arXiv:2602.04917cs.LG2026-02被引 1

针对异构数据流的异常检测,提出可自动建模分布与时间动态的新方法。

Multi-Aspect Mining and Anomaly Detection for Heterogeneous Tensor Streams

  • 用高斯过程建模连续属性分布和时间动态,避免离散化损失
  • 在真实数据上组异常检测准确率优于现有方法,计算耗时不随数据量增长
  • 适合网络日志等含类别与连续属性的时序数据异常发现

由时间戳和多属性构成的事件张量流(如通信日志:时间、IP地址、包长度)分析与异常检测是数据挖掘中的关键任务。现有张量分解与异常检测方法存在两大局限:(i) 难以处理异构张量流,即同时包含类别属性(如IP地址)与连续属性(如包长度),通常需对连续属性离散化或将类别属性视为连续,均会扭曲数据统计特性;且对连续属性分布族假设不当会降低模型性能。(ii) 时间戳被离散化,无法追踪流的时间动态(如趋势、异常事件),导致难以检测群体异常(如拒绝服务攻击)。为此,我们提出HeteroComp,一种持续将异构张量流压缩为表示各属性潜在分组及其时间动态的“成分”,并检测群体异常的方法。该方法采用高斯过程先验直接从数据估计连续属性的概率密度及时间动态。提取的成分提供简洁有效的摘要,支持精准的群体异常检测。在真实数据集上的大量实验表明,HeteroComp在群体异常检测准确率上超越现有最优算法,且计算时间不随数据流长度增加。

原文摘要 · Abstract (English)

Analysis and anomaly detection in event tensor streams consisting of timestamps and multiple attributes - such as communication logs(time, IP address, packet length)- are essential tasks in data mining. While existing tensor decomposition and anomaly detection methods provide useful insights, they face the following two limitations. (i) They cannot handle heterogeneous tensor streams, which comprises both categorical attributes(e.g., IP address) and continuous attributes(e.g., packet length). They typically require either discretizing continuous attributes or treating categorical attributes as continuous, both of which distort the underlying statistical properties of the data.Furthermore, incorrect assumptions about the distribution family of continuous attributes often degrade the model's performance. (ii) They discretize timestamps, failing to track the temporal dynamics of streams(e.g., trends, abnormal events), which makes them ineffective for detecting anomalies at the group level, referred to as 'group anomalies' (e.g, DoS attacks). To address these challenges, we propose HeteroComp, a method for continuously summarizing heterogeneous tensor streams into 'components' representing latent groups in each attribute and their temporal dynamics, and detecting group anomalies. Our method employs Gaussian process priors to model unknown distributions of continuous attributes, and temporal dynamics, which directly estimate probability densities from data. Extracted components give concise but effective summarization, enabling accurate group anomaly detection. Extensive experiments on real datasets demonstrate that HeteroComp outperforms the state-of-the-art algorithms for group anomaly detection accuracy, and its computational time does not depend on the data stream length.

异常检测张量流高斯过程异构数据

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。