Anomaly detection in multivariate time series is a critical component of modern cybersecurity systems. Deep learning-based Autoencoders (AEs) are widely used for this task, typically employing Long Short-Term Memory (LSTM), Temporal Convolutional Networks (TCN), or Transformers as backbones. However, standard AEs predominantly rely on a uniform Mean Squared Error (MSE) loss function, which treats all input features equally regardless of their inherent noise or stability. This paper proposes a generalized Feature-Scaled Reconstruction Loss (FSRL) that is architecture-agnostic. FSRL dynamically weights the reconstruction error of each feature based on its stability profile learned during a pre-training phase on benign data. We evaluate FSRL across LSTM-AE, TCN-AE, and Transformer-AE architectures on two benchmark datasets: CICDDoS2019 (network traffic) and the Server Machine Dataset (SMD). Experimental results demonstrate that FSRL consistently outperforms both standard MSE and supervised Random Forest-weighted baselines across all architectures, achieving state-of-the-art F1-scores of 0.9810 on CICDDoS2019 and 0.9450 on SMD using the Transformer variant. Furthermore, we provide a theoretical justification for FSRL using maximum likelihood estimation and perform extensive sensitivity analysis on model hyperparameters.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Generalizing Feature-Scaled Reconstruction Loss for Deep Autoencoders in Multivariate Time Series Anomaly Detection

  • Pham Truong Son,
  • Dinh Doan Xuan Phuong

摘要

Anomaly detection in multivariate time series is a critical component of modern cybersecurity systems. Deep learning-based Autoencoders (AEs) are widely used for this task, typically employing Long Short-Term Memory (LSTM), Temporal Convolutional Networks (TCN), or Transformers as backbones. However, standard AEs predominantly rely on a uniform Mean Squared Error (MSE) loss function, which treats all input features equally regardless of their inherent noise or stability. This paper proposes a generalized Feature-Scaled Reconstruction Loss (FSRL) that is architecture-agnostic. FSRL dynamically weights the reconstruction error of each feature based on its stability profile learned during a pre-training phase on benign data. We evaluate FSRL across LSTM-AE, TCN-AE, and Transformer-AE architectures on two benchmark datasets: CICDDoS2019 (network traffic) and the Server Machine Dataset (SMD). Experimental results demonstrate that FSRL consistently outperforms both standard MSE and supervised Random Forest-weighted baselines across all architectures, achieving state-of-the-art F1-scores of 0.9810 on CICDDoS2019 and 0.9450 on SMD using the Transformer variant. Furthermore, we provide a theoretical justification for FSRL using maximum likelihood estimation and perform extensive sensitivity analysis on model hyperparameters.