ai.bythebay.io: Mike Tamir, The Advantages of Deep Learning with Recurrent Neural Networks
[Music] so what I'm going to be talking about today is using deep learning particular RNN which we've heard a lot about so far for real-time anomaly detection here's a quick agenda of what we're going to be doing I want to start off just with talking about the problem landscape so we have a common language on the sorts of problems that we're actually approaching we'll go through some traditionals there's some traditional strategies so static anomaly detection time series anomaly detection some of the things that that were more popular a few years ago before our own ends came in to their to their own and then we're going to dive into deep learning strategies talking about time series forecasting with RNN how you can use that anomaly detection and in particular the fun stuff which is what are the common issues that you might run into and how might you address those issues all right so starting off with a problem landscape there are some key questions that we all need to understand make sure that we don't well we don't bleed are our usage of one of these concepts with the others so supervised and unsupervised what is going on with nomally section there in particular in the time series case multivariate versus univariate and how you can use multiple multiple input features in your forecasting and also are you classifying for anomalies with respect to multiple features and then of course using static vs. time series data so for unsupervised and supervisors there's a very fundamental level anomaly detection is an exercise in unsupervised machine learning what you're mostly trying to do is find those data points that are different in some way and/or in relevant ways from the core behavior that either core patterns that you tend to see in in your time in your data set however supervised learning techniques creep in there all the time in all sorts of ways so specifically for the predict and analyzed strategy where you're doing time series forecasting and then you do your animal analysis of residuals which we're going to focus a lot of the back end of this talk on that's going to be an exercise in in supervised learning also when you're integrating feedbacks which is something that inevitably you're going to want to do for most anomaly detection use cases that's also involve supervised learning alright so another important important boundary that we're going to want to keep straight in our mind is multivariate target versus univariate target and this is different from a multivariate versus univariate input so here we have a nice diagram that I made with with G docs and we see in D you have your x1 feature here and your x2 feature here and there's a clear relationship with the standard data points these blue data points it's roughly inverse linear and and that would be the area of normal behavior in that case this red guy it's clearly out of bounds of the normal expected behavior however inept if it's two-dimensional hazards with it's one-dimensional you might say look at the this is going to be the distribution of the data points the now green guy is this guy that was anomalous when you look at two features simultaneously the x1 and x2 now is writing that need to be part of the curve of the distribution so how you consider your target features is going to have a big influence on what counts as anomalous or not an anomalous and definitely on used case is going to be something you want to pay attention to all right the last last bit of perfunctory they don't want to go over is static data versus time series data so if you look at the distribution here on the left hand side when you have something as relative a periodic it's going to be basically a uniform distribution you have as many data points up here as you do over here if you literally project them over to to get a distribution right here right on the left the of the of the curve and what that means is that just looking at the distribution is going to be kind of a poor way of detecting when an anomaly happens because if you break the pattern as you might break over here in this time series you're going to end up not seeing it at all it's worth squarely in the center of that distribution so when you're talking about time series data it can be very important to actually not just talk about the distribution of what the other points are but also where the data points should be at that moment in the time series alright now let's talk about some traditional strategies so the first one that you probably learned when you are in grad school or when you were just googling scikit-learn or some of them whatever was it's probably one class one class svm are sometimes called nu SVM for the key parameter there this is the brother butter it's highly non scalable usually you use a nonlinear current kernel and what it does is instead of instead of separating the positive and the negative cases the ones and zeros what's going to do is find a separating hyperplane that separates from the origin and usually the denominator your kernel and you end up getting a graph like this this was a an example that is pretty easy to pull up using any of any of the open source open source implementations another traditional tactic is Gaussian mixture models Gaussian mixture models is an exercise in fitting a gasping usually get hopefully a Gaussian with with off diagonal covariance matrix term and those off diagonal covariance matrix terms or if the diagonals or not are not identical are going to end up giving you heat maps that are a contour maps that are ellipsoid and ellipsoids with different different shapes different rotations and different major and minor axes these are two-dimensional but you can imagine with your 6 & 7 dimensional visualization how this can can what this might look like in more than one dimension typically it's done with expectation maximization and then you'll loop through K equals 1 cables to takes equal 3 and have different metrics for fit to see which is the right number of modes to add and while there are fewer open-source implementations of this you can also do this with with distribution of the Gaussian which you might very well do and different depending on your use case the last one which is I think probably now a little bit less popular a little bit less yeah you might not have seen this before is the the the technique for taking a moving window of vectors and then plotting those creating vectors in a vector space based on that moving window of select time series so for visualization purposes I've chosen a window size of M equals 2 and then you kind of run down there and you plot each of those data points in your space and you might see a pattern right you might see that oh most of my curves end up and if you think about it each of those windows are going to be a snapshot of a section of a curve that you might see in your time series and you can get the normal ones and then you can get ones that may not happen now there are all sorts of famous examples that I don't want get into on the pros and cons of this this technique the most important thing that you want to make sure that you do here is you know choosing your window size M is very important it has to be large enough to capture time series relevant patterns if you make it too short you're going to end up seeing basically every kind of shape there is and there's if you make too long you have crystal dimension knowledge so figuring out techniques for managing that for maybe having a move moving window vector embedded and then doing a kind of encoding like saks encoding which having these these references at the bottom are that's the way you get around that when you're doing this this sort of strategy all right last but not least and the one that we're going to be focusing the rest of our time on is the forecast and analyze residuals strategy so or predict an analyze residual strategy so this one is the is hopefully very suggestively described by the diagram you have your time series you at this time T it's our time T you predict your next data point which expect to be here but Oh your actual might not be there and then depending on how much your actual misses your forecasted you're going to end up so that is say how bad your residual is you're going to either classify as an anomaly or not anomaly this is something that that there are lots of different approaches to this they lots of different approaches to how you're going to fold cut forecast and what you're going to do in what counts is residual scoring scoring the how big of a residual is a is a detrimental residual and typically that that goes into again static distribution analysis so you might fit it with the GMM a one-dimensional work and dimensional G M and then you'll find the the low probability areas of that residual space typically hopefully if you built your LCM right or you built your forecast too right you're going to end up with something that is one low about you know modal but there are all sorts of cases where you might actually depending on that pattern the data end up with more than one mode and you might have to manage those tricky valleys in the in the middle so well one more one more moment a moment talking about this I've talked about a univariate residual but you can also imagine if you have an array of sensor data and you're you're checking several time series at a time you would have a residual that you might see in each of those sensors or for each of those sensors so you can do not just univariate residual analysis here for the static case once you once you create your residual vectors you can also do multivariate and so it's very flexible in that way all right so last photos of Nandi flirting the there are a lot of traditional time series methods out there there's Rima and social smoothing gosh and and generalized on over scouring often what you'll run into is a low flexibility they'll have difficulty adapting to certain kinds of patterns there they're more or less designed for detecting very specific kinds of patterns and so if you have fluctuating days or or things like that they will or they can tend to break and just a shout-out especially to the forecast package which is the reason why probably a lot of you still broke out are even just Danish thanks Rob and over the summer a rough Taylor released pi flux which is a Python implementation okay so now recurrent neural networks so these probably don't need an introduction displayed in the day but just in case we have this sort of structure where you're you've got your passing out your your your output HT and you're also passing back certain certain results that happen in that recurrent neural network communites cues so what does it look like on the inside really quickly throwing up the DL STM framework there which is a very common one and actually a pretty good one that we found for for anomaly detection LCM as we saw earlier with the the Salesforce presentation are really good at keeping track of what I should remember and what I should not remember and so you have here you have your forget gate your input gate which are all going to take an ax take into account the hidden the hidden features the the X feature for that time point the identification last time point that asks from the last stage and learn to buy effectors that's going to affect the output gate the input gate and the forget gate you're also going to have this this new X data is going to throw into a a sigmoid function and be taking with a how to mark products for the input gate and then that will help you update the update the state of that cell in the state of that cell might be wiped away if you're forget gate gets triggered yes and then the equation 5 we see that the the output will be a result of the update and usually with the tange now there are all sorts of modifications to LCM I'm going to go through a few oh one that that can work out very well is if you give a little bit more control to the the cell-fate with people so the self gate will actually influence the forget output and input gate and meseta in these purple components of the equation another really great advance in lsdm architecture that is a little bit more recent is adding in phase so this can be very important especially when you have different sensor arrays and the different sensor arrays might bring in data at different times you might get one one bit of data with constant telemetry you might get one that is only going to take a snapshot every 10 minutes or every hour and they might not come in exactly at the same time the same stays so what you end up with is building in these these phase gates here here so in order to go from the pre phase a cell state to the post race cell state you're going to end up and end up waiting that with an on/off switch depending on the state of the phase where it is and you can control the period of the phase you can control where the phases or what they what the relative phase is from one to the other and also the ratio of on and off so in this paper with Emil at all they they know they experimented primarily with these spikes of just turning on and turning off and having a ratio there but you can easily imagine doing something that's a little bit more continuous alright so our n Enza spoke forecasters are great so first of all something that is not easy but can be done with traditional ones is you can incorporate exogenous variables you don't have to just pull in the last time series point or less sequence of time series points as you run it through you can have whole vectors so even if you want to do have a univariate target for one particular feature that you want in a time series you can pull in the entire vector of a sensor data or whatever integer you're you find is relevant and that will help you see for instance let's say you have a machine and the different machine parts are adjacent to one another seeing a one time series fluctuate in a certain way one one feature input in fluctuate in a certain way might actually have an input for the final output that you care about in the time series that you're looking for anomaly so looking at that cross influence could be very helpful you can also use a look use external context variable so these are ones that are not we're not going to be necessarily time series but you know the status on the ground so what's the location or the weather things like that if you do other sensor data and something that those of you who have worked in time series a field before are going to probably find it familiar that sometimes when you have constant telemetry you actually don't get that continuous telemetry what you end up getting is chunked up snapshots and instead of getting you know so like let's say every hour you might get a snapshot at that hour of the mean max min and standard deviation for what happened in that hour and so in order to unpack that non-constant telemetry but pseudo regular information that you get you might want to take into account the standard deviation at that during that period the the maximum in during that period in order to get a better forecast alright now for the exciting stuff how do you what actually goes wrong in when you're building this these and how do you fix it so there are several topics I want to go over truncate it back backdrop so how how big your look-back should be avoiding blow ups in your gradients and/or vanishing in your gradients and also just making sure that you have the right the light look back in the time series relevant for forecasting stacking dropout and regularization so controlling for that overfitting what kind of optimization meds did you care about what kind of error metrics you care about and also smoothing techniques so first not stacking I was describing in that original diagram just that that that first layer but it's not hard to see how you can take the output of a lower layer and feed that into a next layer you can really make these arbitrarily high LS dams are actually fairly good at stacking them and so you can add more degrees of freedom you can add more selective more a greater ability for your time series for tester to detect the relevant patterns and get the more accurate next results if you stack that's the sort of thing that you're going to hyper tuned now when you're adding these degrees of freedom you're going to want to also make sure you're not overfitting dropout is a you know this is something that we should all put in your head and remember as a as a thorn dropout doesn't work for horizontal arrows in LST M it can corrupt really important information that happens early in the time series that should that should pass through what dropout is for those of us who haven't haven't worked it worked on it well work with it as much it indents network so it turns out to be very well what you do is you want to prevent overfitting where one part of a deep net might learn one pattern but it's also kind of drifting towards a certain kind of weight structure and then another another part of the network will actually compensate for that so if you have enough parameters if you have a big enough network you'll end up sort of compensating with the parameters over here using the parameters are there and it'll end up being accurate and balanced but it's inefficient and it's not going to be as stable and so what dropout will do is kick out randomly different edges and see if them and then continue to train the matrix what happens when it's only got two legs and one leg instead of four legs and that can be very effective when you're not talking about that those times when you're talking about yeah because that time series pattern is very important doing a core for the horizontal arrows dropout is not suggested instead you might want to use regularization for those horizontal hours you can still use dropout for the vertical arrows okay so one of those good problems because else teams are so good at doing time series forecasting they might actually adapt to anomalous periods too well so you might actually get to the stage where you have a period of normal functioning then something happens and now there is a period of non normal functioning but your your your forecast curve can actually adapt and start forecasting the anomalous behavior very well and that's going to be a problem if you are in the business of detecting anomalies you kind of like forecast a new normal which is a phrase we hear a lot nowadays lots of solutions you can happen this one that relatively intuitive is you could change your error metric so if you're starting with meet squared error that's going to weight the the big outliers a little bit more so if you switch to roll it back to an AE or a log loss you're going to give less penalty to those big differences and that could help with that quick adjustment to to a new normal to a different kind of time series often that does not work well on its own you might you might also try this in combination with other techniques for instance multiple predictors so multiple dictor's you can imagine having I've been focusing on predicting at at one time step back but you can do it at several time steps back and what that's going to end up doing is it's sort of like a a moving average of the forecast values so your actual forecasted term is going to be what was forecasted one time step back and what was forecasted two times just backward forecasts and a forecast on the new time series and three times step back and that will end up pinning the behavior that happens back here as more of a normal kind of behavior and that'll hopefully prevent that over quick adapting to a new new behavior of course something that should be obvious but it's worth mentioning if you have known anomalies retraining with those anomalies redacted will help you identify the normal behavior better you don't want to learn on the anomalies if you can help it and then the last one which I'm going to take a couple moments on is the encoder/decoder architecture so what is that of going back to this fact stack lsdm picture you can you can see how a a sequence at times of your time series has lots of different paths for getting to this final stage so I can go through like information travels through each one of these edges and one of the things you can do is actually much like you see for for auto-encoders with with with dense neural nets you can also have these this auto encoder decoder structure for LS TMS and what you end up doing is you have your input sequence you feed it through and then you get your output sequence and try to reconstruct that that debt and why do we care about that well the whole idea about fitting is through this key hole for the encoder decoder is that the normal data the normal times of time series that your your lsdm network is training on will we'll be able to learn to adapt and to let those things fit through the keyhole the key hole woke the key hole will kind of adapt to what's normal data and then when you see abnormal data when you have abnormal time series then those are not going to fit through that key very well and they might they might have poor reconstruction all right so this is a this is the same graph and that's a that's suggestive it might not be that you are adapting too quickly to a new normal it might be that this is actually the pattern that is expected so you might think it's a maybe a phase function isn't like that if you have a different kinds of data might have a natural daytime nighttime behavior and it might be discrete it might be it might be more gradual but if it's if there's a sudden change let's say the clock will like to turn off and ever and the entire system powers down you might end up getting a one type time step or a couple time step spike so you get the spike in the residuals and that's like in the residuals it's really just an artifact it's supposed to shut down there and that sort of a sudden change throwing away its anomalous but you don't want your URL TM to Detective anomalous because this is going to happen every day and so you'll tend to see the same kind of spike in how do you manage those spikes this is going to be dependent on the kind of data that you're working with well you just commit you can do moving average which is what we have here where you go see exponential smoothing auto regression so all the kinds of smoothing that work with traditional time series well it can also be put as a layer over your residuals and then that residual analysis that much easier all right so a couple more couple more thoughts on how you do integrating labels some some examples of this in action which was a little bit of demo and then we can get into questions so how do you do integrating labels well number one there are going to be certain kind of outlier behaviors that are not true anomalies at least they're not the sort of saying that with your data you want to get alerted to all the time and so you might want to build a classifier supervised learning where you get feedback from from my SME or from somebody who's actually in the position to review the anomalies that you're going to you're going to release as part of your algorithm and give some feedback on it so circle the good ones X bad ones and then you could just build a natural classifier to to to filter out the false positives the false positive anomalies this can be done in all sorts of ways you can use your own set your own classifier you can actually do an LCM for that so you use all the exogenous variables but that sort of structure is very similar if you want go to Yammer out as I just described only now you're forecasting of your Hg so to speak is not the next time point it's going to be a a prediction of whether this is going to be a genuine anomaly or not genuine Amelie if it comes out that way it's far as an anomaly improve tuning for residual analysis so we talked about smoothing we talked about doing residual analysis when you have you know how big of your how far out in your tails or in your distribution low-low distributions that values what counts as a true outlier in your residual and so getting that feedback will help you you can integrate that in a very natural way in order to tune where you're going to set your threshold and then um retraining so again these algorithms work much better when you can pull out the anomalous period as much as possible so after you get to confirmed the confirmed of true positives anomalies we might want to kick those out of your time series and retrain and then your your forecaster will be that much better so here is an example in action and maybe we can just do questions while this is running this is a kind of a drag-and-drop demo of a tool like Ivana that does precisely these sorts of things in the background I'll stop it when it gets a little bit later in the video to talk talk about how this is integrated but I think it's got only five minutes maybe should start with questions with the ARIMA models before I found that like the choice of the parameters as well as your choice of exogenous variables could really shift the residual profile I'm wondering if you found the same thing for your models like finding completely changes like what what are large residuals what data points are smaller residuals so if sorry so what you're saying is that when you like in a Reema X depending on what those X's are that can really impact your residual yes certainly the residual analysis does need to happen you need to do a different visual analysis for every L stand model that's going to and just like for any any ARIMA model or other kind of model like that because you're going to have a quite a different residual behavior you know depending on your forecasting now we see her just one of the parts you know getting the feedback is important you can see that you actually will you know if you can create that blue cloud of confidence intervals and p-values so we're like how bad it was it was a bad residual you can you can end up you can end up flagging the ones that are outside of there and then here we have an example where you have several different metrics coming in simultaneously so not only are they all across pollinating influencing the forecasting for one another they also can be analyzed independently and actually in a multivariate static multivariate individual analysis as well yeah my question is for the univariate single time series case how much data do you actually need for these deep learning models to work totally depends on the data of the time series with telemetry it's one of those situations where because you have you might have one censored but because you're constantly getting in new data unless it's like once a day usually the volume of data is not as big of a problem because after if you're getting like one in one submitted or once every 10 minutes throughout the day it's not too long before you start getting building up millions of data points what about like once a day very much more sparse matrix have you worked with those so you've seen those in practice once a day is probably going to be rougher unless you have several years of data so yeah so a few thousand data points then you might want to shift more into short-term low trained examples and the new Venza bad invented data set is probably good example of that genre of anomaly detection any more questions and so we perhaps if not have different marbles are you going to be different multiple Aerith p.m. models for each variable or same RSP model can scale to multi variant yeah that's that's a great question an important one to get straight um you you would have a you would feed in potentially all of those variables into your LCM model but then you would have a different Alice TM model each one of which is responsible for predicting the next time point for that particular metric and then you would get your residual for that particular metric for each one of your models and then you would you would do residual analysis another alternative is you could do a forecasting remember elf games can forecast on multiple dimensions so you can also have it be multi very in and multivariate out is something that's harder to do with like a Rhema ax and then you can do your multivariate residual analysis or your univariate residual analysis on the differences for each one of those features thank you [Applause]