IoT) pose new challenges to the detection of anomalies in this type of data. In the meantime, detection techniques that can provide early, reliable repo rts of anomaly has become crucial for a wide range of systems requiring 24/7 monitoring services. In cloud data centers, for example, a distributed monitoring system usually collects a variety of log data from virtual machine level to cluster lev el on a regular basis and sends them to a central detection module, which needs to analyze the aggregated time series to detect any anomalous events including hardware breakdown, unavailable services and cyber attacks. This requires an on - line detector capable of making reliable detections (i.e., with strong sensitivity and specificity), otherwise it could bri ng about unnecessary cost of maintenance.