Efficient pattern-based anomaly detection in a network of multivariate
  devices
Len Feremans Boris Cule Bart Goethals
Many organisations manage service quality and monitor a large set devices and
servers where each entity is associated with telemetry or physical sensor data
series. Recently, various methods have been proposed to detect behavioural
anomalies, however existing approaches focus on multivariate time series and
ignore communication between entities. Moreover, we aim to support end-users in
not only in locating entities and sensors causing an anomaly at a certain
period, but also explain this decision. We propose a scalable approach to
detect anomalies using a two-step approach. First, we recover relations between
entities in the network, since relations are often dynamic in nature and caused
by an unknown underlying process. Next, we report anomalies based on an
embedding of sequential patterns. Pattern mining is efficient and supports
interpretation, i.e. patterns represent frequent occurring behaviour in time
series. We extend pattern mining to filter sequential patterns based on
frequency, temporal constraints and minimum description length. We collect and
release two public datasets for international broadcasting and X from an
Internet company. \textit{BAD} achieves an overall F1-Score of 0.78 on 9
benchmark datasets, significantly outperforming the best baseline by 3\%.
Additionally, \textit{BAD} is also an order-of-magnitude faster than
state-of-the-art anomaly detection methods.