Cheng Wei, Zhang Kai, Chen Haifeng, Jiang Guofei, Chen Zhengzhang, Wang Wei
NEC Laboratories America.
Department of Computer Science, University of California, Los Angeles.
KDD. 2016 Aug;2016:805-814. doi: 10.1145/2939672.2939765.
Modern world has witnessed a dramatic increase in our ability to collect, transmit and distribute real-time monitoring and surveillance data from large-scale information systems and cyber-physical systems. Detecting system anomalies thus attracts significant amount of interest in many fields such as security, fault management, and industrial optimization. Recently, invariant network has shown to be a powerful way in characterizing complex system behaviours. In the invariant network, a node represents a system component and an edge indicates a stable, significant interaction between two components. Structures and evolutions of the invariance network, in particular the vanishing correlations, can shed important light on locating causal anomalies and performing diagnosis. However, existing approaches to detect causal anomalies with the invariant network often use the percentage of vanishing correlations to rank possible casual components, which have several limitations: 1) fault propagation in the network is ignored; 2) the root casual anomalies may not always be the nodes with a high-percentage of vanishing correlations; 3) temporal patterns of vanishing correlations are not exploited for robust detection. To address these limitations, in this paper we propose a network diffusion based framework to identify significant causal anomalies and rank them. Our approach can effectively model fault propagation over the entire invariant network, and can perform joint inference on both the structural, and the time-evolving broken invariance patterns. As a result, it can locate high-confidence anomalies that are truly responsible for the vanishing correlations, and can compensate for unstructured measurement noise in the system. Extensive experiments on synthetic datasets, bank information system datasets, and coal plant cyber-physical system datasets demonstrate the effectiveness of our approach.
现代世界见证了我们从大规模信息系统和网络物理系统中收集、传输和分发实时监测与监控数据能力的急剧增长。因此，检测系统异常在安全、故障管理和工业优化等许多领域引起了极大的关注。最近，不变网络已被证明是刻画复杂系统行为的一种有效方法。在不变网络中，一个节点代表一个系统组件，一条边表示两个组件之间稳定、显著的交互。不变网络的结构和演化，特别是相关性的消失，能够为定位因果异常和进行诊断提供重要线索。然而，现有的利用不变网络检测因果异常的方法通常使用相关性消失的百分比对可能的因果组件进行排序，这存在几个局限性：1）忽略了网络中的故障传播；2）根本的因果异常不一定总是相关性消失百分比高的节点；3）未利用相关性消失的时间模式进行稳健检测。为了解决这些局限性，在本文中我们提出了一个基于网络扩散的框架来识别显著的因果异常并对其进行排序。我们的方法能够有效地对整个不变网络上的故障传播进行建模，并且能够对结构和随时间演变的破坏不变模式进行联合推理。结果，它能够定位对相关性消失真正负责的高置信度异常，并能够补偿系统中的非结构化测量噪声。在合成数据集、银行信息系统数据集和煤矿厂网络物理系统数据集上进行的大量实验证明了我们方法的有效性。
