UoCAD2: An unsupervised online contextual anomaly detection approach using optimized hyperparameters of RNNs for multivariate time series

Internet of Things (IoT) based smart devices are gradually becoming part of daily lives through their increasing usage in industry, healthcare, agriculture, environmental monitoring, energy, transportation, and smart cities, buildings, and homes. IoT devices generate fast-paced time-bound data known as time series. Time series often contain anomalies, i.e., unusual patterns or deviations from the norm, that can disrupt services and must be detected quickly. Many researchers have tried to detect unlabeled anomalies by employing unsupervised online anomaly detection approaches based on Recurrent Neural Networks (RNN). RNNs are specially designed to process sequential data. However, selecting the right type of RNN and appropriate hyperparameters for a specific data domain is challenging. Another challenge in the online processing of time series is to pick out an appropriate sliding window size, that is small enough to process the incoming data in a limited time and large enough to capture the underlying deviations in the data. This study extends the Unsupervised Online Contextual Anomaly Detection (UoCAD) approach to overcome these challenges by proposing UoCAD2. UoCAD2 conducts hyperparameter optimisation on six RNN variants in an offline phase and uses fine-tuned hyperparameters to detect anomalies during the online phase. The experiments evaluate the proposed framework on three IoT datasets containing contextual anomalies. Precision, Recall, F1 score, and detection time are the evaluation metrics used in this study. This study recommends selecting the best combination of RNN-based models, optimal hyperparameters, and window sizes for contextual anomaly detection in multivariate time series data. UoCAD2 comprises an offline phase that includes a hyperparameter tuner, which takes a multivariate time series dataset and selected RNN-based models—RNN, LSTM, GRU, Stacked LSTM, CNN-LSTM, and LSTM with attention—to perform hyperparameter optimisation. The optimised hyperparameters are passed to the respective RNN model for online sliding window-based anomaly detection from three IoT datasets. • Extends the UoCAD method for online contextual anomaly detection from IoT time series. • Performed automatic hyperparameter optimisation of six RNN-based models for the smart home and industrial IoT datasets. • Evaluation of six RNN-based models with optimised hyperparameters for UoCAD2. • Experiments on eight sliding-window sizes along with individual and majority detection criteria. • Recommendations provided for selection of optimal sliding-window size, RNN model, hyperparameters, and anomaly detection criteria.