Event and Anomaly Detection Using Tucker3 Decomposition

Abstract

Failure detection in telecommunication networks is a vital task. So far, severalsupervised and unsupervised solutions have been provided for discovering failures insuch networks. Among them unsupervised approaches has attracted more attentionsince no label data is required. Often, network devices are not able to provideinformation about the type of failure. In such cases the type of failure is not knownin advance and the unsupervised setting is more appropriate for diagnosis. Amongunsupervised approaches, Principal Component Analysis (PCA) is a well-knownsolution which has been widely used in the anomaly detection literature and canbe applied to matrix data (e.g. Users-Features). However, one of the importantproperties of network data is their temporal sequential nature. So considering theinteraction of dimensions over a third dimension, such as time, may provide us betterinsights into the nature of network failures. In this paper we demonstrate the powerof three-way analysis to detect events and anomalies in time-evolving network data.