Unsupervised Anomaly Detection via Variational Auto-Encoder for Seasonal KPIs in Web Applications

TL;DR

This paper introduces Donut, an unsupervised VAE-based algorithm for detecting anomalies in seasonal KPIs of web applications, outperforming existing methods with a solid theoretical foundation.

Contribution

It presents Donut, a novel VAE-based anomaly detection method with a KDE interpretation, specifically designed for seasonal KPIs, and demonstrates its superior performance.

Findings

Donut achieves F-scores from 0.75 to 0.9 on real KPIs.

Outperforms supervised ensemble and baseline VAE methods.

Provides a theoretical KDE interpretation of VAE reconstruction.

Abstract

To ensure undisrupted business, large Internet companies need to closely monitor various KPIs (e.g., Page Views, number of online users, and number of orders) of its Web applications, to accurately detect anomalies and trigger timely troubleshooting/mitigation. However, anomaly detection for these seasonal KPIs with various patterns and data quality has been a great challenge, especially without labels. In this paper, we proposed Donut, an unsupervised anomaly detection algorithm based on VAE. Thanks to a few of our key techniques, Donut greatly outperforms a state-of-arts supervised ensemble approach and a baseline VAE approach, and its best F-scores range from 0.75 to 0.9 for the studied KPIs from a top global Internet company. We come up with a novel KDE interpretation of reconstruction for Donut, making it the first VAE-based anomaly detection algorithm with solid theoretical explanation.