[Paper Review] Anomaly Detection and Interpretation using Multimodal Autoencoder and Sparse Optimization

Yasuhiro Ikeda, Keisuke Ishibashi+3 more|arXiv (Cornell University)|Dec 18, 2018

Anomaly Detection Techniques and Applications19 references9 citations

TL;DR

This paper proposes a multimodal autoencoder (MAE) and a sparse optimization-based method to detect and interpret anomalies in cross-domain ICT system data. The MAE learns nonlinear relationships among heterogeneous data types (e.g., MIB, flow, syslog), while sparse optimization identifies the minimal set of contributing input dimensions to localized anomalies, significantly improving interpretability and detection accuracy over conventional autoencoders and PCA on real-world and benchmark datasets.

ABSTRACT

Automated anomaly detection is essential for managing information and communications technology (ICT) systems to maintain reliable services with minimum burden on operators. For detecting varying and continually emerging anomalies as differences from normal states, learning normal relationships inherent among cross-domain data monitored from ICT systems is essential. Deep-learning-based anomaly detection using an autoencoder (AE) is therefore promising for such complicated learning; however, its interpretation is still problematic. Since the dimensions of the input data contributing to the detected anomaly are not directly indicated in an AE, they are not suitable for localizing anomalies in large ICT systems composed of a huge amount of equipment. We propose an algorithm using sparse optimization for estimating contributing dimensions to anomalies detected with AEs. We also propose a multimodal AE (MAE) for effectively learning the relationships among cross-domain data, which can induce nonlinearity and differences in learnability among data types. We evaluated our algorithms with several datasets including real measured data in comparison with conventional algorithms and confirmed the superiority of our estimation algorithm in specifying contributing dimensions of anomalous data and our MAE in detecting anomalies in cross-domain data.

Motivation & Objective

• To address the challenge of localizing anomalies in large ICT systems where autoencoders fail to identify contributing input dimensions.
• To improve anomaly detection in cross-domain data (e.g., MIB, flow, syslog) by modeling nonlinear and heterogeneous relationships.
• To develop a method that interprets detected anomalies by estimating the minimal set of input features responsible for abnormality.
• To evaluate the proposed method on real measured data and benchmark datasets, demonstrating superiority over conventional AE and PCA approaches.

Proposed method

• A multimodal autoencoder (MAE) is designed to learn joint representations from heterogeneous data types (MIB, flow, syslog) by pre-training each modality separately and fine-tuning the shared bottleneck layer.
• Sparse optimization is applied to the reconstruction error of the autoencoder to identify the minimal set of input dimensions contributing to the anomaly, promoting sparsity in the contribution vector.
• A weighted mean squared error (wMSE) loss is used in the MAE to normalize differences in scale across data types, improving sensitivity to anomalies in low-variance modalities like syslog.
• The contribution degree of each input dimension is computed via gradient-based analysis of the reconstruction error, and sparsity is enforced using L1 regularization.
• The method is evaluated using real network data and benchmark datasets, comparing detection and localization performance against standard AE and PCA.

Experimental results

Research questions

• RQ1 Can a multimodal autoencoder effectively learn complex, nonlinear relationships among heterogeneous cross-domain data in ICT systems?
• RQ2 Can sparse optimization accurately identify the minimal set of input dimensions contributing to detected anomalies, enabling effective localization?
• RQ3 Does the proposed MAE outperform standard autoencoders and PCA in detecting anomalies across diverse data types, especially in low-variance modalities like syslog?
• RQ4 How does the proposed method perform on real-world network failure scenarios compared to rule-based or conventional learning-based approaches?

Key findings

• The proposed sparse optimization method outperformed reconstruction error-based estimation in identifying contributing dimensions, enabling accurate localization of anomalies in large ICT systems.
• The MAE detected 10 out of 20 failures in real network data, compared to 9 with standard AE and PCA, with 8 out of 20 failures detected only by the MAE due to improved sensitivity to syslog anomalies.
• Failure #7 (SAP port state change) was detected by the MAE but not by standard AE or PCA, demonstrating the MAE’s ability to detect anomalies in low-variance modalities through pre-training and wMSE normalization.
• The method successfully localized anomalies such as TCP SYN floods (via flow data) and ping check failures (via MIB traffic volume), with contribution degrees matching operator-verified root causes.
• The TPR for detected and verified failures was 0.5 with MAE, compared to 0.45 for standard AE and PCA, indicating improved detection reliability.
• The approach reduced reliance on manually crafted thresholds—replacing 1,141 rule-based thresholds in one use case with a single normal-state training phase and a single MSE threshold.