# Multi-Scale One-Class Recurrent Neural Networks for Discrete Event Sequence Anomaly Detection

arXiv: https://arxiv.org/abs/2008.13361 · HTML: https://mlsanity.com/paper/2008.13361/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 31 Aug 2020.

## Built on by (most cited first, 19 of 19)

- [Multimodal Motion Conditioned Diffusion Model for Skeleton-based Video Anomaly Detection](https://mlsanity.com/paper/2307.07205/) (2023)
- [Deep Learning for Anomaly Detection in Log Data: A Survey](https://mlsanity.com/paper/2207.03820/) (2022)
- [LogGPT: Log Anomaly Detection via GPT](https://mlsanity.com/paper/2309.14482/) (2023)
- [Holistic Representation Learning for Multitask Trajectory Anomaly Detection](https://mlsanity.com/paper/2311.01851/) (2023)
- [Contracting Skeletal Kinematics for Human-Related Video Anomaly Detection](https://mlsanity.com/paper/2301.09489/) (2023)
- [Are we certain it's anomalous?](https://mlsanity.com/paper/2211.09224/) (2022)
- [LAN: Learning Adaptive Neighbors for Real-Time Insider Threat Detection](https://mlsanity.com/paper/2403.09209/) (2024)
- [Abnormal Event Detection via Hypergraph Contrastive Learning](https://mlsanity.com/paper/2304.01226/) (2023)
- [Fine-grained Anomaly Detection in Sequential Data via Counterfactual Explanations](https://mlsanity.com/paper/2210.04145/) (2022)
- [Backdoor Attack against One-Class Sequential Anomaly Detection Models](https://mlsanity.com/paper/2402.10283/) (2024)
- [A Problem-Oriented Taxonomy of Evaluation Metrics for Time Series Anomaly Detection](https://mlsanity.com/paper/2511.18739/) (2025)
- [MINES: Explainable Anomaly Detection through Web API Invariant Inference](https://mlsanity.com/paper/2512.06906/) (2025)
- [CSCLog: A Component Subsequence Correlation-Aware Log Anomaly Detection Method](https://mlsanity.com/paper/2307.03359/) (2023)
- [Seamless Monitoring of Stress Levels Leveraging a Universal Model for Time Sequences](https://mlsanity.com/paper/2407.03821/) (2024)
- [Beyond Window-Based Detection: A Graph-Centric Framework for Discrete Log Anomaly Detection](https://mlsanity.com/paper/2501.12166/) (2025)
- [Distributed Detection of Adversarial Attacks in Multi-Agent Reinforcement Learning with Continuous Action Space](https://mlsanity.com/paper/2508.15764/) (2025)
- [LogPurge: Log Data Purification for Anomaly Detection via Rule-Enhanced Filtering](https://mlsanity.com/paper/2511.14062/) (2025)
- [A unified framework for detecting point and collective anomalies in operating system logs via collaborative transformers](https://mlsanity.com/paper/2512.23380/) (2025)
- [KRONE: Scalable LLM-Augmented Log Anomaly Detection via Hierarchical Abstraction](https://mlsanity.com/paper/2602.07303/) (2026)

## Abstract (arXiv)

Discrete event sequences are ubiquitous, such as an ordered event series of process interactions in Information and Communication Technology systems. Recent years have witnessed increasing efforts in detecting anomalies with discrete-event sequences. However, it still remains an extremely difficult task due to several intrinsic challenges including data imbalance issues, the discrete property of the events, and sequential nature of the data. To address these challenges, in this paper, we propose OC4Seq, a multi-scale one-class recurrent neural network for detecting anomalies in discrete event sequences. Specifically, OC4Seq integrates the anomaly detection objective with recurrent neural networks (RNNs) to embed the discrete event sequences into latent spaces, where anomalies can be easily detected. In addition, given that an anomalous sequence could be caused by either individual events, subsequences of events, or the whole sequence, we design a multi-scale RNN framework to capture different levels of sequential patterns simultaneously. Experimental results on three benchmark datasets show that OC4Seq consistently outperforms various representative baselines by a large margin. Moreover, through both quantitative and qualitative analysis, the importance of capturing multi-scale sequential patterns for event anomaly detection is verified.