Detectability Driven Recommendation of Anomaly Detection Models for Time-Series Data

Anomaly detection for time-series data has been viewed widely in many practical applications and caused lots of research interests. A popular solution based on deep learning techniques is first building an anomaly detection model by offline learning on a specific training data and subsequently utilizing the model to detect anomalies in the online setting. On the one hand, previous works have introduced a plenty of learning methods for building anomaly detection models, but it is well known that no one can perform best in all settings. Therefore, there is usually high demand for collecting multiple detection models in practical applications. On the other hand, in view of the limited computing resources in many online anomaly detection applications, it is almost impossible to run multiple detection models simultaneously due to the high time cost. Then, a natural idea is to enhance the general anomaly detection procedure with an effective mechanism for selecting proper models to avoid the high cost caused by executing too many detection models. Previous works focusing on the recommendation either are time inefficient or usually show weak performance, suffering from the missing labels and heterogeneous data characteristics met in real applications. Therefore, it is highly needed to design effective recommendation methods for automatically choosing anomaly detection models. Motivated by the technical challenges, a novel recommendation method for anomaly detection models is proposed in this article. First, a model recommendation framework based on the concept of detectability is introduced, where the detectability of an anomaly detection model is defined using a fine-grained strategy for comparing data characteristics. Then, based on efficient techniques for computing detectability, an efficient model recommendation algorithm is designed. Finally, extensive experimental results are produced on real time series and typical anomaly detection methods, and show that the proposed method is both effective and efficient.