A Joint Model for IT Operation Series Prediction and Anomaly Detection

TL;DR

This paper introduces a joint model combining VAE and LSTM for simultaneous IT operation series prediction and anomaly detection, improving robustness and accuracy through integrated spectral residual analysis.

Contribution

The novel joint VAE-LSTM framework effectively addresses both prediction and anomaly detection tasks in IT systems within a unified model.

Findings

Outperforms existing methods on benchmark datasets

Enhances anomaly detection accuracy with spectral residual analysis

Provides robust predictions despite noisy data

Abstract

Status prediction and anomaly detection are two fundamental tasks in automatic IT systems monitoring. In this paper, a joint model Predictor & Anomaly Detector (PAD) is proposed to address these two issues under one framework. In our design, the variational auto-encoder (VAE) and long short-term memory (LSTM) are joined together. The prediction block (LSTM) takes clean input from the reconstructed time series by VAE, which makes it robust to the anomalies and noise for prediction task. In the meantime, the LSTM block maintains the long-term sequential patterns, which are out of the sight of a VAE encoding window. This leads to the better performance of VAE in anomaly detection than it is trained alone. In the whole processing pipeline, the spectral residual analysis is integrated with VAE and LSTM to boost the performance of both. The superior performance on two tasks is confirmed with the experiments on two challenging evaluation benchmarks.