DEGAN: Time Series Anomaly Detection using Generative Adversarial Network Discriminators and Density Estimation

TL;DR

DEGAN is an unsupervised GAN-based framework for time series anomaly detection that uses a discriminator as an anomaly predictor and density estimation to identify abnormal patterns.

Contribution

It introduces a novel unsupervised anomaly detection method leveraging GAN discriminators and density estimation, trained solely on normal data for improved detection.

Findings

Achieved 80% recall and 86% precision in real-world railroad data

Demonstrated the effectiveness of CNN discriminator architecture

Analyzed hyperparameter and architecture impacts on detection performance

Abstract

Developing efficient time series anomaly detection techniques is important to maintain service quality and provide early alarms. Generative neural network methods are one class of the unsupervised approaches that are achieving increasing attention in recent years. In this paper, we have proposed an unsupervised Generative Adversarial Network (GAN)-based anomaly detection framework, DEGAN. It relies solely on normal time series data as input to train a well-configured discriminator (D) into a standalone anomaly predictor. In this framework, time series data is processed by the sliding window method. Expected normal patterns in data are leveraged to develop a generator (G) capable of generating normal data patterns. Normal data is also utilized in hyperparameter tuning and D model selection steps. Validated D models are then extracted and applied to evaluate unseen (testing) time series and identify patterns that have anomalous characteristics. Kernel density estimation (KDE) is applied to data points that are likely to be anomalous to generate probability density functions on the testing time series. The segments with the highest relative probabilities are detected as anomalies. To evaluate the performance, we tested on univariate acceleration time series for five miles of a Class I railroad track. We implemented the framework to detect the real anomalous observations identified by operators. The results show that leveraging the framework with a CNN D architecture results in average best recall and precision of 80% and 86%, respectively, which demonstrates that a well-trained standalone D model has the potential to be a reliable anomaly detector. Moreover, the influence of GAN hyperparameters, GAN architectures, sliding window sizes, clustering of time series, and model validation with labeled/unlabeled data were also investigated.