時間序列異常偵測和分類中的案例探討

Abstract

現實生活中有許多資料與時間的變化有著不可分割的相關性，例如股票的資訊或者晶片溫度等等。而人們通常會利用這些時間序列的資料來做一些分析，例如股票預測或者晶片是否有異常發生等問題。本篇論文的目的為利用機器學習的方式來偵測時間序列 (time series) 的異常，這些異常的預測可以避免一些危險發生以及降低異常發生後所需之成本。偵測方式主要分為兩大類，一種是以分群為基礎的方式去做預測，將時間序列的資料單純以數值來做分析，將訓練資料根據異常比例來產生一個模型，主要的方法為 K-鄰近演算法 (k-nearest neighbors)，單類別支援向量機 (one-class support vector machine)，孤立森林 (isolation forest),橢圓形包絡面 (elliptic envelope)。第二種方式利用時間序列的預測 (time series forecast) 來進行異常偵測，主要是利用現有的訓練資料去預測後續的資料，而這些資料也同時保有時間上的關聯，而最後以預測值與測量值的差距去判斷是否為異常點。本論文用到的時間序列預測模型包含自迴歸模型(auto regressive)，遞迴神經網絡 (recurrent neural network)，長短期記憶網路 (long short-term memory)。最後我們發現在上述方法中並無絕對優勢的模型，我們將會根據不同資料集來決定要使用哪一種模型。

There are many instances of data with inseparable correlation with time in the real world, for instance, stock prices or on-chip thermal temperatures.People usually use these time series (TS) data for more analysis and prediction, such as stock prediction or anomaly detection.The purpose of this thesis is to use machine learning to detect anomalies in a time series. If an anomaly is detected correctly, it can avoid dangerous situations and reduce repair cost. There are two types of methods for anomaly detection. The first type is based on clustering, which builds a model on training data with no labels, and then divides the data into normal and abnormal by using a given anomaly ratio. Some well-known methods of this type are k-nearest neighbors (KNN), one-class support vector machine (OCSVM), isolation forest (IF) and elliptic envelope (EE). The other type is based on time series forecast to detect anomalies. It computes the distance between the predicted TS values and measured TS values to determine if a given point is normal or abnormal. The models used in this study for TS predictor include auto regressive (AR) model, recurrent neural network (RNN), long short-term memory (LSTM). Finally, we found that there is no single best model in general, and we usually need to perform model comparison in order to select the best one for a given dataset.