Anomaly detection

As explained in Machine Learning Algorithms in Depth

A technique for identifying observations that differ substantially from established data patterns.

Anomaly detection identifies observations that differ substantially from established data patterns. In unsupervised learning, a point far from existing clusters can be treated as an anomaly without labeled targets. section 1.1

For time series, an LSTM-VAE learns normal behavior from nonanomalous data. It outputs the log probability of each sensor input under learned Gaussian parameters; an anomaly lowers that likelihood, which can then be thresholded. section 11.1.1

The VAE detector proceeds through these modeling steps:

• Represent each of n sensors with a mean and variance, producing 2n output parameters under a Gaussian likelihood. section 11.1.1
• Embed the input signals jointly in a latent Gaussian space that approximates standard normal N(0,1) by minimizing KL divergence. section 11.1.1
• Train with an objective that maximizes average sensor log likelihood while structuring the latent embedding. section 11.1.1
• Score new inputs through their log likelihood and signal anomalies when the score drops below a selected threshold. section 11.1.1

Square-wave time series

A simple square-wave input produces a detectable drop in log likelihood when anomalous behavior occurs. Training also shows decreasing total loss across epochs. section 11.1.1

Figure 11.3 LSTM-VAE anomaly detector architecture

Use the architecture figure to trace the LSTM-VAE from multivariate time-series inputs through latent sampling to probabilistic anomaly scores. section 11.1.1

How Machine Learning Algorithms in Depth covers it

How deep it goes

Derives Gaussian likelihoods, latent-space regularization, training objectives, thresholding, and a from-scratch LSTM-VAE implementation.

Examples

Uses distant points from clusters, multivariate sensor signals, a square wave, and the Numenta Anomaly Benchmark.

What you can do after

Implement an LSTM-VAE anomaly detector from scratch with Keras/TensorFlow and threshold log-likelihood drops.

How it connects

Connects unsupervised learning, clustering, variational autoencoders, LSTMs, Gaussian likelihoods, latent spaces, and KL divergence.

liveBookmanning.com

Read Machine Learning Algorithms in Depth on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Data-Driven CybersecurityAn anomaly is an observation or activity that deviates significantly from an expected pattern or reference value.
• 

  liveBookmanning.com
  Time Series Forecasting Using Foundation ModelsAnomaly detection is the task of identifying observations or patterns that substantially deviate from expected behavior.
• 

  liveBookmanning.com
  Financial AI in PracticeThe identification of observations or patterns that substantially differ from expected behavior, including without labeled training examples.
• 

  liveBookmanning.com
  Cloud Observability in ActionAnomaly detection is the identification of observations or behavior that significantly deviates from an established normal baseline.
• 

  liveBookmanning.com
  Digital Twins in ActionAn anomaly is an observation or condition that deviates from expected system behavior or normal operating patterns.
• 

  liveBookmanning.com
  Data Without LabelsAnomaly detection is the identification of observations or behaviors that deviate substantially from an expected pattern.

Compare how 7 books explain anomaly detection →

Related concepts

• fraud detectioncontrasts with · Fraud detection is the process of identifying transactions, activities, or other events suspected of involving intentional deception or unauthorized gain.
• autoencoderaddressed by · An autoencoder is a neural network that encodes input data into an internal representation and decodes it to reconstruct the input or an approximation.
• unsupervised learningused by · Unsupervised learning is a machine-learning approach that discovers patterns, structure, or representations in data without labeled target outputs.
• support vector machineused by · A support vector machine is a supervised-learning model that uses support vectors to determine a maximum-margin decision boundary or regression function, optionally using kernels to model nonlinear relationships.
• prediction intervalconfigured by · A prediction interval is a range computed from a forecasting model that is expected to contain a future or unobserved value at a specified confidence level.

This explainer was generated by Manning's knowledge graph from the text of Machine Learning Algorithms in Depth. The section links point to the parts of the book it draws on.