[Paper Review] Event and Anomaly Detection Using Tucker3 Decomposition

Hadi Fanaee‐T, Márcia Oliveira+3 more|arXiv (Cornell University)|Jun 12, 2014

Blind Source Separation Techniques10 references9 citations

TL;DR

This paper proposes a Tucker3 tensor decomposition approach for detecting anomalies and events in time-evolving network data by modeling user behavior across users, features, and time. By decomposing multi-way data into low-rank components, the method identifies abnormal users through residual analysis, reconstructs their temporal trajectories, and clusters these trajectories to detect group-level events, achieving robust detection of both isolated anomalies and sustained network failures.

ABSTRACT

Failure detection in telecommunication networks is a vital task. So far, several supervised and unsupervised solutions have been provided for discovering failures in such networks. Among them unsupervised approaches has attracted more attention since no label data is required. Often, network devices are not able to provide information about the type of failure. In such cases the type of failure is not known in advance and the unsupervised setting is more appropriate for diagnosis. Among unsupervised approaches, Principal Component Analysis (PCA) is a well-known solution which has been widely used in the anomaly detection literature and can be applied to matrix data (e.g. Users-Features). However, one of the important properties of network data is their temporal sequential nature. So considering the interaction of dimensions over a third dimension, such as time, may provide us better insights into the nature of network failures. In this paper we demonstrate the power of three-way analysis to detect events and anomalies in time-evolving network data.

Motivation & Objective

• To address the challenge of detecting anomalies and events in telecommunication networks without relying on labeled failure data.
• To leverage the temporal sequential nature of network data by modeling interactions across three dimensions: users, features, and time.
• To improve upon traditional PCA-based anomaly detection by incorporating higher-order structure through tensor decomposition.
• To identify not only individual abnormal users but also collective abnormal behaviors (events) across groups of users over time.
• To provide a framework for real-time network surveillance by enabling interpretable diagnosis of failure types through user trajectory analysis.

Proposed method

• Apply Tucker3 decomposition to a 3D tensor of network data (users × features × time) to extract low-rank core components and factor matrices.
• Compute reconstruction error from Tucker3 decomposition to detect individual anomalies, where high error indicates abnormal user behavior.
• Reconstruct user-specific trajectories by aggregating feature-level anomalies over time, enabling temporal analysis of user behavior.
• Use hierarchical clustering (Ward’s linkage with Euclidean distance) on user trajectories to group users with similar abnormal patterns.
• Identify events as clusters of users exhibiting synchronized abnormal behavior over specific time intervals, validated via visual and statistical analysis.
• Employ dynamic time warping (DTW) as an alternative distance measure to account for time-shifted but similar behavioral patterns in future extensions.

Experimental results

Research questions

• RQ1 Can Tucker3 decomposition effectively detect individual anomalies in high-dimensional, time-evolving network data?
• RQ2 How can user trajectories derived from tensor decomposition improve the interpretation of anomaly patterns compared to static anomaly scores?
• RQ3 Can clustering of user trajectories reveal collective abnormal behaviors (events) that are not detectable through individual anomaly detection?
• RQ4 What types of failure patterns (e.g., transient vs. persistent) can be distinguished using trajectory-based analysis?
• RQ5 How can tensor-based methods outperform traditional PCA in capturing complex, multi-dimensional interactions in network failure detection?

Key findings

• Tucker3 decomposition successfully identified 23 abnormal users (2.5% of total) with sustained abnormal behavior across time, including 22 users in a distinct cluster indicating a stable issue.
• The method detected three significant events in the network: one between hours 350–400, and two others between 450–480 and 520–560, with the latter two requiring hypothesis testing for validation.
• User 95 exhibited only two isolated abnormal points, suggesting a transient issue, while user 10 showed consistent abnormal behavior, indicating a persistent problem—insights only possible via trajectory analysis.
• The blue cluster (866 users, 97.4%) represented normal behavior, while red (1 user) and green (22 users) clusters showed abnormal patterns across all time points, suggesting device-level or systemic issues.
• Clustering trajectories enabled detection of group-level events that were not apparent from individual anomaly scores, demonstrating the value of temporal context.
• The approach outperformed standard PCA by capturing higher-order interactions across users, features, and time, enabling richer diagnostic insights into failure types.