A Cloud Server Anomaly Detection Model Based on Time Series Decomposition and Spatiotemporal Information Extraction

TANG Lun; ZHAO Yuchen; XUE Chengcheng; CHEN Qianbin

doi:10.11999/JEIT230679

Article Contents

Article Navigation > Journal of Electronics & Information Technology > 2024 >

TANG Lun, ZHAO Yuchen, XUE Chengcheng, CHEN Qianbin. A Cloud Server Anomaly Detection Model Based on Time Series Decomposition and Spatiotemporal Information Extraction[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT230679

Citation:

TANG Lun, ZHAO Yuchen, XUE Chengcheng, CHEN Qianbin. A Cloud Server Anomaly Detection Model Based on Time Series Decomposition and Spatiotemporal Information Extraction[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT230679

Citation:

TANG Lun, ZHAO Yuchen, XUE Chengcheng, CHEN Qianbin. A Cloud Server Anomaly Detection Model Based on Time Series Decomposition and Spatiotemporal Information Extraction[J]. Journal of Electronics & Information Technology. doi: 10.11999/JEIT230679

PDF( 4836 KB)

A Cloud Server Anomaly Detection Model Based on Time Series Decomposition and Spatiotemporal Information Extraction

doi: 10.11999/JEIT230679

1.
School of Communications and Information Engineering, Chongqing University of Posts and Telecommunications, Chongqing 400065, China
2.
Chongqing Key Laboratory of Mobile Communications Technology, Chongqing 400065, China

Funds: The National Natural Science Foundation of China (62071078), Sichuan and Chongqing Key R&D Projects (2021YFQ0053)

Received Date: 2023-07-07
Rev Recd Date: 2024-02-08

Available Online: 2024-03-04

Abstract

Abstract

Anomaly detection is an important task to maintain cloud data center performance. A large number of cloud servers are running in cloud data centers to implement various cloud computing functions. Since the performance of cloud data centers depends on the normal operation of cloud services, it is crucial to detect and analyze anomalies in cloud servers. To this end, a cloud server anomaly detection model based on time series decomposition and spatiotemporal information extraction-Multi-Channel Bidirectional Wasserstein Generative Adversarial Networks with Graph-Time Network (MCBiWGAN-GTN) is proposed in this paper. Firstly, the Bidirectional Wasserstein GAN with Graph-Time Network (BiWGAN-GTN) algorithm is proposed. This algorithm is built upon the Bidirectional Wasserstein GAN with Gradient Penalty (BiWGAN-GP) algorithm. In this modification, the generator and encoder are replaced by a spatiotemporal information extraction module— Graph-Time Network (GTN) composed of Graph Convolutional Networks (GCN) and Temporal Convolutional Networks (TCN). This modification aims to extract spatiotemporal information from the data, enhancing the capabilities of the algorithm. Secondly, the semi-supervised BiWGAN-GTN algorithm is proposed to identify anomalies in multi-dimensional time series to avoid the risk of abnormal data intrusion during the training process and enhance model robustness. Finally, the MCBiWGAN-GTN is designed to achieve the goal of reducing data complexity and improving model learning efficiency. The Complete Ensemble Empirical Mode Decomposition with Adaptive Noise algorithm (CEEMDAN) is used to decompose the time series data, and then different components are sent to the BiWGAN-GTN algorithm under the corresponding channel for training. The effectiveness and stability of the proposed model are verified on two real-world cloud data center datasets, Clearwater and MBD, using three evaluation metrics: precision, recall and F1 score. Experimental results show that the performance of MCBiWGAN-GTN on these two datasets is stable and better than the compared methods.

FullText(HTML)

References(15)

References

[1]	ZHU Zheng, GU Rongbin, PAN Chenling, et al. CPU and network traffic anomaly detection method for cloud data center[C]. The 1st International Conference on Advanced Information Science and System, Singapore, 2019: 24. doi: 10.1145/3373477.3373501.
[2]	LI Dan, CHEN Dacheng, JIN Baihong, et al. MAD-GAN: Multivariate anomaly detection for time series data with generative adversarial networks[C]. The 28th International Conference on Artificial Neural Networks, Munich, Germany, 2019: 703–716. doi: 10.1007/978-3-030-30490-4_56.
[3]	WANG Weili, LIANG Chengchao, TANG Lun, et al. Federated multi-discriminator BiWGAN-GP based collaborative anomaly detection for virtualized network slicing[J]. IEEE Transactions on Mobile Computing, 2023, 22(11): 6445–6459. doi: 10.1109/TMC.2022.3200059.
[4]	Haloui I, Gupta J S, and Feuilard V. Anomaly detection with Wasserstein GAN[J]. arXiv preprint, 2018: 1–36. doi: 10.48550/arXiv.1812.02463.
[5]	GULRAJANI I, AHMED F, ARJOVSKY M, et al. Improved training of Wasserstein GANs[C]. The 31st International Conference on Neural Information Processing Systems, Long Beach, USA, 2017: 5769–5779. doi: 10.5555/3295222.3295327.
[6]	ZHAO Hang, WANG Yujing, DUAN Juanyong, et al. Multivariate time-series anomaly detection via graph attention network[C]. 2020 IEEE International Conference on Data Mining, Sorrento, Italy, 2020: 841–850. doi: 10.1109/ICDM50108.2020.00093.
[7]	GAO Jingkun, SONG Xiaomin, WEN Qingsong, et al. RobustTAD: Robust time series anomaly detection via decomposition and convolutional neural networks[J]. arXiv preprint, 2020: 1–9. doi: 10.48550/arXiv.2002.09545.
[8]	ZHANG Chaoli, ZHOU Tian, WEN Qingsong, et al. TFAD: A decomposition time series anomaly detection architecture with time-frequency analysis[C]. The 31st ACM International Conference on Information & Knowledge Management, Atlanta, USA, 2022: 2497–2507. doi: 10.1145/3511808.3557470.
[9]	RAO Yucong and ZHAO Jiabao. Time series anomaly detection based on CEEMDAN and LSTM[C]. 2021 IEEE International Conference on Networking, Sensing and Control, Xiamen, China, 2021: 1–6. doi: 10.1109/ICNSC52481.2021.9702161.
[10]	HUANG Tao, CHEN Pengfei, and LI Ruipeng. A semi-supervised VAE based active anomaly detection framework in multivariate time series for online systems[C]. ACM Web Conference 2022, Lyon, France, 2022: 1797–1806. doi: 10.1145/3485447.3511984.
[11]	THOMAS N and WELLING M. Semi-supervised classification with graph convolutional networks[J]. arXiv preprint, 2016: 1–14. doi: 10.48550/arXiv.1609.02907.
[12]	BAI Shaojie, KOLTER Z, and KOLTUN V. An empirical evaluation of generic convolutional and recurrent networks for sequence modeling[EB/OL]. https://arxiv.org/abs/1803.01271, 2018.
[13]	TORRES M E, COLOMINAS M A, SCHLOTTHAUER G, et al. A complete ensemble empirical mode decomposition with adaptive noise[C]. 2011 IEEE International Conference on Acoustics, Speech and Signal Processing, Prague, Czech Republic, 2011: 4144–4147. doi: 10.1109/ICASSP.2011.5947265.
[14]	HE Zilong, CHEN Pengfei, LI Xiaoyun, et al. A spatiotemporal deep learning approach for unsupervised anomaly detection in cloud systems[J]. IEEE Transactions on Neural Networks and Learning Systems, 2023, 34(4): 1705–1719. doi: 10.1109/TNNLS.2020.3027736.
[15]	SAUVANAUD C, LAZRI K, KAâNICHE M, et al. Towards black-box anomaly detection in virtual network functions[C]. The 2016 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshop, Toulouse, France, 2016: 254–257. doi: 10.1109/DSN-W.2016.17.