Little Help Makes a Big Difference: Leveraging Active Learning to
  Improve Unsupervised Time Series Anomaly Detection
  Key Performance Indicators (KPI), which are essentially time series data,
have been widely used to indicate the performance of telecom networks. Based on
the given KPIs, a large set of anomaly detection algorithms have been deployed
for detecting the unexpected network incidents. Generally, unsupervised anomaly
detection algorithms gain more popularity than the supervised ones, due to the
fact that labeling KPIs is extremely time- and resource-consuming, and
error-prone. However, those unsupervised anomaly detection algorithms often
suffer from excessive false alarms, especially in the presence of concept
drifts resulting from network re-configurations or maintenance. To tackle this
challenge and improve the overall performance of unsupervised anomaly detection
algorithms, we propose to use active learning to introduce and benefit from the
feedback of operators, who can verify the alarms (both false and true ones) and
label the corresponding KPIs with reasonable effort. Specifically, we develop
three query strategies to select the most informative and representative
samples to label. We also develop an efficient method to update the weights of
Isolation Forest and optimally adjust the decision threshold, so as to
eventually improve the performance of detection model. The experiments with one
public dataset and one proprietary dataset demonstrate that our active learning
empowered anomaly detection pipeline could achieve performance gain, in terms
of F1-score, more than 50% over the baseline algorithm. It also outperforms the
existing active learning based methods by approximately 6%-10%, with
significantly reduced budget (the ratio of samples to be labeled).
