Neural contrastive anomaly detection
Systems and methods are described for detecting anomalies within data, such as time series data. In one example, unlabeled data, such as time series data, may be obtained. At least one data point, representing an artificial anomaly, may be inserted into the data. The data may then be divided into a number of different windows. The windows may have a fixed size and may at least partially overlap in time. The data contained within different windows may be compared, to each other and to the injected data point, to determine an anomaly score for individual windows. The anomaly score may indicate a likelihood that a given window contains an anomaly. In a specific example, a convolution neural network may be trained based on the data and inserted data points representing anomalies, where a contrastive loss function is used to represent different portions of the data in the neural network.
1. A computer-implemented method, comprising:
obtaining time series data, the time series data comprising unlabeled data;
injecting at least one data point into the time series data, the at least one data point representing a first anomaly relative to the time series data;
segmenting the time series data into a plurality of overlapping windows, wherein a first window of the plurality of windows is further separated into a first context window and a first suspect window;
training a neural network to detect anomalies in the time series data using at least a portion of the time series data and the at least one data point; and
determining an anomaly score for the first suspect window based on a comparison of the time series data in the first window with the time series data in the first context window using the trained neural network, the anomaly score indicating a likelihood that the first suspect window contains a second anomaly.
2. The computer-implemented method of claim 1 , wherein determining the anomaly score for the first suspect window further comprises using a contrastive loss function to compare the at least one data point with the first suspect window.
3. The computer-implemented method of claim 1 , further comprising segmenting a second window of the plurality of windows into a second context window and a second suspect window, wherein determining the anomaly score further comprises comparing the first suspect window to at least two of the first window, the first context window, the second window, or the second context window.
4. The computer-implemented method of claim 1 , further comprising determining at least one of a temporal location or an amplitude of the at least one data point within the time series data based on at least one characteristic of the time series data.
5. A system, comprising:
at least one processor;
memory that stores computer-executable instructions that, as a result of being executed by the one or more processors, cause the system to:
obtain time series data, the time series data comprising unlabeled data;
insert at least one data point into the time series data, the at least one data point representing a first anomaly relative to the time series data;
divide the time series data into a plurality of windows, the plurality of windows comprising a first window and a second window; and
determine an anomaly score for the first window based on a comparison of the time series data in at least the first window with the time series data in the second window and based on the at least one data point, the anomaly score indicating a likelihood that the first window contains a second anomaly.
6. The system of claim 5 , wherein the computer-executable instructions further include instructions that further cause the system to:
train a model to detect anomalies in the time series data using at least a portion of the time series data and the at least one data point; and
determine the anomaly score for the first suspect window using the trained model.
7. The system of claim 6 , wherein the model comprises a convolutional neural network.
8. The system of claim 6 , wherein the computer-executable instructions further include instructions that further cause the system to:
determine the anomaly score for the first window using a contrastive loss function that compares the time series data in the first window with the time series data in the second window.
9. The system of claim 5 , wherein the computer-executable instructions further include instructions that further cause the system to:
separate a first window of the plurality of windows into a first context window and a first suspect window; and
determine the anomaly score for the first suspect window based on a comparison of the time series data in the first window with the time series data in the first context window and based on the at least one data point.
10. The system of claim 9 , wherein the computer-executable instructions further include instructions that further cause the system to:
separate a second window of the plurality of windows into a second context window and a second suspect window; and
determine an anomaly score for the second suspect window based on: a comparison of the time series data in the second window with the time series data in the second context window; the time series data in at least one of the first window, the first context window, or the first suspect window; and the at least one data point.
11. The system of claim 10 , wherein the computer-executable instructions further include instructions that further cause the system to:
select the second window such that the second window at least partially overlaps the first window.
12. The system of claim 5 , wherein the computer-executable instructions further include instructions that further cause the system to:
determine the at least one data point based on at least one characteristic of the time series data.
13. The system of claim 5 , wherein the at least one data point comprises a portion of the time series data beginning at a first time in the time series data; and wherein the computer-executable instructions further include instructions that further cause the system to:
inject the at least one data point into the time series data at a second in the time series data.
14. The system of claim 5 , wherein the computer-executable instructions further include instructions that further cause the system to:
determine at least one of a length of the first window, a length of the context window, or the length of the suspect window based on at least one temporal characteristic of the time series data.
15. A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
inject at least one data point into time series data, the at least one data point representing a first anomaly relative to the time series data;
segment the time series data into a plurality of windows, wherein a first window of the plurality of windows is further separated into a first context window and a first suspect window; and
determine an anomaly score for the first suspect window based on a comparison of the time series data in the first window with the time series data in the first context window and based on the at least one data point, the anomaly score indicating a likelihood that the first suspect window contains a second anomaly.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to:
train at least one model to detect anomalies in the time series data using at least a portion of the time series data and the at least one data point; and
determine the anomaly score for the first suspect window using the trained model.
17. The non-transitory computer-readable storage medium of claim 15 , wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to:
determine the anomaly score for the first suspect window using a contrastive loss function.
18. The non-transitory computer-readable storage medium of claim 15 , wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to:
separate a second window of the plurality of windows into a second context window and a second suspect window; and
determine an anomaly score for the second suspect window based on a comparison of the time series data in the second window with the time series data in the second context window, based on the time series data in at least one of the first window, the first context window, or the first suspect window, and based on the at least one data point.
19. The non-transitory computer-readable storage medium of claim 15 , wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to select the second window such that the second window at least partially overlaps the first window.
20. The non-transitory computer-readable storage medium of claim 15 , wherein the time series data further comprises labeled data.