Multiple-Input Variational Auto-Encoder for Anomaly Detection in Heterogeneous Data

TL;DR

This paper introduces a novel neural network architecture, MIVAE, and a multiple-input auto-encoder, MIAEAD, designed to improve anomaly detection in heterogeneous, non-IID data by leveraging feature subset reconstruction errors and distribution modeling.

Contribution

The paper proposes MIVAE and MIAEAD, innovative models that enhance anomaly detection in heterogeneous data by combining sub-encoder reconstruction errors with distribution learning, outperforming existing methods.

Findings

MIVAE achieves higher AUC than traditional VAEs.

MIAEAD performs better on datasets with low feature heterogeneity.

Both models outperform state-of-the-art unsupervised anomaly detection methods.

Abstract

Anomaly detection (AD) plays a pivotal role in AI applications, e.g., in classification, and intrusion/threat detection in cybersecurity. However, most existing methods face challenges of heterogeneity amongst feature subsets posed by non-independent and identically distributed (non-IID) data. We propose a novel neural network model called Multiple-Input Auto-Encoder for AD (MIAEAD) to address this. MIAEAD assigns an anomaly score to each feature subset of a data sample to indicate its likelihood of being an anomaly. This is done by using the reconstruction error of its sub-encoder as the anomaly score. All sub-encoders are then simultaneously trained using unsupervised learning to determine the anomaly scores of feature subsets. The final AUC of MIAEAD is calculated for each sub-dataset, and the maximum AUC obtained among the sub-datasets is selected. To leverage the modelling of the distribution of normal data to identify anomalies of the generative models, we develop a novel neural network architecture/model called Multiple-Input Variational Auto-Encoder (MIVAE). MIVAE can process feature subsets through its sub-encoders before learning distribution of normal data in the latent space. This allows MIVAE to identify anomalies that deviate from the learned distribution. We theoretically prove that the difference in the average anomaly score between normal samples and anomalies obtained by the proposed MIVAE is greater than that of the Variational Auto-Encoder (VAEAD), resulting in a higher AUC for MIVAE. Extensive experiments on eight real-world anomaly datasets demonstrate the superior performance of MIAEAD and MIVAE over conventional methods and the state-of-the-art unsupervised models, by up to 6% in terms of AUC score. Alternatively, MIAEAD and MIVAE have a high AUC when applied to feature subsets with low heterogeneity based on the coefficient of variation (CV) score.