An unsupervised anomaly detection approach using energy-based spatiotemporal graphical modeling

This paper presents a new data-driven framework for unsupervised system-wide anomaly detection for modern distributed complex systems within which there exists a strong connectivity among sub-systems, operating in diverse modes and encountering a large variety of anomalies. The framework is based on a spatiotemporal feature extraction scheme built on the concept of symbolic dynamics for discovering and representing causal interactions among subsystems. The extracted features from the spatiotemporal pattern network (STPN) are then used to learn system-wide patterns via a Restricted Boltzmann Machine (RBM), to form an energy based anomaly detection approach. While STPN is treated as a weak learner of system modes (in terms of difficulty in discovering true graphical representations), RBM is treated as a boosting approach to form a strong learner of system characteristics. Case studies with simulated data and real data from an integrated building system are used to validate the proposed approach. The results show that: (i) the increase in RBM free energy in the off-nominal conditions compared to that in the nominal conditions can be used for anomaly detection; (ii) the proposed framework formulates a strong learning model (STPN+RBM) from weak frequentist model–STPN, via boosting with RBM; and (iii) the STPN+RBM framework can capture multiple nominal operating modes of distributed complex systems with a single graphical model.