Anomaly detection in multidimensional time series data

1. A computer-implemented method to detect anomalies in a multivariate or multidimensional time series data set, comprising:

retrieving the time series data set from a monitored device and a historical time series data set from a historical data device;

training a pair of neural networks simultaneously using the retrieved historical time series data set by implementing an adversarial training process to generate a generative neural network and a discriminative neural network,

wherein the generative neural network is trained to generate a probability distribution model of data points in the historical time series data set, wherein the probability distribution model includes data relating to a temporal distribution of data points in the monitored time series data set, and

wherein the discriminative neural network is trained to classify and label the data points in the historical time series data set as being generated by the generative neural network, and if the data points in the historical time series data set are not generated by the generative neural network, classifying and labeling the data points in the historical time series data set as training data, and wherein the discriminative neural network is further trained to distinguish between the data points that actually occur in the monitored time series data set and the historical time series data set, and a forecasted value of the data points in the monitored time series data set and the historical time series data set that are generated by the generative neural network; and

detecting the anomalies in the time series data set of the monitored device by implementing both of the generative neural network and the discriminative neural network to monitor the time series data set, wherein a remedial action is performed on the monitored device in response to a detected anomaly in the time series dataset, and wherein at least one remedial action includes freezing an account on the monitored device if the anomaly is indicative of fraud.

2. The computer-implemented method of claim 1 , wherein detecting the anomalies in the time series data set of the monitored device comprises:

generating, by the generative neural network, a probability distribution model based on the historical time series data set;

forecasting, by the generative neural network, a data point of the time series data set of the monitored device; and

detecting an anomaly based on differences between the forecasted data point and an actual data point corresponding to the forecasted data point, wherein the anomaly is detected where the differences exceed a predetermined threshold.

3. The computer-implemented method of claim 1 , wherein detecting the anomalies in the time series data set of the monitored device comprises:

classifying, by the discriminative neural network, a data point of the time series data set of the monitored device as being anomalous; and

detecting an anomaly based on the classification of the data point.

4. The computer-implemented method of claim 1 , wherein the pair of neural networks comprises one or more recurrent multilayer perceptron neural networks.

5. The computer-implemented method of claim 4 , wherein the pair of neural networks comprises Long Short Term Memory recurrent neural networks.

6. The computer-implemented method of claim 1 , wherein training the pair of neural networks comprises implementing a backpropagation through time algorithm.

7. A computer system comprising:

one or more computer processors, one or more computer-readable storage media, and program instructions stored on one or more of the computer-readable storage media for execution by at least one of the one or more computer processors, the program instructions, when executed by the at least one of the one or more computer processors, causing the computer system to perform a method to detect anomalies in a multivariate or multidimensional time series data set, the method comprising:

retrieving the time series data set from a monitored device and a historical time series data set from a historical data device;

training a pair of neural networks simultaneously using the retrieved historical time series data set by implementing an adversarial training process to generate a generative neural network and a discriminative neural network,

wherein the generative neural network is trained to generate a probability distribution model of data points in the historical time series data set, wherein the probability distribution model includes data relating to a temporal distribution of data points in the monitored time series data set, and

wherein the discriminative neural network is trained to classify and label the data points in the historical time series data set as being generated by the generative neural network, and if the data points in the historical time series data set are not generated by the generative neural network, classifying and labeling the data points in the historical time series data set as training data, and wherein the discriminative neural network is further trained to distinguish between the data points that actually occur in the monitored time series data set and the historical time series data set, and a forecasted value of the data points in the monitored time series data set and the historical time series data set that are generated by the generative neural network; and

detecting the anomalies in the time series data set of the monitored device by implementing both of the generative neural network and the discriminative neural network to monitor the time series data set, wherein a remedial action is performed on the monitored device in response to a detected anomaly in the time series dataset, and wherein at least one remedial action includes freezing an account on the monitored device if the anomaly is indicative of fraud.

8. The computer system of claim 7 , wherein detecting the anomalies in the time series data set of the monitored device comprises:

generating, by the generative neural network, a probability distribution model based on the historical time series data set;

forecasting, by the generative neural network, a data point of the time series data set of the monitored device; and

detecting an anomaly based on differences between the forecasted data point and an actual data point corresponding to the forecasted data point, wherein the anomaly is detected where the differences exceed a predetermined threshold.

9. The computer system of claim 7 , wherein detecting the anomalies in the time series data set of the monitored device comprises:

classifying, by the discriminative neural network, a data point of the time series data set of the monitored device as being anomalous; and

detecting an anomaly based on the classification of the data point.

10. The computer system of claim 7 , wherein the pair of neural networks comprises one or more recurrent multilayer perceptron neural networks.

11. The computer system of claim 10 , wherein the pair of neural networks comprises Long Short Term Memory recurrent neural networks.

12. The computer system of claim 7 , wherein training the pair of neural networks comprises implementing a backpropagation through time algorithm.

13. A computer program product comprising:

one or more computer-readable storage devices and program instructions stored on at least one of the one or more computer-readable storage devices for execution by at least one or more computer processors of a computer system, the program instructions, when executed by the at least one of the one or more computer processors, causing the computer system to perform a method to detect anomalies in a multivariate or multidimensional time series data set, the method comprising:

retrieving the time series data set from a monitored device and a historical time series data set from a historical data device;

training a pair of neural networks simultaneously using the retrieved historical time series data set by implementing an adversarial training process to generate a generative neural network and a discriminative neural network,

wherein the generative neural network is trained to generate a probability distribution model of data points in the historical time series data set, wherein the probability distribution model includes data relating to a temporal distribution of data points in the monitored time series data set, and

wherein the discriminative neural network is trained to classify and label the data points in the historical time series data set as being generated by the generative neural network, and if the data points in the historical time series data set are not generated by the generative neural network, classifying and labeling the data points in the historical time series data set as training data, and wherein the discriminative neural network is further trained to distinguish between the data points that actually occur in the monitored time series data set and the historical time series data set, and a forecasted value of the data points in the monitored time series data set and the historical time series data set that are generated by the generative neural network; and

detecting the anomalies in the time series data set of the monitored device by implementing both of the generative neural network and the discriminative neural network to monitor the time series data set, wherein a remedial action is performed on the monitored device in response to a detected anomaly in the time series dataset, and wherein at least one remedial action includes freezing an account on the monitored device if the anomaly is indicative of fraud.

14. The computer program product of claim 13 , wherein detecting the anomalies in the time series data set of the monitored device comprises:

generating, by the generative neural network, a probability distribution model based on the historical time series data set;

forecasting, by the generative neural network, a data point of the time series data set of the monitored device; and

detecting an anomaly based on differences between the forecasted data point and an actual data point corresponding to the forecasted data point, wherein the anomaly is detected where the differences exceed a predetermined threshold.

15. The computer program product of claim 13 , wherein detecting the anomalies in the time series data set of the monitored device comprises:

classifying, by the discriminative neural network, a data point of the time series data set of the monitored device as being anomalous; and

detecting an anomaly based on the classification of the data point.

16. The computer program product of claim 13 , wherein the pair of neural networks comprises one or more recurrent multilayer perceptron neural networks.

17. The computer program product of claim 16 , wherein the pair of neural networks comprises Long Short Term Memory recurrent neural networks.