Switching Gaussian Mixture Variational RNN for Anomaly Detection of Diverse CDN Websites

To conduct service quality management of industry devices or Internet infrastructures, various deep learning approaches have been used for extracting the normal patterns of multivariate Key Performance Indicators (KPIs) for unsupervised anomaly detection. However, in the scenario of Content Delivery Networks (CDN), KPIs that belong to diverse websites usually exhibit various structures at different timesteps and show the non-stationary sequential relationship between them, which is extremely difficult for the existing deep learning approaches to characterize and identify anomalies. To address this issue, we propose a switching Gaussian mixture variational recurrent neural network (SGmVRNN) suitable for multivariate CDN KPIs. Specifically, SGmVRNN introduces the variational recurrent structure and assigns its latent variables into a mixture Gaussian distribution to model complex KPI time series and capture the diversely structural and dynamical characteristics within them, while in the next step it incorporates a switching mechanism to characterize these diversities, thus learning richer representations of KPIs. For efficient inference, we develop an upward-downward autoencoding inference method which combines the bottom-up likelihood and up-bottom prior information of the parameters for accurate posterior approximation. Extensive experiments on real-world data show that SGmVRNN significantly outperforms the state-of-the-art approaches according to F1-score on CDN KPIs from diverse websites.

I. Introduction

Today’s commercial Content Delivery Networks (CDN) typically provide content delivery services for tens of thousands of websites, making it extremely important to monitor and ensure the services of these websites under the constraints specified by the service level agreements (SLA). To this end, CDN operators usually collect various Key Performance Indicators (KPIs) for each website, e.g., traffic volume, delay, and hit ratio, etc., and perform anomaly detection for these multivariate KPIs to detect a service failure or degradation.