{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,30]],"date-time":"2025-10-30T07:15:06Z","timestamp":1761808506383,"version":"build-2065373602"},"reference-count":41,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2021,11,5]],"date-time":"2021-11-05T00:00:00Z","timestamp":1636070400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"National Key R&amp;D Program of China","award":["2018YFB1601502"],"award-info":[{"award-number":["2018YFB1601502"]}]},{"DOI":"10.13039\/501100018617","name":"LiaoNing Revitalization Talents Program","doi-asserted-by":"publisher","award":["XLYC1902071"],"award-info":[{"award-number":["XLYC1902071"]}],"id":[{"id":"10.13039\/501100018617","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>Key performance indicator (KPI) anomaly detection is the underlying core technology in Artificial Intelligence for IT operations (AIOps). It has an important impact on subsequent anomaly location and root cause analysis. Variational auto-encoder (VAE) is a symmetry network structure composed of encoder and decoder, which has attracted extensive attention because of its ability to capture complex KPI data features and better detection results. However, VAE is not well applied to the modeling of KPI time series data and it is often necessary to set the threshold to obtain more accurate results. In response to these problems, this paper proposes a novel hybrid method for KPI anomaly detection based on VAE and support vector data description (SVDD). This method consists of two modules: a VAE reconstructor and SVDD anomaly detector. In the VAE reconstruction module, firstly, bi-directional long short-term memory (BiLSTM) is used to replace the traditional feedforward neural network in VAE to capture the time correlation of sequences; then, batch normalization is used at the output of the encoder to prevent the disappearance of KL (Kullback\u2013Leibler) divergence, which prevents ignoring latent variables to reconstruct data directly. Finally, exponentially weighted moving average (EWMA) is used to smooth the reconstruction error, which reduces false positives and false negatives during the detection process. In the SVDD anomaly detection module, smoothed reconstruction errors are introduced into the SVDD for training to determine the threshold of adaptively anomaly detection. Experimental results on the public dataset show that this method has a better detection effect than baseline methods.<\/jats:p>","DOI":"10.3390\/sym13112104","type":"journal-article","created":{"date-parts":[[2021,11,7]],"date-time":"2021-11-07T20:42:54Z","timestamp":1636317774000},"page":"2104","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":8,"title":["A Novel Hybrid Method for KPI Anomaly Detection Based on VAE and SVDD"],"prefix":"10.3390","volume":"13","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4563-4475","authenticated-orcid":false,"given":"Yun","family":"Zhao","sequence":"first","affiliation":[{"name":"School of Information Science and Technology, Dalian Maritime University, Dalian 116026, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiuguo","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Information Science and Technology, Dalian Maritime University, Dalian 116026, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zijing","family":"Shang","sequence":"additional","affiliation":[{"name":"School of Information Science and Technology, Dalian Maritime University, Dalian 116026, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhiying","family":"Cao","sequence":"additional","affiliation":[{"name":"School of Information Science and Technology, Dalian Maritime University, Dalian 116026, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2021,11,5]]},"reference":[{"key":"ref_1","first-page":"68","article-title":"Intelligent operation and maintenance based on machine learning","volume":"13","author":"Pei","year":"2017","journal-title":"Commun. CCF"},{"key":"ref_2","unstructured":"Kingma, D.P., and Welling, M. (2014, January 14\u201316). Auto-encoding variational bayes. Proceedings of the 2nd International Conference on Learning Representations (ICLR), Banff, AB, Canada."},{"key":"ref_3","unstructured":"Goodfellow, I.J., Pouget-Abadie, J., Mirza, M., Xu, B., Warde-Farley, D., Ozair, S., Courville, A., and Bengio, Y. (2014, January 8\u201313). Generative Adversarial Nets. Proceedings of the 28th Conference on Neural Information Processing Systems (NIPS), Montreal, QC, Canada."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Huang, Y., Li, Y., Liu, Y., Jing, R., and Li, M. (2021). A Multiple Comprehensive Analysis of scATAC-seq Based on Auto-Encoder and Matrix Decomposition. Symmetry, 13.","DOI":"10.3390\/sym13081467"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Xu, H., Feng, Y., Chen, J., Wang, Z., Qiao, H., and Chen, W. (2018, January 23\u201327). Unsupervised Anomaly Detection via Variational Auto-Encoder for Seasonal KPIs in Web Applications. Proceedings of the 27th World Wide Web (WWW) Conference, Lyon, France.","DOI":"10.1145\/3178876.3185996"},{"key":"ref_6","unstructured":"Chen, W., Xu, H., Li, Z., Pei, D., Chen, J., and Qiao, H. (May, January 29). Unsupervised Anomaly Detection for Intricate KPIs via Adversarial Training of VAE. Proceedings of the IEEE Conference on Computer Communications (IEEE INFOCOM), Paris, France."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long Short-Term Memory","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Comput."},{"key":"ref_8","first-page":"1544","article-title":"A Multimodal Anomaly Detector for Robot-Assisted Feeding Using an LSTM-based Variational Autoencoder","volume":"3","author":"Daehyung","year":"2017","journal-title":"IEEE Robot. Autom. Lett."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Niu, Z., Yu, K., and Wu, X. (2020). LSTM-Based VAE-GAN for Time-Series Anomaly Detection. Sensors, 20.","DOI":"10.3390\/s20133738"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Bowman, S.R., Vilnis, L., Vinyals, O., Dai, A.M., and Bengio, S. (2016, January 11\u201312). Generating Sentences from a Continuous Space. Proceedings of the 20th Conference on Computational Natural Language Learning (CoNLL), Berlin, Germany.","DOI":"10.18653\/v1\/K16-1002"},{"key":"ref_11","unstructured":"Kingma, D.P., Salimans, T., Jozefowicz, R., Chen, X., Sutskever, I., and Welling, M. (2016, January 5\u201310). Improving Variational Inference with Inverse Autoregressive Flow. Proceedings of the 30th Conference on Neural Information Processing Systems (NIPS), Barcelona, Spain."},{"key":"ref_12","unstructured":"Xu, J., and Durrett, G. (November, January 31). Spherical Latent Spaces for Stable Variational Autoencoders. Proceedings of the Conference on Empirical Methods in Natural Language Processing, Brussels, Belgium."},{"key":"ref_13","unstructured":"Yang, Z., Hu, Z., Salakhutdinov, R., and Berg-Kirkpatrick, T. (2017, January 6\u201311). Improved Variational Autoencoders for Text Modeling using Dilated Convolutions. Proceedings of the 34th International Conference on Machine Learning (ICML), Sydney, Australia."},{"key":"ref_14","first-page":"1","article-title":"Variational autoencoder based anomaly detection using reconstruction probability","volume":"2","author":"An","year":"2015","journal-title":"Spec. Lect. IE"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Suh, S., Chae, D.H., Kang, H.G., and Choi, S. (2016, January 24\u201329). Echo-state conditional variational autoencoder for anomaly detection. Proceedings of the International Joint Conference on Neural Networks (IJCNN), Vancouver, BC, Canada.","DOI":"10.1109\/IJCNN.2016.7727309"},{"key":"ref_16","unstructured":"Zong, B., Song, Q., Min, M.R., Cheng, W., Lumezanu, C., Cho, D., and Chen, H. (May, January 30). Deep autoencoding Gaussian mixture model for unsupervised anomaly detection. Proceedings of the 6th International Conference on Learning Representations (ICLR), Vancouver, BC, Canada."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"602","DOI":"10.1016\/j.neunet.2005.06.042","article-title":"Framewise phoneme classification with bidirectional LSTM and other neural network architectures","volume":"18","author":"Graves","year":"2005","journal-title":"Neural Netw."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Zhu, Q.L., Bi, W., Liu, X.J., Ma, X.Y., Li, X.L., and Wu, D.P. (2020, January 5\u201310). A Batch Normalized Inference Network Keeps the KL Vanishing Away. Proceedings of the 58th Annual Meeting of the Association-for-Computational-Linguistics (ACL), Seattle, WA, USA.","DOI":"10.18653\/v1\/2020.acl-main.235"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"19","DOI":"10.1080\/00224065.1986.11979014","article-title":"The Exponentially Weighted Moving Average","volume":"18","author":"Hunter","year":"1986","journal-title":"J. Qual. Technol."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"45","DOI":"10.1023\/B:MACH.0000008084.60811.49","article-title":"Support Vector Data Description","volume":"54","author":"Tax","year":"2004","journal-title":"Mach. Learn."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"88","DOI":"10.1080\/00031305.1994.10476030","article-title":"The three sigma rule","volume":"48","author":"Pukelsheim","year":"1994","journal-title":"Am. Stat."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Yaacob, A.H., Tan, I.K., Chien, S.F., and Tan, H.K. (2010, January 26\u201328). ARIMA Based Network Anomaly Detection. Proceedings of the Second International Conference on Communication Software and Networks (ICCSN), Singapore.","DOI":"10.1109\/ICCSN.2010.55"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"9653230","DOI":"10.1155\/2016\/9653230","article-title":"An improved ARIMA-based traffic anomaly detection algorithm for wireless sensor networks","volume":"12","author":"Yu","year":"2016","journal-title":"Int. J. Distrib. Sens. Netw."},{"key":"ref_24","first-page":"1","article-title":"Time series forecasting using Holt-Winters exponential smoothing","volume":"4329008","author":"Kalekar","year":"2004","journal-title":"Kanwal Rekhi Sch. Inf. Technol."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Laptev, N., Amizadeh, S., and Flint, I. (2015, January 10\u201313). Generic and Scalable Framework for Automated Time-series Anomaly Detection. Proceedings of the 21st ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), Sydney, Australia.","DOI":"10.1145\/2783258.2788611"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Liu, D.P., Zhao, Y.J., Xu, H.W., Sun, Y.Q., Pei, D., Luo, J., Jing, X.W., and Feng, M. (2015, January 28\u201330). Opprentice: Towards Practical and Automatic Anomaly Detection Through Machine Learning. Proceedings of the ACM Internet Measurement Conference(IMC), Tokyo, Japan.","DOI":"10.1145\/2815675.2815679"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"121","DOI":"10.1016\/j.patcog.2016.03.028","article-title":"High-dimensional and large-scale anomaly detection using a linear one-class SVM with deep learning","volume":"58","author":"Erfani","year":"2016","journal-title":"Pattern Recognit."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"1971","DOI":"10.1007\/s11277-016-3433-3","article-title":"An Efficient Hybrid Anomaly Detection Scheme Using K-Means Clustering for Wireless Sensor Networks","volume":"90","author":"Wazid","year":"2016","journal-title":"Wirel. Pers. Commun."},{"key":"ref_29","unstructured":"Laxhammar, R., Falkman, G., and Sviestins, E. (2009, January 6\u20139). Anomaly detection in sea traffic\u2014A comparison of the Gaussian Mixture Model and the Kernel Density Estimator. Proceedings of the 12th International Conference on Information Fusion(FUSION), Seattle, WA, USA."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"105187","DOI":"10.1016\/j.knosys.2019.105187","article-title":"adVAE: A self-adversarial variational autoencoder with Gaussian anomaly prior knowledge for anomaly detection","volume":"190","author":"Wang","year":"2020","journal-title":"Knowl.-Based Syst."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"102213","DOI":"10.1016\/j.cose.2021.102213","article-title":"ADS-B anomaly data detection model based on VAE-SVDD","volume":"104","author":"Luo","year":"2021","journal-title":"Comput. Secur."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Qiu, J., Du, Q.F., and Qian, C.S. (2019). KPI-TSAD: A Time-Series Anomaly Detector for KPI Monitoring in Cloud Applications. Symmetry, 11.","DOI":"10.3390\/sym11111350"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"130","DOI":"10.1016\/j.neucom.2021.03.062","article-title":"A Joint Model for IT Operation Series Prediction and Anomaly Detection","volume":"448","author":"Chen","year":"2021","journal-title":"Neurocomputing"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"94","DOI":"10.1016\/j.eswa.2019.06.028","article-title":"ALSR: An adaptive label screening and relearning approach for interval-oriented anomaly detection","volume":"136","author":"Wang","year":"2019","journal-title":"Expert Syst. Appl."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Li, J., Di, S., Shen, Y., and Chen, L. (2021, January 8\u201312). FluxEV: A Fast and Effective Unsupervised Framework for Time-Series Anomaly Detection. Proceedings of the Fourteenth International Conference on Web Search and Data Mining (WSDM), Virtual Event, Israel.","DOI":"10.1145\/3437963.3441823"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Siffer, A., Fouque, P.A., Termier, A., and Largouet, C. (2017, January 13\u201317). Anomaly Detection in Streams with Extreme Value Theory. Proceedings of the 23rd International Conference on Knowledge Discovery and Data Mining (KDD), Halifax, NS, Canada.","DOI":"10.1145\/3097983.3098144"},{"key":"ref_37","first-page":"66","article-title":"Influences of different interpolation methods on GPS time series","volume":"44","author":"Yang","year":"2019","journal-title":"Gnss World China"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Hundman, K., Constantinou, V., Laporte, C., Colwell, I., and Soderstrom, T. (2018, January 19\u201323). Detecting Spacecraft Anomalies Using LSTMs and Nonparametric Dynamic Thresholding. Proceedings of the 24th ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD), London, UK.","DOI":"10.1145\/3219819.3219845"},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"397","DOI":"10.1109\/TAP.2004.823969","article-title":"Particle swarm optimization in electromagnetics","volume":"52","author":"Robinson","year":"2004","journal-title":"IEEE Trans. Antennas Propag."},{"key":"ref_40","first-page":"2812","article-title":"Principal Component Analysis","volume":"6","author":"Bro","year":"2014","journal-title":"J. Mark. Res."},{"key":"ref_41","first-page":"2579","article-title":"Visualizing Data using t-SNE","volume":"9","author":"Laurens","year":"2008","journal-title":"J. Mach. Learn. Res."}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/13\/11\/2104\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T07:26:33Z","timestamp":1760167593000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/13\/11\/2104"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,11,5]]},"references-count":41,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2021,11]]}},"alternative-id":["sym13112104"],"URL":"https:\/\/doi.org\/10.3390\/sym13112104","relation":{},"ISSN":["2073-8994"],"issn-type":[{"type":"electronic","value":"2073-8994"}],"subject":[],"published":{"date-parts":[[2021,11,5]]}}}