# Collective Anomaly Detection based on Long Short Term Memory Recurrent Neural Network

arXiv: https://arxiv.org/abs/1703.09752 · HTML: https://mlsanity.com/paper/1703.09752/

## Key facts

- Cited by 28 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Mar 2017.

## Built on by (most cited first, 28 of 28)

- [Deep Learning for Time Series Anomaly Detection: A Survey](https://mlsanity.com/paper/2211.05244/) (2022)
- [DCdetector: Dual Attention Contrastive Representation Learning for Time Series Anomaly Detection](https://mlsanity.com/paper/2306.10347/) (2023)
- [A Survey on Anomaly Detection for Technical Systems using LSTM Networks](https://mlsanity.com/paper/2105.13810/) (2021)
- [Applications of Recurrent Neural Network for Biometric Authentication & Anomaly Detection](https://mlsanity.com/paper/2109.05701/) (2021)
- [TiSAT: Time Series Anomaly Transformer](https://mlsanity.com/paper/2203.05167/) (2022)
- [Series2Graph: Graph-based Subsequence Anomaly Detection for Time Series](https://mlsanity.com/paper/2207.12208/) (2022)
- [Set Features for Fine-grained Anomaly Detection](https://mlsanity.com/paper/2302.12245/) (2023)
- [PatchAD: A Lightweight Patch-based MLP-Mixer for Time Series Anomaly Detection](https://mlsanity.com/paper/2401.09793/) (2024)
- [How Far Should We Look Back to Achieve Effective Real-Time Time-Series Anomaly Detection?](https://mlsanity.com/paper/2102.06560/) (2021)
- [RePAD2: Real-Time, Lightweight, and Adaptive Anomaly Detection for Open-Ended Time Series](https://mlsanity.com/paper/2303.00409/) (2023)
- [Rethinking Spatio-Temporal Anomaly Detection: A Vision for Causality-Driven Cybersecurity](https://mlsanity.com/paper/2507.08177/) (2025)
- [LEAD1.0: A Large-scale Annotated Dataset for Energy Anomaly Detection in Commercial Buildings](https://mlsanity.com/paper/2203.17256/) (2022)
- [Set Features for Anomaly Detection](https://mlsanity.com/paper/2311.14773/) (2023)
- [DeepFIB: Self-Imputation for Time Series Anomaly Detection](https://mlsanity.com/paper/2112.06247/) (2021)
- [A Bi-LSTM Autoencoder Framework for Anomaly Detection -- A Case Study of a Wind Power Dataset](https://mlsanity.com/paper/2303.09703/) (2023)
- [CSCAD: Correlation Structure-based Collective Anomaly Detection in Complex System](https://mlsanity.com/paper/2105.14476/) (2021)
- [Time Series Anomaly Detection by Cumulative Radon Features](https://mlsanity.com/paper/2202.04067/) (2022)
- [RadArnomaly: Protecting Radar Systems from Data Manipulation Attacks](https://mlsanity.com/paper/2106.07074/) (2021)
- [LPC-AD: Fast and Accurate Multivariate Time Series Anomaly Detection via Latent Predictive Coding](https://mlsanity.com/paper/2205.08362/) (2022)
- [Interactive System-wise Anomaly Detection](https://mlsanity.com/paper/2304.10704/) (2023)
- [On the Relationship Between RNN Hidden State Vectors and Semantic Ground Truth](https://mlsanity.com/paper/2306.16854/) (2023)
- [Detecting Anomalous Network Communication Patterns Using Graph Convolutional Networks](https://mlsanity.com/paper/2311.18525/) (2023)
- [HCL-MTSAD: Hierarchical Contrastive Consistency Learning for Accurate Detection of Industrial Multivariate Time Series Anomalies](https://mlsanity.com/paper/2404.08224/) (2024)
- [Ensemble Method for System Failure Detection Using Large-Scale Telemetry Data](https://mlsanity.com/paper/2407.00048/) (2024)
- [AI Learning Algorithms: Deep Learning, Hybrid Models, and Large-Scale Model Integration](https://mlsanity.com/paper/2410.09186/) (2024)
- [Robotic Classification of Divers' Swimming States using Visual Pose Keypoints as IMUs](https://mlsanity.com/paper/2510.17863/) (2025)
- [Lightweight Multi-Scale Anomaly Detection for Resource-Constrained Edge Devices](https://mlsanity.com/paper/2607.12599/) (2026)
- [Clustering-Based Collective Anomaly Detection in IoT Systems: A Graph Neural Network Approach](https://mlsanity.com/paper/2609.22166/) (2026)

## Abstract (arXiv)

Intrusion detection for computer network systems becomes one of the most critical tasks for network administrators today. It has an important role for organizations, governments and our society due to its valuable resources on computer networks. Traditional misuse detection strategies are unable to detect new and unknown intrusion. Besides, anomaly detection in network security is aim to distinguish between illegal or malicious events and normal behavior of network systems. Anomaly detection can be considered as a classification problem where it builds models of normal network behavior, which it uses to detect new patterns that significantly deviate from the model. Most of the cur- rent research on anomaly detection is based on the learning of normally and anomaly behaviors. They do not take into account the previous, re- cent events to detect the new incoming one. In this paper, we propose a real time collective anomaly detection model based on neural network learning and feature operating. Normally a Long Short Term Memory Recurrent Neural Network (LSTM RNN) is trained only on normal data and it is capable of predicting several time steps ahead of an input. In our approach, a LSTM RNN is trained with normal time series data before performing a live prediction for each time step. Instead of considering each time step separately, the observation of prediction errors from a certain number of time steps is now proposed as a new idea for detecting collective anomalies. The prediction errors from a number of the latest time steps above a threshold will indicate a collective anomaly. The model is built on a time series version of the KDD 1999 dataset. The experiments demonstrate that it is possible to offer reliable and efficient for collective anomaly detection.