Adversarial Deep Domain Adaptation Method for Unsupervised Anomaly Detection

Many unsupervised anomaly detection (UAD) methods for the telecommunication network that use only normal data collected from routers or servers such as traffic volumes and text logs have been developed to detect anomalies. Although system operators need to collect enough amount of normal data to learn various normal states, normal states of the telecommunication network change due to the addition or deletion of devices, configuration changes, and OS updates. As a result, UAD methods cannot be used to monitor the system during data collection. The use of domain adaptation can reduce the duration of collecting data in the telecommunication network’ normal state. However, existing unsupervised domain adaptation (UDA) methods cannot be applied to anomaly detection in telecommunication networks since existing UDA methods need source labels, assume dimensions of the data in the source and target domains are the same. In this paper, we propose an Adversarial Deep Domain Adaptation for Unsupervised Anomaly Detection by introducing encoders for source and target domain, adversarial domain adaptation, and deep one-class classification without labels in both source and target domains. ADDA-UAD is evaluated using three types of telecommunication network data, traffic data, security data, and system logs that are open to the public. By preparing eight datasets, comprehensive experiments are conducted and found that ADDA-UAD improves the accuracy of anomaly detection in the target domain comparing with the baseline methods.