LARA: A Light and Anti-overfitting Retraining Approach for Unsupervised Time Series Anomaly Detection

TL;DR

LARA is a novel retraining approach for unsupervised time series anomaly detection that efficiently adapts to changing normal patterns, prevents overfitting, and requires minimal data and computational resources.

Contribution

The paper introduces a convex formulation for fast, overfitting-resistant retraining, a ruminate block for historical data leverage without storage, and a mathematical proof for minimal error adjustment in fine-tuning.

Findings

LARA achieves competitive F1 scores with only 43 new data points.

The retraining process converges quickly and prevents overfitting.

LARA has minimal computational overhead.

Abstract

Most of current anomaly detection models assume that the normal pattern remains same all the time. However, the normal patterns of Web services change dramatically and frequently. The model trained on old-distribution data is outdated after such changes. Retraining the whole model every time is expensive. Besides, at the beginning of normal pattern changes, there is not enough observation data from the new distribution. Retraining a large neural network model with limited data is vulnerable to overfitting. Thus, we propose a Light and Anti-overfitting Retraining Approach (LARA) for deep variational auto-encoder based time series anomaly detection methods (VAEs). This work aims to make three novel contributions: 1) the retraining process is formulated as a convex problem and can converge at a fast rate as well as prevent overfitting; 2) designing a ruminate block, which leverages the historical data without the need to store them; 3) mathematically proving that when fine-tuning the latent vector and reconstructed data, the linear formations can achieve the least adjusting errors between the ground truths and the fine-tuned ones. Moreover, we have performed many experiments to verify that retraining LARA with even 43 time slots of data from new distribution can result in its competitive F1 Score in comparison with the state-of-the-art anomaly detection models trained with sufficient data. Besides, we verify its light overhead.