Research On Correlation-Aware Unsupervised Deep Anomaly Detection Model

Anomaly detection is one of the technologies in computer related fields.It has been widely used in network security,pattern recognition,data mining and other application fields.Anomaly detection is designed to detect abnormal patterns within normal patterns.Unsupervised anomaly detection method finds abnormal data by estimating the probability density of samples.Therefore,unsupervised method plays an important role in anomaly detection.The existing unsupervised anomaly detection methods usually only analyze the original characteristics of the data and ignore the implied correlation information between the data,resulting in an unsatisfactory anomaly detection effect.This paper proposes an unsupervised anomaly detection scheme based on data correlation.In order to extract the correlation information of the data,this paper models the correlation between the data through the graph structure.First,in the original feature space of the data,k-nearest neighbor(k-NN)algorithm is used to analyze the similarity of the data.Then,according to the similarity between the data,the undigraph is constructed to represent the correlation between the data.Finally,a correlation mining model is designed to deeply mine the correlation information between the data.In order to make use of the correlation information of the data,this paper designs correlation-aware autoencoders in Gaussian mixed model(CAAE-GMM),model through correlation information between data mining,and design based on Gaussian mixture model estimates network,is used to forecast data of probability density,the end is used for anomaly detection.On top of that,on the basis of the AE-DCGMM,dual autoencoders model is put forward,based on that we designed correlation-aware dual-autoencoders in Gaussian mixed model(CADAE-GMM),the model use two parallel structure of the encoder,the features of the original data and data correlation information respectively,and two kinds of characteristics of fusion,as the output of the encoder.At the same time,in order to prevent the loss of information in the process of data dimensionality reduction,the reconstruction error is used as a feature and the output cascade of the encoder is used as the low-dimensional embedding of the data,which is finally input into the estimation network to predict the probability density of the data.Experimental results show that the above two models can effectively improve the performance of anomaly detection.After the combination of the two,all kinds of feature information contained in the data are fully mined from different sides,and then the model's anomaly detection capability of all kinds of data can be maximized after the fusion.