The massive amounts of monitoring data in network applications bring an urgent need for intelligent operation in large distributed systems. The key problem is precisely detecting anomalies in multivariate time series (MTS) monitoring metrics with the awareness of different application scenarios. Unsupervised MTS anomaly detection methods aim at detecting data anomalies from historical MTS without considering the out-of-band information (including user feedback and background information like code deployment status), which leads to poor performance in practice. To take advantage of the out-of-band information, we propose ACVAE, an MTS anomaly detection algorithm through active learning and contrast VAE-based detection models, which simultaneously learns MTS data’s normal and anomalous patterns for anomaly detection. We also use a learnable prior to capture system status from the background information. Moreover, we propose a query model for VAE-based methods, which can learn to query labels of the most useful instances to train the detection model. We evaluate our algorithm on three different monitoring situations in eBay’s search back-end systems. ACVAE achieves a range F1 score of 0.68~0.96 with only 3% labels, significantly outperforming the best competing methods by 0.18~0.50, and even better than a supervised ensemble method designed by domain experts in eBay.

中文翻译：

---

通过主动学习和对比大型分布式系统中基于 VAE 的模型进行态势感知多元时间序列异常检测


网络应用中海量的监控数据带来了大型分布式系统智能化运行的迫切需求。关键问题是通过了解不同的应用场景来精确检测多变量时间序列（MTS）监控指标中的异常。无监督MTS异常检测方法旨在从历史MTS中检测数据异常，而不考虑带外信息（包括用户反馈和代码部署状态等背景信息），这导致实际性能较差。为了利用带外信息，我们提出了 ACVAE，这是一种通过主动学习和对比基于 VAE 的检测模型的 MTS 异常检测算法，它同时学习 MTS 数据的正常和异常模式以进行异常检测。我们还使用可学习的先验从背景信息中捕获系统状态。此外，我们提出了一种基于 VAE 的方法的查询模型，它可以学习查询最有用实例的标签来训练检测模型。我们在 eBay 搜索后端系统的三种不同监控情况下评估我们的算法。 ACVAE 仅使用 3% 的标签就实现了 0.68~0.96 的 F1 分数范围，明显优于最佳竞争方法 0.18~0.50，甚至优于 eBay 领域专家设计的监督集成方法。