S S symmetry Article Anomaly Detection Based on Mining Six Local Data Features and BP Neural Network Yu Zhang 1, Yuanpeng Zhu 2, *, Xuqiao Li 2, Xiaol

Transcription

1 S S symmetry Artcle Anomaly Detecton Based on Mnng Sx Local Data Features BP Neural Networ Yu Zhang, Yuanpeng Zhu 2, *, Xuqao L 2, Xaole Wang 2 Xutong Guo 2 School Mechancal & Automotve Engneerng, South Chna Unversty Technology, Guangzhou 564, Chna; @mal.scut.edu.cn 2 School Mamatcs, South Chna Unversty Technology, Guangzhou 564, Chna; maxql@mal.scut.edu.cn (X.L.); w @63.com (X.W.); g @san.com (X.G.) * Correspondence: ypzhu@scut.edu.cn Receved: 8 March 29; Accepted: 5 Aprl 29; Publshed: 9 Aprl 29 Abstract: Key performance ndcators (KPIs) are tme seres wth format (tmestamp, value). The accuracy KPIs anomaly detecton s far beyond our ntal expectatons sometmes. The reasons nclude unbalanced dstrbuton between normal data anomales as well as exstence many dfferent types KPIs data curves. In ths paper, we propose a new anomaly detecton model based on mnng sx local data as nput bac-propagaton (BP) neural networ. By means vectorzaton descrpton on a normalzed dataset nnovatvely, local geometrc characterstcs one tme seres curve could be well descrbed n a precse mamatcal way. Dfferng from some tradtonal statstcs data characterstcs descrbng entre varaton stuaton one sequence, sx mned local data gve a subtle nsght local dynamcs by descrbng local monotoncty, local convexty/concavty, local nflecton property peas dstrbuton one KPI tme seres. In order to demonstrate valdty proposed model, we appled our method on 4 classcal KPIs tme seres datasets. Numercal results show that new gven scheme acheves an average F -score over 9%. Comparson results show that proposed model detects anomaly more precsely. Keywords: anomaly detecton; local data ; BP neural networ; local monotoncty; convexty/concavty; local nflecton; peas dstrbuton. Introducton Key performance ndcators (KPIs) are tme seres wth format (tmestamp, value), whch can be collected from networ traces, syslogs, web access logs, SNMP, or data sources []. Table shows descrpton 4 classcal KPIs Fgure shows se 4 classcal KPIs, whch can be downloaded at For example, KPI s a typcal perodc data seres [2], whch s very common n our daly lfe. KPI5 s a classcal stable data seres [3], whch may ndcate enterprse producton ndex one company. KPI s an unstable data seres [4], n whch dstrbuton anomales s very rregular. KPI KPI4 belong to contnuous fluctuaton data seres [5], whch varaton degree s dramatc so that anomales could be detected very arduously. Furrmore, n KPI2, KPI3, KPI6, KPI8, KPI2, dstrbuton between normal data anomales s extraordnarly unbalanced, whch also results n low accuracy KPIs anomaly detecton. Symmetry 29,, 57; do:.339/sym457

2 Symmetry 29,, x FOR PEER REVIEW 2 2 Up to now, many anomaly detecton approaches have been proposed. In [8], Hu et al. proposed an anomaly detecton method nown as Robust SVM (RSVM). By neglectng nosy data usng Symmetry averagng 29, technque,, 57 RSVM maes decson surface smoor controls regularzaton 2 2 automatcally. In [9], Kabr et al. proposed a Least Square SVM (LS-SVM) method. Compared wth stard SVM, ths method behaves more senstve to anomalous nose n tranng set. By Table. Descrpton 4 classcal KPIs. usng an optmum allocaton scheme selectng samples dependng on varablty, algorthm s optmzed to KPI produce an KPI2 effectve result. KPI3 Snce Bayesan KPI4 Networ KPI5 can be KPI6 used for KPI7 an event classfcaton scheme, t can also be used for anomaly detecton. In [], Kruegel et al. dentfed two Perodc reasons Perodc Unstable Unstable Stable Unstable Unstable Descrpton for a large amount false alarms. The frst reason s smplstc aggregaton model seres seres seres seres seres seres outputs, whch leads to hgh fluctuaton false postves. The second s that anomaly detecton system may msjudge some unusual KPI8 but KPI9 legtmate behavors. KPI To KPI solve se KPI2 problems, KPI3 an anomaly KPI4 detecton approach based on Bayesan Networ was proposed n []. Neutral Perodc networ s also applcable for Contnuous Contnuous detectng anomaly. StableIn [], Unstable Hawns et al. presented Unstable a Replcator Neural Stable Networ (RNN). By Descrpton fluctuaton fluctuaton provdng an outlyngness seres factor seres for anomaly, seres fluctuaton seres seres method reproduces nput data pattern seres at seres output layer after tranng acheves hgh accuracy wthout class labels. For statstcs-based approaches, Shyu et al. proposed an effectve method based on robust prncpal component analyss n [2]. Anomaly The method detecton was s developed purposedfrom to fnd two prncpal varaton, components. as so-called One anomaly, prncpal fromcomponents norm KPI explans dataset. about In recent half years, total anomaly varaton, detecton whle plays or an ncreasngly mnor component s mportant egenvalues role n some are bg less data than analyss.2. Ths areas. technque For example, has benefts n reducng feld fnance, dmenson anomaly data detecton wthout technology losng mportant s used nformaton to detect fraud havng [6] low networ computatonal ntruson n complexty. networ securty [7]. (a) (b) (c) (d) (e) (f) (g) (h) Fgure. Cont.

3 Symmetry 29,, Symmetry 29,, x FOR PEER REVIEW 3 2 () (j) () (l) (m) (n) Fgure.. Fourteen classcal ey ey performance ndcators ndcators (KPIs). (KPIs). (a): Perodc (a): Perodc tme seres; tme (b): seres; Perodc (b): Perodc contnuous contnuous fluctuaton tme fluctuaton seres; (c): tme Unstable seres; tme (c): seres; Unstable (d): tme Unstable seres; tme (d): seres; Unstable (e): Stable tme tme seres; seres; (e):(f): Stable Unstable tme tme seres; seres; (f): Unstable (g): Unstable tme tme seres; seres; (g): (h): Unstable Stable tme seres; (): (h): Unstable Stable tme seres; (j): (): Contnuous Unstable fluctuaton tme seres; tme (j): seres; Contnuous (): Unstable fluctuaton tme seres; tme (l): seres; Perodc (): Unstable contnuous tme fluctuaton seres; (l): tme Perodc seres; (m): Stable contnuous tme seres; fluctuaton (n): Contnuous tme seres; fluctuaton (m): tme Stable seres. tme seres; (n): Contnuous fluctuaton tme seres. Up to now, many anomaly detecton approaches have been proposed. In [8], Hu et al. proposed an anomaly detecton method nown Table. as Descrpton Robust SVM 4 (RSVM). classcal By KPIs. neglectng nosy data usng averagng technque, RSVM maes decson surface smoor controls regularzaton automatcally. In KPI [9], Kabr etkpi2 al. proposed akpi3 Least SquareKPI4 SVM (LS-SVM) KPI5 method. KPI6 Compared wth KPI7 stard SVM, Perodc Perodc ths method behaves more Unstable senstve to anomalous Unstable Stable nose n tranng Unstable set. By Unstable usng an optmum Descrpton allocaton seres scheme selectng samples seres dependng seres on varablty, seres algorthm seres s optmzed seres to produce an effectve result. fluctuaton Snce Bayesan Networ can be used for an event classfcaton scheme, t can also be used KPI8 for anomaly KPI9 detecton. KPI In [], Kruegel KPI et al. dentfed KPI2 two KPI3 reasons forkpi4 a large amount false alarms. The frst reason s smplstc aggregatonperodc model outputs, whch leads to Contnuous Contnuous hgh false postves. Stable The second Unstable s that anomaly detecton Unstable system may msjudge Stable some unusual but Descrpton fluctuaton fluctuaton legtmate behavors. seres To solve seres se problems, an anomaly seres detecton fluctuaton approachseres based on Bayesan seres seres Networ was proposed n []. Neutral networ s also applcable seres for detectng anomaly. In [], Hawns et al. presented a Replcator Neural Networ (RNN). By provdng an outlyngness factor for anomaly, One method essental reproduces eys to develop nput data anomaly patterndetecton outputmodels layer after to tranng detect KPIs acheves anomales hgh accuracy effcently wthout s tme-seres class labels. feature For mnng statstcs-based technque, whch approaches, may affect Shyu superor et al. proposed lmt an effectve models. method In prevous basedstudes, on robust sldng prncpal wndow-based component strategy analyss was n [2]. wdely The used method for tme wasseres developed analyss, fromsee two for prncpal example components. [3 6] One references prncpal ren. components However, explans predcton about half performance total varaton, ths method whle reles or on mnor descrpton component s smlarty egenvalues metrcs arebetween less thantwo.2. sub-sequences. Ths technquemoreover, has benefts n ths reducng method, dmenson smlarty metrcs data wthout are just represented losng mportant by nformaton calculaton havng dstance. lowin computatonal order to avod complexty. problem, Hu et One al. proposed essental a meta-feature-based eys to developapproach anomaly n detecton [7], n whch modelssx tostatstcs detect data KPIs characterstcs anomales effcently ncludng s urtoss, tme-seres coeffcent feature mnng varaton, technque, oscllaton, whch regularty, may affect square superor waves, lmt trend are models. mned. InNeverless, prevous studes, se sldng sx statstcs wndow-based data characterstcs strategy wasare wdely used foronly tmerepresentng seres analyss, see entre for varaton sequence descrbed, relatonshp between several adjacent ponts are not revealed subtly (n or words, local varaton stuaton between a few adjacent ponts could not be

4 Symmetry 29,, example [3 6] references ren. However, predcton performance ths method reles on descrpton smlarty metrcs between two sub-sequences. Moreover, n ths method, smlarty metrcs are just represented by calculaton dstance. In order to avod problem, Hu et al. proposed a meta-feature-based approach n [7], n whch sx statstcs data characterstcs ncludng urtoss, coeffcent varaton, oscllaton, regularty, square waves, trend are mned. Neverless, se sx statstcs data characterstcs are only representng entre varaton sequence descrbed, relatonshp between several adjacent ponts are not revealed subtly (n or words, local varaton stuaton between a few adjacent ponts could not be well descrbed). We tae followng coeffcent varaton as an example, whch descrbes degree dsperson one tme seres C = σ µ, () where C denotes coeffcent varaton one tme seres, σ denotes stard devaton ths seres, µ s mean value ths seres. From Equaton (), we now that coeffcent varaton reflects varaton stuaton from an overall perspectve one tme sequence, thus local varaton stuaton could not be well reflected. In feld anomaly detecton, generally, many anomalous events may have not happened successvely or probablty occurrence n successon s very small, whch means one anomalous event usually appears suddenly rarely. Therefore, due to low frequency abnormal events [8], we are not able to confrm an anomaly just usng some characters descrbng entre varaton stuaton one sequence, we could not locate or predct comng tme next unnown anomaly precsely. In ths stuaton, subtle nsght local dynamcs descrbed sequence s partcularly needed. The major nnovatons ths wor could be summarzed as follows: we mne sx local data on behalf real-tme dynamcs descrbed tme seres. By means vectorzaton descrpton between every four adjacent ponts, local geometrc characterstcs one tme seres curve could be well descrbed n a precse mamatcal way. For example, local monotoncty, local convexty/concavty, local nflecton propertes could be well revealed. Then nput se sx local data nto supervsed bac-propagaton (BP) neural networ, a new anomaly detecton scheme s proposed. Numercal examples on above 4 typcal KPIs show that, tang advantage sx local as nputs BP neural networ, new gven scheme acheves an average F -score over 9%. Compared wth tradtonal statstcs data characterstcs used n [9], our method has a hgher score, whch means that our sx local data can be well descrbed n local dynamcs one KPI tme seres. Compared wth SVM method [2] SVM + PCA [2] method, our method based on BP neural networ also has a hgher average F -score. The rest ths paper s organzed as follows. Secton 2 gves basc concept BP neural networ. Besdes, analyss sx local geometrc characterstcs s dscussed n detal. Several numercal examples are gven n Secton 3 to argue valdty our model. Dscusson s gven n Secton 4, concluson s summarzed n Secton Materals Methods Fgure 2a shows framewor our anomaly detecton method. Fgure 2b s semantc drawng sx local data spaces. By means vectorzaton descrpton on a normalzed tranng/verfyng dataset nnovatvely, local geometrc characterstcs one tme seres curve could be well descrbed n a precse mamatcal way. Thus sx local data have been mned to descrbe local monotoncty, convexty/concavty, local nflecton propertes one KPI seres curve. Then nput se sx nto BP neural networ, after multple tranng processes, a new anomaly detecton model s establshed.

5 Symmetry 29,, Symmetry 29,, x FOR PEER REVIEW 5 2 Fgure 2. (a): The flowchart proposed approach for KPIs tme seres; (b): semantc drawng sx local data feature space BP BP Neural Neural Networ Networ Method Method In In ths ths subsecton, subsecton, we we shall shall gve gve a few few necessary necessary bacgrounds bacgrounds on on bac-propagaton bac-propagaton (BP) (BP) neural neural networ. networ. We wll merely menton afew fewmamatcal mamatcalstatements statementsnecessary necessaryfor fora agood goodunderstng for for present paper, more detals can be found n n [22 26]. BP neural networ s a nd artfcal neural networson on bass bass error bac-propagaton algorthm. Usually, BP neural networ conssts one onenput nputlayer, one oneor ormore morehdden hddenlayer, layer, one one output layer. Let m,, respectvely, denote neural number nput layer neural number output output layer, layer, L denotes denotes number number hdden hdden layers. layers. Addtonally, Label Label = = (l ( l, l 2, l, ) l ) denotes denotes target vector, value = (v, v 2,, v m ) denotes nput vector BP neural networ, a L = ( a target vector, value = ( v, v2, vm ) denotes nput vector BP neural networ, a L = ( L a L, a, L al 2 2,, a ) L al denotes output vector BP. BP uses f l (x) as neuron actvaton functon n lth layer, ) l denotes =, 2,..., L. output The st vector layer BP. BP neural uses networ f ( x ) as s nput neuron layer, actvaton from functon 2nd layer n to lth (Llayer, )th l layer l =, are 2, hdden,l. The layers, st layer layer neural Lth s networ output s layer. nput Let layer, w l from denotes 2nd weght layer to from ( node L )th j layer l (l are hdden )th to node layers, j layer layer lth, Lth s b l denotes output layer. bas Let node w j denotes j n layer lth. j weght from node In BP neural networ, neurons just n adjacent layers are fully connected; neverless, re l layer (l )th to node j layer lth, b s no connecton n same neurons layer. j denotes After each bas tranng node process, j n layer lth. output value ( vector predcted In BP neural labels) networ, s compared neurons wth just target n adjacent value layers ( vector are fully correct connected; labels), neverless, n we re can amend s no connecton weghts n thresholds same neurons layer. nputafter layereach tranng hdden process, layer wth output errorvalue feedbac. ( vector Wth a hdden predcted layer, labels) BP neural s compared networwth can express target anyvalue contnuous ( vector functon correct accurately. labels), n we can amend Letweghts a l thresholds nput layer hdden layer wth error feedbac. Wth a j denotes output node j layer lth, let zl denotes assemble nputs n node j j hdden layer layer, lth, BP tneural can benetwor expressed can asexpress follows any [23] contnuous functon accurately. l l Let aj denotes output node j n layer lth, let z j denotes assemble nputs n node j layer lth, t can be expressed as follows z l j = [23] w l j al + b l j. l l l- l j = j + j z w a b. Therefore, output a l node j n layer lth s expressed as follows j l Therefore, output a j node j n layer lth s expressed as follows a l j = f l(z l j ) = f l( w l j al + b l j ), l l l l- l aj = fl( zj) = fl( wja + bj), where f l (x) s actvaton functon layer lth. where fl () x s actvaton functon layer lth.

6 Symmetry 29,, There are three transfer functons n BP neural networ such that tan-sgmod, log-sgmod, pureln. Tan-sgmod or pureln transfer functon maps any nput value nto an output value between. Log-sgmod transfer functon maps any nput value nto an output value between. The transfer functons n neural networ can mx freely wthout unfyng, so that we can reduce networ s parameters hdden layer s nodes durng establshment BP. Snce Label s target vector, a L s output vector, error functon E(w, b) can be expressed as follows [23] E(w, b) = Label a L 2 = (l y ) 2, where denotes number output layer nodes. In ths paper, we use followng mean square error (MSE) as error output functon BP neural networ [23] MSE = p Label(x n ) a L (x n ) 2, 2p n= where x n denotes nput each tran sample, P denotes number tran samples. It can decrease global error tranng dataset local error when each data pont nputs. In order to reduce MSE gradually so that predcted output value can be closer closer to expectatons booed n advance, BP neural networ needs to adjust ts weghts bas values constantly [24]. The classfcaton accuracy BP neural networ s heavly dependent on selected topology on selecton tranng algorthm [25]. In ths paper, we use Wdrow-Hf LMS method [26] to adjust weght w l j bas bl, that s j = w l j = wl j η MSE w l, (6) j b l j = bl j η MSE b l, (7) j where η s used to control ts amendment speed, whch can be varable or constant, generally speang < η <. Accordng to basc prncple BP neural networ, we can obtan update formula weght bas n each layer. We wrte δ L for value MSE/ z L, whch can be expressed as follows j j δ L j = MSE z L j = MSE a L j a L z L j j = MSE a L j f L (zl j ), (8) where f formula above s frst-order partal dervatves actvaton functon layer lth f l (x). And we wrte δ l j for value MSE/ zl, whch can be expressed as follows j δ l j = MSE z l j MSE = z l+ z l+ z l j = z l+ z l j δ l+, (9) snce z l+ = w l+ a l + bl+ = w l+ f l (z l ) + bl+, ()

7 Symmetry 29,, we have z l+ / z l j = wl+ f j l (zl j ), n δl can be defned by recurrence as follows: j Smlarly, we can prove that [23] δ l j = w l+ f j l (zl j )δl+. () MSE b l j = MSE z l j z l b l j j = δ l j, (2) MSE w l j = MSE z l j z l j w l j = a l δ l j = f l (z l )δ l j. (3) Consequently, basc dea BP neural networ s summarzed as follows. Frstly, nput tranng data nto neural networ. Then durng processng contnuous learnng tranng, BP neural networ wll modfy weghts threshold values step by step, when t reaches precson error setup n advance, t wll stop learnng. Fnally, output value s acqured Features Mnng Method By means vectorzaton descrpton on a normalzed KPIs dataset nnovatvely, local geometrc characterstcs one tme seres curve could be well descrbed n a precse mamatcal way. We shall mne sx local data to descrbe local monotoncty, convexty/concavty, local nflecton propertes one seres curve Normalzaton by Max Mn Method For a KPIs data wth value set V = V, V 2, V 3, V n, V n+m, we frstly use a max mn method to normalze each values as follows: v = V V mn V max V mn, (4) where V max = maxv, V mn = mnv, =, 2,..., n + m. The purpose normalzaton s to avod large dfferences between dfferent values n a KPI tme seres The Defnton Sx Local Data Features For a resultng normalzed value dataset v = v, v 2, v 3, v n, v n+m, we dvde t nto a tran part V tran = v, v 2, v 3, v n a verfyng or test part V test = v n+, v n+2, v n+3, v n+m. We shall use tran part to establsh model whle use verfyng part to test performance model. Local monotoncty, convexty/concavty, local nflecton propertes, peas dstrbuton are four essental a gven data set, whch descrbe local ncreasng/decreasng rates data set. Wth ths n mnd, we mne followng sx resultng normalzed value dataset v = v, v 2, v 3, v n, v n+m

8 Symmetry 29,, () = v, =, 2,..., n + m, F = v+ v, =,..., n + m, F F F (6) F = v+2 2v+ + v, =, 2,..., n + m 2, F (5) = (v+2 v+ )(v+ v ), =, 2,..., n + m 2, = v+3 3v+2 + 3v+ v, =, 2,..., n + m 3, = (v+3 2v+2 + v+ )(v+2 2v+ + v ), =, 2,..., n + m 3. () We29, gve,some explanatons on sx mned. The feature F can descrbe Symmetry x FORgeometrc PEER REVIEW 8 2 ) Symmetry 29,, x FOR PEER REVIEW (32 peas dstrbuton normalzed value data. As shown n Fgures 3 4, feature F 8 F are n F fact frst second dfference normalzed value data, respectvely, whch can descrbe wth >, F + > F >, normalzed value data s both monotoncally ncreasng F >, F > F > wth, normalzed both monotoncally ncreasng local convexty/concavty value value normalzed value data.faster For ncreasng example, wth monotoncty + (n or words, convex locally normalzed datadata has asfaster rate convex locally (n or words, normalzed value data has a faster faster ncreasng rate F >, F > F >, normalzed value data s both monotoncally ncreasng convex locally). + locally).(n or words, normalzed value data has a faster faster ncreasng rate locally). locally Fgure 3. Schematc llustraton feature F( 2). Fgure3.3.Schematc Schematcllustraton llustraton feature feature FF.. Fgure Fgure 4. Schematc llustraton feature F F F.. F Fgure 4. Schematc llustraton feature Fgure 4. Schematc llustraton feature F F. The feature F can descrbe local nflecton property normalzed value data. For The feature (4F) can descrbe local nflecton property normalzed value data. For, that s F example, wth F F< >, F+ <nflecton or F <property, F+ >, t mples that normalzed The feature can descrbe normalzed value data. For local example, wth F <, that s F >, F + < or F <, F + >, t mples that normalzed value data has a local swtch between decreasng values. The feature F s ncreasng example, wth F <, that s F >, F + < or F <, F + >, t mples that normalzed (6) F s value data has a local between ncreasng feature decreasng The thrd dfference swtch normalzed value data, F canvalues. descrbe feature local swtch F s value data has a local swtch between ncreasng decreasng values. The feature (6) can descrbe local swtch thrd dfference normalzed value data, feature F sgn F. (6) F can ths localfgure, swtchwe thrdfgure dfference feature 5 shows normalzed numercal value resultsdata, sx mned 4 descrbe KPIs. From sgn F. Fshows sgn 5. can see that second, thrd dfference F, F mned F dstngush normal frst, Fgure numercal results sx 4 KPIs.anomales From ths fgure, we Fmned from Fgure shows numercal results 4dstngush KPIs. ths fgure, we datasee sgnfcantly. The pont whose values F sx, FF dffer thatfrom or ponts F can that 5 frst, second, thrd dfference anomales, F (6) ( 4 ), F F F dstngush can see that may frst, asthrd dfference extraordnarly besecond, consdered an anomaly. TheF F reveal anomales anomales n a normal data sgnfcantly. The pont whose values F (,2F) F dffer from that ( 3 ) ( 5 ) subtle can prevent msjudgments gven, F. dffer F F, F,F normalway, datawhch sgnfcantly. The pont whose values by from that F F(6) reveal or ponts extraordnarly may be consdered as an anomaly. The or ponts extraordnarly may be consdered as an anomaly. The F F(6) reveal F. anomales n a subtle way, whch can prevent msjudgments gven by F,F, anomales n a subtle way, whch can prevent msjudgments gven by F,F, F.

9 can see that frst, second, thrd dfference F, F F dstngush anomales normal data sgnfcantly. The pont whose values F, F F dffer from that or ponts extraordnarly may be consdered as an anomaly. The F F(6) reveal anomales a subtle way, whch can prevent msjudgments gven by F,F, F9 Symmetry 29,,n57.2 Symmetry 29,, x FOR PEER REVIEW 9 2 (a) (b) (c) (d) (e) (f) Fgure 5. Cont. (g)

10 Symmetry 29,, (f) Symmetry 29,, x FOR PEER REVIEW 2 (g) (h) () (j) () (l) Fgure 5. Cont (m)

11 Symmetry 29,, (l) Symmetry 29,, x FOR PEER REVIEW (m) (n) Fgure 5. Sx mned KPIs. (a) Sx mned KPI; (b) Sx mned KPI2; (c) Sx mned KPI3; mned KPI4;(b) (e)sx Sx mned mned Fgure 5. Sx mned KPIs. (a)(d) SxSx mned KPI; KPI2; KPI5; (c) (f) Sx (h) mned mned mned KPI6; KPI3;(g) (d)sx Sx mned mned KPI7; KPI4; (e)sx Sx mned KPI8; () (f) Sx Sx mned (j) Sx(g) mnedmned KPI; () Sx(h) mned KPI5; mned KPI9; KPI6; Sx KPI7; Sx KPI; Sx mned KPI2; Sx(j) mnedmned KPI3; Sx mned (l) KPI8; () Sx mned (m) KPI9; Sx (n) KPI; () Sx mned KPI4. mned KPI; (l) Sx mned KPI2; (m) Sx mned KPI3; (n) Sx mned KPI Algorthm Descrpton 2.3. Algorthm Descrpton Input: Input:In tranng model, we nput In tranng model, we nput In verfyng model, we nput () () () F() = F4, F5, Fn, F () = F4(), F5(), Fn(), ) = F, F, F, F(2 n, F = F33, F44, Fn ( 3) ( 3) ( 3 ) = F FFn n 2 F22,, F F33,, FF = 2,, F ) = F2, F(34), Fn( 42), F(4 = F, F, Fn 2, F = F2, F23, Fn, 3 ((6) 5) ((6) 5) ( 5 ) (6) (6) FF == F, F2,, FFn 3., n 3 ( 6 ) ( 6 ) (6) F(6) = F, F2, Fn 3. In verfyng model, we nput () () F () = Fn() +, Fn + 2, Fn + m, F = Fn, Fn, Fn +(m ), () (+) ( ) F = Fn+ F, F, m, F = Fn, Fnn+2, Fn + mn+ 2, (2 ),F (2 ), F F(F2) == FFnn, F, Fnn++ 2,, m m nn+ F = F(3n ) 2, F(n3 ), Fn(+3m) 3, F(6)= Fn, Fn(6), Fn(6), +m 2 F = Fn(6) 2, Fn, Fn + m 3. F = Fn, Fn, Fn+m 2, Output: F = Fn 2, Fn, Fn+m 3, The output s predcted label vector; (6) (6) (6) F(6) = Fn 2, Fn, Fn+m 3. Step : normalze values KPIs seres data; Step 2: separate KPI nto tranng dataset verfyng dataset; Output: Step 3: calculate value sx local data accordng to Equatons (4) (5); Step 4: nput vector target vector nto BP algorthm; Step 5: BP neural networ outputs detectng results Evaluaton Method Model Performance In ths experment, confuson matrces (TP, TN, FP, FN) have been appled to defne

12 Symmetry 29,, The output s predcted label vector; Step : normalze values KPIs seres data; Step 2: separate KPI nto tranng dataset verfyng dataset; Step 3: calculate value sx local data accordng to Equatons (4) (5); Step 4: nput vector target vector nto BP algorthm; Step 5: BP neural networ outputs detectng results Evaluaton Method Model Performance In ths experment, confuson matrces (TP, TN, FP, FN) have been appled to defne evaluaton crteron. The meanng correspondng to confuson matrces are categorzed n Table 2, where true postve (TP) means number anomales precsely dagnosed as anomales, whereas true negatve (TN) means number normal data correctly dagnosed as normal. In same way, false postve (FP) means number normal data dagnosed as anomalous by mstae, false negatve (FN) means number anomales naccurately dagnosed as normal. Table 2. The meanng confuson matrces. Predcaton Value Actual Value Anomaly Normal Anomaly TP FP Normal FN TN In order to gve evaluatons performance proposed model, evaluaton crtera such as Recall, Precson, F -score are consdered [8] Recall = Precson = F score = 2 TP TP + FN, (6) TP TP + FP, (7) Precson Recall Precson + Recall. (8) Recall, whch s computed by Equaton (6), denotes number anomales detected by anomaly detecton technology. Precson, whch s computed by Equaton (7), denotes numbers values beng accurately categorzed as anomales. It s most ntutve performance evaluaton crteron. F -score, whch s computed by Equaton (8), conssts a harmonc mean precson recall whle accuracy s rato correct predctons a classfcaton model [27,28]. In next numercal experments, we shall adopt F -score to evaluate performance model. 3. Results In next experments, we shall use computer wth 8 GB memory as well as core 5 nsde. The model s establshed by MATLAB 26a. 3.. Explore Dfferent Topology Structures BP Networ Inputtng sx mned local data nto BP neural networ, a novel anomaly detecton model s proposed. In order to fnd out best-performng topology structure BP networ, we have done fve experments to explore optmal combnaton dfferent layers neural nodes. Fgure 6 shows F -scores dfferent topology structures BP networ for each 4 KPIs. Table 3 shows average score dfferent topology structures BP networ. From se, we can see that topology structure 6 has hghest average F -score among fve topology

13 Symmetry 29,, x FOR PEER REVIEW 3 2 Table 3. Comparatve results dfferent topology structures bac-propagaton (BP) networ. Symmetry 29,, structures. The topology structure 6 means 6 nput nodes, nodes each Pr ecson average hdden layer, output 96.5 node. We96.59 use log-sgmod 96.8 functon97.68 as transfer functon n BP (%) neural networ. It should be noted that when predcted label s no smaller than.5, t wll be set Re call (%) average as, orwse. In or words, a 84.4 data pont wth predcted label above.5 s regarded as an F anomaly - score whle average under s regarded as a normal data In next compared 9.33 experments, 9.6 we shall use best structure (%) 6 to establsh BP model. Fgure Fgure FF-scores dfferent topology structures BP BPnetwor networfor foreach each 4 4KPIs. KPIs. Table 3. Comparatve results dfferent topology structures bac-propagaton (BP) networ Results Presentaton We show numercal results structure 6 on each 4 KPIs. 6 8 Table 4 shows values three evaluaton crtera verfyng dataset each 4 KPIs. From Precson results, average we (%) can see that 96.5 detecton effects on se KPIs are good, especally for KPI 3. All Recall anomales average (%) had been detected re s no msjudgments happened n KPI 3. Accordng to F score average (%) Equaton (9), new gven scheme acheves an average F-score over 9%, whch verfes remarable anomaly detecton effects Results Presentaton Pr ecson Re call average average We show numercal F score results = 2 structure 6 = %. on each 4 average (9) KPIs. Pr ecson + Recall Table 4 shows values three evaluaton crteraverage verfyng average dataset each 4 KPIs. From results, we can see that detecton effects on se 4 KPIs are good, especally for KPI 3. All anomales had been Table detected 4. Values evaluaton re s no crtera msjudgments usng our method. happened n KPI 3. Accordng to Equaton (9), new gven scheme acheves an average F KPI KPI2 KPI3 KPI4 KPI5 KPI6 KPI7 KPI8 KPI9 -score over 9%, whch verfes KPI KPI KPI2 KPI3 KPI4 remarable anomaly detecton effects. Precson (%) Recall (%) 6.4 F88.89 score average = Precson average Recall average = % (9) Precson average + Recall average F-score (%) Table 4. Values evaluaton crtera usng our method. KPI KPI2 KPI3 KPI4 KPI5 KPI6 KPI7 KPI8 KPI9 KPI KPI KPI2 KPI3 KPI4 Fgure 7 shows numercal results structure 6 on each 4 Precson (%) KPIs. Recall (%) In 6.4 fgure, red ponts are orgnal anomales one KPI. The 7.83crcles 85.7represent Fpredcted -score (%) anomales When crcle concdes n poston 99.7 wth 9.4 one 99.8 red pont, t 9.2 means that ths abnormal data pont has been detected by our method. From Fgure 7, we now that on left dotted Fgure lne, 7 shows detecton numercal results results tran models structure acheve 6a hgher accuracy, whle on re eachare a 4few KPIs. In msjudgments fgure, tang red ponts place n are ths orgnal process. anomales On rght one KPI. dotted Thelne, crcles detecton representresults predcted about anomales. verfyng When data are shown. crcle concdes For KPI, nwhch poston s a wth perodc one tme red pont, seres, tour means method that ths not abnormal capable to data pont acheve has been satsfactory detected performance. by our method. There From are some Fgure anomales 7, we now that that have on not been left detected dotted lne, some detecton results tran models acheve a hgher accuracy, whle re are a few msjudgments tang place n ths process. On rght dotted lne, detecton results about verfyng data are shown. For KPI, whch s a perodc tme seres, our method s not capable to acheve satsfactory performance. There are some anomales that have not been detected some normal

14 Symmetry 29,, Symmetry 29,, x FOR PEER REVIEW 4 2 normal data are msjudged as anomales. For KPI2 KPI, numercal results show a remarable data are msjudged as anomales. For KPI2 KPI, numercal results show a remarable detecton detecton effect. For KPI, although re are some anomales that have not been detected, effect. For KPI, although re are some anomales that have not been detected, msjudgments are msjudgments are rare, whch means that once a pont s dagnosed as an anomaly, ths pont may rare, whch means that once a pont s dagnosed as an anomaly, ths pont may well be an orgnal well be an orgnal anomaly. For KPI2 KPI4, numercal results also show a remarable detecton anomaly. For KPI2 KPI4, numercal results also show a remarable detecton effect. effect. (a) Anomaly detecton results KPI usng structure 6. (b) Anomaly detecton results KPI2 usng structure 6. (c) Anomaly detecton results KPI3 usng structure 6. (d) Anomaly detecton results KPI4 usng structure 6. (e) Anomaly detecton results KPI5 usng structure 6. Fgure 7. Cont.

15 Symmetry 29,, Symmetry 29,, x FOR PEER REVIEW 5 2 (f) Anomaly detecton results KPI6 usng structure 6. (g) Anomaly detecton results KPI7 usng structure 6. (h) Anomaly detecton results KPI8 usng structure 6. () Anomaly detecton results KPI9 usng structure 6. (j) Anomaly detecton results KPI usng structure 6. Fgure 7. Cont.

16 Symmetry 29,, Symmetry 29,, x FOR PEER REVIEW 6 2 () Anomaly detecton results KPI usng structure 6. (l) Anomaly detecton results KPI2 usng structure 6. (m) Anomaly detecton results KPI3 usng structure 6. (n) Anomaly detecton results KPI4 usng structure 6. Fgure Anomaly detecton results usng structure (a): Anomaly detecton results KPI usng structure 6 6 ; (b): Anomaly ; (b): Anomaly detecton detecton results results KPI2 usng KPI2 usng structure structure 6 6 ; (c): Anomaly ; detecton (c): Anomaly results detecton KPI3 usng results structure KPI3 usng 6 structure ; (d): 6 Anomaly detecton ; results (d): Anomaly KPI4 usng detecton structure results KPI4 6 usng structure ; (e): Anomaly 6 detecton results ; (e): Anomaly KPI5 usng detecton results structure KPI5 usng 6 structure ; (f): 6 Anomaly detecton ; (f): results Anomaly KPI6 detecton usng results structure KPI6 usng 6 structure 6 ; (g): Anomaly detecton ; (g): Anomaly results detecton KPI7 results usng KPI7 structure usng structure 6 6 ; (h): Anomaly ; (h): detecton Anomaly results detecton results KPI8 usng KPI8 usng structure structure 6 6 ; (): ; (): Anomaly Anomaly detecton detecton results results KPI9 KPI9usng usng structure 6 6 ; ; (j): (j): Anomaly Anomalydetecton detectonresults results KPI KPIusng usng structure 6 6 ; ; (): (): Anomaly Anomalydetecton detectonresults results KPI KPIusng usng structure structure 6 6 ; ; (l): (l): Anomaly Anomalydetecton detectonresults results KPI2 KPI2usng usng structure structure 6 6 ; ; (m): (m): Anomaly Anomaly detecton results results KPI3 KPI3 usng structure structure 6 6 ; ; (n): (n): Anomaly Anomaly detecton detecton results results KPI4 KPI4 usng usng structure structure 6. 6.

17 Symmetry 29,, Dscusson In ths secton, frstly, we use tradtonal statstcs data gven n [9] as nput BP networ, apply ths model on same KPIs. Secondly, we also explore SVM [2] SVM + PCA [2] methods results are presented as well. Fnally, we analyze performance se models. 4.. Tradtonal Statstcs Data Features BP Networ We performed an experment usng tradtonal statstcs data gven n [9] BP networ wth topology structure 6. These tradtonal statstcs data ncluded average value, maxmum value, mnmum value, stard devaton, varance one tme seres. The results are presented n Table 5. Accordng to Equatons (6) (8), we have Precson average = 84.29%, Recall average = 86.4%, F score average = 85.2%. Table 5. Values evaluaton crtera usng method n [9]. KPI KPI2 KPI3 KPI4 KPI5 KPI6 KPI7 KPI8 KPI9 KPI KPI KPI2 KPI3 KPI4 Precson (%) Recall (%) F -score (%) Explore Dfferent Machne Learnng Models In ths subsecton, we shall use SVM [2] SVM + PCA [2] methods to furr verfy valdty sx new mned gven n Equaton (5). SVM method Table 6 shows anomaly detecton results usng SVM method wth sx new mned gven n Equaton (5) as nput. From results, t s observed that SVM-based method s not able to fnd any anomaly n KPI2, but t has a hgh score on or KPIs. The average score on or 3 KPIs are calculated as follows: Precson average = 96.98%, Recall average = 85.93%, F score average = 9.2%. Table 6. Values evaluaton crtera usng SVM method. KPI KPI2 KPI3 KPI4 KPI5 KPI6 KPI7 KPI8 KPI9 KPI KPI KPI2 KPI3 KPI4 Precson (%) Recall (%) F -score (%) 65.7 NaN SVM + PCA Method Table 7 shows anomaly detecton results usng SVM + PCA method wth sx new mned gven n Equaton (5) as nput. The detecton results for combned SVM PCA methods have some mprovements. However, as for KPI5, ths method shows a poor performance. The average score has been calculated as follows: Precson average = 93.29%, Recall average = 79.54%, F score average = 85.87%.

18 Symmetry 29,, Table 7. Values evaluaton crtera usng SVM + PCA method. KPI KPI2 KPI3 KPI4 KPI5 KPI6 KPI7 KPI8 KPI9 KPI KPI KPI2 KPI3 KPI4 Precson (%) Recall (%) F -score (%) Performance Analyss Dfferent Models Table 8 shows comparatve results on same 4 KPIs usng dfferent methods. Our method, SVM method, SVM + PCA method all use sx new mned gven n Equaton (5) as nput. And our method s establshed by usng BP networ wth structure 6. Besdes, method n [9] s also establshed by usng BP networ wth same structure, whch tradtonal statstcs data characterstcs are nputted nto. As can be seen from Table 8, compared wth tradtonal statstcs data characterstcs used n [9], our method has a hgher score, whch means that our sx local data can well descrbe local dynamcs KPIs. Compared wth SVM SVM + PCA methods, our method also has a hgher score, whch means that BP networ has a better anomaly detecton effect. In whole, our method s capable for anomaly detecton on some complexty KPIs. Table 8. Comparatve results dfferent methods. Our Method Method n Lterature [9] SVM Method SVM + PCA Method Precson average (%) Recall average (%) F score average (%) Conclusons We have proposed sx local data to mne local monotoncty, local convexty/concavty, local nflecton propertes, peas dstrbuton KPI tme seres data. Wth se sx local data as nput BP networ, we have establshed a new anomaly detecton model. Compared wth tradtonal statstcs data characterstcs method gven n [9], our scheme shows a hgher accuracy unversalty whch demonstrates remarable detecton effects. Our experments also show that BP neural networ has a better unversalty accuracy degree than SVM SVM + PCA methods. In future, some or neural networ algorthms wll be explored to furr ths study. In addton, classfcaton accuracy BP neural networ s heavly dependent on selected topology on selecton tranng algorthm, performance our proposed methodology could be furr mproved by selectng more sophstcated tranng algorthms n future wor. Snce our method s based on mnng sx local data, as for perodc data seres le KPI, se local data are not adequate enough to characterze perodc data seres. In future study, we shall mne some descrbng perodc tme seres. Author Contrbutons: Conceptualzaton, Y.Z. (Yu Zhang), Y.Z. (Yuanpeng Zhu), X.L.; methodology, Y.Z. (Yu Zhang), Y.Z. (Yuanpeng Zhu), X.L.; stware, Y.Z. (Yu Zhang) X.L.; valdaton, Y.Z. (Yu Zhang) X.L.; formal analyss, Y.Z. (Yu Zhang), Y.Z. (Yuanpeng Zhu), X.L.; nvestgaton, X.L. X.W.; resources, Y.Z. (Yuanpeng Zhu); data curaton, Y.Z. (Yu Zhang) X.L.; wrtng orgnal draft preparaton, Y.Z. (Yu Zhang), Y.P.Z. (Yuanpeng Zhu), X.L.; wrtng revew edtng, Y.Z. (Yuanpeng Zhu) X.L.; vsualzaton, X.L., X.W., X.G.; supervson, Y.Z. (Yuanpeng Zhu); project admnstraton, Y.Z. (Yuanpeng Zhu); fundng acquston, Y.Z. (Yuanpeng Zhu) Y.Z. (Yuanpeng Zhu). Fundng: The research s supported by Natonal Natural Scence Foundaton Chna (No ), Postdoctoral Scence Foundaton Chna (No. 25M5793), Fundamental Research Funds for Central

19 Symmetry 29,, Unverstes (No. 27MS2), Natural Scence Foundaton Guangdong Provnce, Chna (No. 28A3338), Natonal Tranng Program Innovaton Entrepreneurshp for Undergraduates (285674). Acnowledgments: Ths wor was supported by South Chna Unversty Technology. Conflcts Interest: The authors declare no conflct nterest. References. Pérez-Álvarez, J.M.; Maté, A.; Gómez-López, M.T.; Trujllob, J. Tactcal Busness-Process-Decson Support based on KPIs Montorng Valdaton. Comput. Ind. 28, 2, [CrossRef] 2. Yang, J.; Wan, W.; Yu, P.S. Mnng Asynchronous Perodc Patterns n Tme Seres Data. IEEE Trans. Knowl. Data Eng. 23, 5, [CrossRef] 3. Krucze, P.; Wyłomańsa, A.; Teuerle, M.; Gajda, J. The modfed Yule-Waler method for α-stable tme seres models. Phys. A Stat. Mech. Appl. 27, 469, [CrossRef] 4. Grllenzon, C. Forecastng unstable nonstatonary tme seres. Int. J. Forecast. 998, 4, [CrossRef] 5. Pern, J.; Telesca, L. Fluctuaton analyss monthly ranfall tme seres. Fluct. Nose Lett. 2, 2, [CrossRef] 6. Ahmed, M.; Mahmood, A.N.; Islam, M.R. A survey anomaly detecton technques n fnancal doman. Future Gener. Comput. Syst. 26, 55, [CrossRef] 7. Hong, J.H.; Lu, C.C.; Govndarasu, M. Integrated Anomaly Detecton for Cyber Securty Substatons. IEEE Trans. Smart Grd 24, 5, [CrossRef] 8. Hu, W.J.; Lao, Y.; Vemur, V.R. Robust support vector machnes for anomaly detecton n computer securty. In Proceedngs Internatonal Conference Machne Learnng & Applcatons-ICMLA, Los Angeles, CA, USA, July Kabr, E.; Hu, J.; Wang, H.; Zhuo, G. A novel statstcal technque for ntruson detecton systems. Future Gener. Comput. Syst. 28, 79, [CrossRef]. Kruegel, C.; Mutz, D.; Robertson, W.; Valeur, F. Bayesan event classfcaton for ntruson detecton. In Proceedngs 9th Annual Computer Securty Applcatons Conference, Las Vegas, NV, USA, 8 2 December 23.. Hawns, S.; He, H.; Wllams, G.; Baxter, R. Outler detecton usng replcator neural networs. In Data Warehousng Knowledge Dscovery, Proceedngs Internatonal Conference on Data Warehousng Knowledge Dscovery, Ax-en-Provence, France, 4 6 September 22; Lecture Notes n Computer Scence; Kambayash, Y., Wnwarter, W., Arawa, M., Eds.; Sprnger: Berln/Hedelberg, Germany, 22; Volume 2454, pp Shyu, M.L.; Chen, S.C.; Kanosr, S.; Chang, L.W. A novel anomaly detecton scheme based on prncpal component classfer. In IEEE Foundatons New Drectons Data Mnng Worshop; Mam Unv Coral Gables Fl Dept Electrcal Computer Engneerng: Coral Gables, FL, USA, 23; pp Zhang, T.; Yue, D.; Gu, Y.; Wang, Y.; Yu, G. Adaptve correlaton analyss n stream tme seres wth sldng wndows. Comput. Math. Appl. 28, 57, [CrossRef] 4. Dng, Z.; Fe, M. An anomaly detecton approach based on solaton forest algorthm for streamng data usng sldng wndow. IFAC Proc. 23, 46, 2 7. [CrossRef] 5. Ren, H.; Ye, Z.; L, Z. Anomaly detecton based on a dynamc Marov model. Inf. Sc. 27, 4, [CrossRef] 6. Chou, J.S.; Ngo, N.T. Tme seres analytcs usng sldng wndow metaheurstc optmzaton-based machne learnng system for dentfyng buldng energy consumpton patterns. Appl. Energy 26, 77, [CrossRef] 7. Hu, M.; J, Z.W.; Yan, K.; Guo, Y.; Feng, X.W.; Gong, J.H.; Zhao, X. Detectng Anomales n Tme Seres Data va a Meta-Feature Based Approach. IEEE Access 28, 6, [CrossRef] 8. Lu, D.; Zhao, Y.; Xu, H.; Sun, Y.; Pe, D.; Luo, J.; Jng, X.; Feng, M. Opprentce: Towards practcal automatc anomaly detecton through machne learnng. In Proceedngs Internet Measurement Conference AMC, Toyo, Japan, 28 3 October 25.

20 Symmetry 29,, Kumar, P.H.; Patl, S.B.; Sya, H.B. Feature extracton, classfcaton forecastng tme seres sgnal usng fuzzy garch technques. In Proceedngs Natonal Conference on Challenges n Research & Technology n Comng Decades Natonal Conference on Challenges n Research & Technology n Comng Decades (CRT 23) IET, Ujre, Inda, September Amraee, S.; Vafae, A.; Jamshd, K.; Adb, P. Abnormal event detecton n crowded scenes usng one-class SVM. Sgnal Image Vdeo Proc. 28, 2, [CrossRef] 2. L, Z.C.; Zhtang, L.; Bn, L. Anomaly detecton system based on prncpal component analyss support vector machne. Wuhan Unv. J. Nat. Sc. 26,, Dong, X.F.; Lan, Y.; Lu, Y.J. Small mult-pea nonlnear tme seres forecastng usng a hybrd bac propagaton neural networ. Inf. Sc. 28, 424, [CrossRef] 23. Maren, A.J.; Harston, C.T.; Pap, R.M. Hboo Neural Computng Applcatons; Academc Press: San Dego, CA, USA, Hagan, M.T.; Beale, M.H.; Demuth, H.B. Neural Networ Desgn; PWS Pub: Boston, MA, USA, Lvers, I. Improvng Classfcaton Effcency an ANN Utlzng a New Tranng Methodology. Informatcs 28, 6,. [CrossRef] 26. Lvers, I.; Pntelas, P.E. A Survey on Algorthms for Tranng Artfcal Neural Networs; Techncal Report TR8-; Department Math, Unversty Patras: Patras, Greece, Lvers, I.; Kradou, N.; Kanavos, A.; Tampaas, V.; Pntelas, P. On Ensemble SSL Algorthms for Credt Scorng Problem. Informatcs 28, 5, 4. [CrossRef] 28. Powers, D. Evaluaton: From Precson, Recall F-Measure to ROC, Informedness, Maredness & Correlaton. J. Mach. Learn. Technol. 2, 2, by authors. Lcensee MDPI, Basel, Swtzerl. Ths artcle s an open access artcle dstrbuted under terms condtons Creatve Commons Attrbuton (CC BY) lcense (