[Paper Review] LSTM-based Encoder-Decoder for Multi-sensor Anomaly Detection

Pankaj Malhotra, Anusha Ramakrishnan+4 more|arXiv (Cornell University)|Jul 1, 2016

Anomaly Detection Techniques and Applications18 references345 citations

TL;DR

The paper proposes EncDec-AD, an LSTM encoder-decoder trained only on normal multi-sensor time-series to detect anomalies via reconstruction error, effective for predictable and unpredictable sequences. It evaluates on multiple real datasets showing robust anomaly detection across varied temporal patterns.

ABSTRACT

Mechanical devices such as engines, vehicles, aircrafts, etc., are typically instrumented with numerous sensors to capture the behavior and health of the machine. However, there are often external factors or variables which are not captured by sensors leading to time-series which are inherently unpredictable. For instance, manual controls and/or unmonitored environmental conditions or load may lead to inherently unpredictable time-series. Detecting anomalies in such scenarios becomes challenging using standard approaches based on mathematical models that rely on stationarity, or prediction models that utilize prediction errors to detect anomalies. We propose a Long Short Term Memory Networks based Encoder-Decoder scheme for Anomaly Detection (EncDec-AD) that learns to reconstruct 'normal' time-series behavior, and thereafter uses reconstruction error to detect anomalies. We experiment with three publicly available quasi predictable time-series datasets: power demand, space shuttle, and ECG, and two real-world engine datasets with both predictive and unpredictable behavior. We show that EncDec-AD is robust and can detect anomalies from predictable, unpredictable, periodic, aperiodic, and quasi-periodic time-series. Further, we show that EncDec-AD is able to detect anomalies from short time-series (length as small as 30) as well as long time-series (length as large as 500).

Motivation & Objective

• Motivate anomaly detection in multi-sensor time-series when external factors make data non-stationary and unpredictable.
• Propose EncDec-AD, an LSTM-based encoder-decoder trained on normal sequences to reconstruct input and detect anomalies via reconstruction error.
• Demonstrate robustness across predictable, unpredictable, periodic, aperiodic, and quasi-periodic time-series.
• Show effectiveness on both short and long sequences and compare with prediction-based anomaly methods.

Proposed method

• Train an LSTM encoder-decoder to reconstruct normal time-series by reversing the target sequence.
• Use the encoder's final state as the decoder’s initial state and predict the next values with a linear layer on top of the decoder.
• Compute reconstruction error e(i)=|x(i)−x'(i)| and model anomaly likelihood with a Gaussian on a validation set to obtain anomaly scores a(i).
• Label windows as anomalous if their scores exceed a learned threshold using Fβ optimization on validation data.
• Evaluate performance on multiple datasets (power demand, space shuttle, ECG, Engine-P) with varying dynamics.
• Optionally compare EncDec-AD with LSTM-AD (prediction-based) to highlight robustness where prediction fails.

Experimental results

Research questions

• RQ1 Can an LSTM encoder-decoder trained only on normal sequences detect anomalies in multi-sensor time-series including unpredictable and quasi-periodic data?
• RQ2 How does reconstruction-based anomaly scoring perform across predictable, unpredictable, and periodic temporal patterns?
• RQ3 What are the relative strengths of EncDec-AD compared to prediction-based anomaly detection on diverse datasets?
• RQ4 Can short sequences (as small as 30) be effectively analyzed for anomalies using this approach?
• RQ5 How do parameter choices (L, c, thresholds) influence detection performance across datasets?

Key findings

• EncDec-AD yields high positive likelihood ratios across all datasets, indicating better anomaly scores for anomalous points than normal points.
• The method detects anomalies in predictable, unpredictable, periodic, aperiodic, and quasi-periodic time-series.
• For predictable datasets, prediction-based LSTM-AD can perform better on some tasks; EncDec-AD excels notably on unpredictable sequences (Engine-NP).
• Engine-NP achieves a Fβ-score of 0.93 with a high TPR/FPR, demonstrating robustness in non-predictable scenarios.
• Power demand, space shuttle, Engine-P show strong performance under EncDec-AD with varying L, c and threshold settings.
• ECG, though quasi-periodic, also yields significant anomaly detection performance with the reconstruction-based approach.