[Paper Review] Efficient GAN-Based Anomaly Detection

Houssam Zenati, Chuan-Sheng Foo+3 more|arXiv (Cornell University)|Feb 17, 2018

Anomaly Detection Techniques and ApplicationsComputer Science16 references483 citations

TL;DR

This paper uses a BiGAN-like framework with an encoder to enable efficient anomaly detection, achieving state-of-the-art results on MNIST and KDD99 with substantially faster test-time inference than prior GAN-based methods.

ABSTRACT

Generative adversarial networks (GANs) are able to model the complex highdimensional distributions of real-world data, which suggests they could be effective for anomaly detection. However, few works have explored the use of GANs for the anomaly detection task. We leverage recently developed GAN models for anomaly detection, and achieve state-of-the-art performance on image and network intrusion datasets, while being several hundred-fold faster at test time than the only published GAN-based method.

Motivation & Objective

• Model normal data distribution with a GAN that jointly learns an encoder and a generator.
• Avoid costly latent-embedding recovery at test time by integrating encoding into training.
• Define an anomaly score combining reconstruction loss and discriminator-based loss.
• Demonstrate state-of-the-art performance on image (MNIST) and network intrusion (KDD99) datasets.

Proposed method

• Adopt BiGAN-style training to learn G, E, and D simultaneously for normal data.
• Optimize min_G,E max_D of the loss V(D,E,G) that aligns x with z via encoder and generator.
• Define anomaly score A(x) = α L_G(x) + (1−α) L_D(x) with L_G(x) = ||x − G(E(x))||_1.
• Evaluate two variants for L_D: cross-entropy σ(D(x,E(x)),1) and feature-matching ||f_D(x,E(x)) − f_D(G(E(x)),E(x))||_1.
• Show that feature-matching L_D (FM) improves performance over cross-entropy σ in anomaly scoring.
• Compare against AnoGAN and VAE, reporting both MNIST and KDD99 results and inference-time speedups.

Experimental results

Research questions

• RQ1 Can a GAN with an encoder trained jointly with the generator perform efficient anomaly detection without test-time latent recovery?
• RQ2 Does incorporating an encoder into GAN training improve anomaly detection on high-dimensional data such as images and network traffic?
• RQ3 How does the BiGAN-based anomaly detector compare to existing GAN-based and non-GAN methods on MNIST and KDD99 in terms of accuracy and speed?
• RQ4 What is the impact of using a feature-matching discriminator loss versus a cross-entropy discriminator loss in anomaly scoring?

Key findings

• On MNIST, the BiGAN-based method outperforms AnoGAN and VAE in AUPRC across 10 MNIST-derived anomaly tasks.
• The FM variant of L_D yields better anomaly scores than the σ variant, consistent with discriminator features being informative for detection.
• Inference-time speed is dramatically faster than AnoGAN (approx. 800x faster on MNIST).
• On KDD99, the method remains competitive with state-of-the-art results and achieves higher recall, while also delivering substantial speedups (700x to 900x faster).
• AnoGAN-FM and the BiGAN-based method show strong cross-dataset generalization for high-dimensional data.