Ymir: A Supervised Ensemble Framework for Multivariate Time Series Anomaly Detection

Abstract: We proposed a multivariate time series anomaly detection frame-work Ymir, which leverages ensemble learning and supervisedlearning technology to efficiently learn and adapt to anomaliesin real-world system applications. Ymir integrates several currentlywidely used unsupervised anomaly detection models through anensemble learning method, and thus can provide robust frontalanomaly detection results in unsupervised scenarios. In a super-vised setting, domain experts and system users discuss and providelabels (anomalous or not) for the training data, which reflects theiranomaly detection criteria for the specific system. Ymir leveragesthe aforementioned unsupervised methods to extract rich and usefulfeature representations from the raw multivariate time series data,then combines the features and labels with a supervised classifier todo anomaly detection. We evaluated Ymir on internal multivariatetime series datasets from large monitoring systems and achievedgood anomaly detection performance.