Anomaly detection in a network

Abstract

Anomaly detection for one or more streams of time-series data can use an encoder/decoder pair, such as in a variational autoencoder (VAE) in combination with an aggregator or classifier, such as a random isolation forest (RIF). A particular application relates to detecting anomalies in network updates in a large number of network devices that can transmit the updates to a collector for analysis. The encoder/decoder pair can include a neural network with long short-term memory cells or similar type cells. Using the combination, a single anomaly score can be produced from multiple streams of the time-series data.