Multi-Scale One-Class Recurrent Neural Networks for Discrete Event Sequence Anomaly Detection

TL;DR

This paper introduces OC4Seq, a multi-scale one-class RNN model that effectively detects anomalies in discrete event sequences by capturing various levels of sequential patterns, outperforming existing methods on benchmark datasets.

Contribution

The paper proposes a novel multi-scale RNN framework integrated with one-class learning for improved discrete event sequence anomaly detection.

Findings

OC4Seq outperforms baseline methods on benchmark datasets.

Multi-scale pattern capturing enhances anomaly detection accuracy.

Quantitative and qualitative analyses confirm the importance of multi-scale features.

Abstract

Discrete event sequences are ubiquitous, such as an ordered event series of process interactions in Information and Communication Technology systems. Recent years have witnessed increasing efforts in detecting anomalies with discrete-event sequences. However, it still remains an extremely difficult task due to several intrinsic challenges including data imbalance issues, the discrete property of the events, and sequential nature of the data. To address these challenges, in this paper, we propose OC4Seq, a multi-scale one-class recurrent neural network for detecting anomalies in discrete event sequences. Specifically, OC4Seq integrates the anomaly detection objective with recurrent neural networks (RNNs) to embed the discrete event sequences into latent spaces, where anomalies can be easily detected. In addition, given that an anomalous sequence could be caused by either individual events, subsequences of events, or the whole sequence, we design a multi-scale RNN framework to capture different levels of sequential patterns simultaneously. Experimental results on three benchmark datasets show that OC4Seq consistently outperforms various representative baselines by a large margin. Moreover, through both quantitative and qualitative analysis, the importance of capturing multi-scale sequential patterns for event anomaly detection is verified.