We proposed a multivariate time series anomaly detection frame-work Ymir, which leverages ensemble learning and supervisedlearning technology to efficiently learn and adapt to anomaliesin real-world system applications. Ymir integrates several currentlywidely used unsupervised anomaly detection models through anensemble learning method, and thus can provide robust frontalanomaly detection results in unsupervised scenarios. In a super-vised setting, domain experts and system users discuss and providelabels (anomalous or not) for the training data, which reflects theiranomaly detection criteria for the specific system. Ymir leveragesthe aforementioned unsupervised methods to extract rich and usefulfeature representations from the raw multivariate time series data,then combines the features and labels with a supervised classifier todo anomaly detection. We evaluated Ymir on internal multivariatetime series datasets from large monitoring systems and achievedgood anomaly detection performance.
翻译:我们建议了一个多变的时间序列异常探测框架工作Ymir,它利用混合学习和监管学习技术来有效学习和适应真实世界应用中的异常现象。Ymir通过全套学习方法整合了目前普遍使用的一些未经监督的异常现象检测模型,从而可以在不受监督的情景中提供强力的正面异常检测结果。在超视环境中,域专家和系统用户讨论并提供了培训数据标签(有色与否 ), 它反映了特定系统异常的检测标准。 Ymir利用上述未经监督的方法从原始多变时间序列数据中提取丰富和有用的功能表示,然后将特征和标签与监管的分类器待变现象检测结合起来。我们评估了大型监测系统内部多变系列数据集的Ymir,并取得了良好的异常检测性能。