# Adaptive Anomaly Detection in Network Flows with Low-Rank Tensor Decompositions and Deep Unrolling

arXiv: https://arxiv.org/abs/2409.11529 · HTML: https://mlsanity.com/paper/2409.11529/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 29 of its 76 references that are in the map.
- First posted on arXiv 17 Sep 2024.

## Builds on (most cited first, 29 of 29)

- [PyTorch: An Imperative Style, High-Performance Deep Learning Library](https://mlsanity.com/paper/1912.01703/) (2019)
- [Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI](https://mlsanity.com/paper/1910.10045/) (2019)
- [Relational inductive biases, deep learning, and graph networks](https://mlsanity.com/paper/1806.01261/) (2018)
- [Algorithm Unrolling: Interpretable, Efficient Deep Learning for Signal and Image Processing](https://mlsanity.com/paper/1912.10557/) (2019)
- [Deep Learning for Anomaly Detection: A Survey](https://mlsanity.com/paper/1901.03407/) (2019)
- [Tensor Decomposition for Signal Processing and Machine Learning](https://mlsanity.com/paper/1607.01668/) (2016)
- [Soft-to-Hard Vector Quantization for End-to-End Learning Compressible Representations](https://mlsanity.com/paper/1704.00648/) (2017)
- [Model-Based Deep Learning: On the Intersection of Deep Learning and Optimization](https://mlsanity.com/paper/2205.02640/) (2022)
- [Deep Unfolded Robust PCA with Application to Clutter Suppression in Ultrasound](https://mlsanity.com/paper/1811.08252/) (2018)
- [Low-Rank Autoregressive Tensor Completion for Spatiotemporal Traffic Data Imputation](https://mlsanity.com/paper/2104.14936/) (2021)
- [Learned Robust PCA: A Scalable Deep Unfolding Approach for High-Dimensional Outlier Detection](https://mlsanity.com/paper/2110.05649/) (2021)
- [Artificial Intelligence-Enabled Cellular Networks: A Critical Path to Beyond-5G and 6G](https://mlsanity.com/paper/1907.07862/) (2019)
- [Bayesian Robust Tensor Factorization for Incomplete Multiway Data](https://mlsanity.com/paper/1410.2386/) (2014)
- [Robust PCA for Anomaly Detection in Cyber Networks](https://mlsanity.com/paper/1801.01571/) (2018)
- [Inexact Block Coordinate Descent Algorithms for Nonsmooth Nonconvex Optimization](https://mlsanity.com/paper/1905.04211/) (2019)
- [Rank regularization and Bayesian inference for tensor completion and extrapolation](https://mlsanity.com/paper/1301.7619/) (2013)
- [Coordinated Sum-Rate Maximization in Multicell MU-MIMO with Deep Unrolling](https://mlsanity.com/paper/2202.10371/) (2022)
- [Deep Unfolded Tensor Robust PCA with Self-supervised Learning](https://mlsanity.com/paper/2212.11346/) (2022)
- [Estimating Traffic and Anomaly Maps via Network Tomography](https://mlsanity.com/paper/1407.1660/) (2014)
- [A Deep-Unfolded Reference-Based RPCA Network For Video Foreground-Background Separation](https://mlsanity.com/paper/2010.00929/) (2020)
- [Deep Graph Unfolding for Beamforming in MU-MIMO Interference Networks](https://mlsanity.com/paper/2304.00446/) (2023)
- [Byzantine Attack and Defense in Cognitive Radio Networks: A Survey](https://mlsanity.com/paper/1504.01185/) (2015)
- [Hankel-structured Tensor Robust PCA for Multivariate Traffic Time Series Anomaly Detection](https://mlsanity.com/paper/2110.04352/) (2021)
- [Anomaly Detection in Road Networks Using Sliding-Window Tensor Factorization](https://mlsanity.com/paper/1803.04534/) (2018)
- [Network Anomaly Detection based on Tensor Decomposition](https://mlsanity.com/paper/2004.09655/) (2020)
- [DOLPHIn - Dictionary Learning for Phase Retrieval](https://mlsanity.com/paper/1602.02263/) (2016)
- [Identification of Successive "Unobservable" Cyber Data Attacks in Power Systems Through Matrix Decomposition](https://mlsanity.com/paper/1607.04776/) (2016)
- [Deep Unfolding of Iteratively Reweighted ADMM for Wireless RF Sensing](https://mlsanity.com/paper/2106.03686/) (2021)
- [Extended Successive Convex Approximation for Phase Retrieval with Dictionary Learning](https://mlsanity.com/paper/2109.05646/) (2021)

## Abstract (arXiv)

Anomaly detection (AD) is increasingly recognized as a key component for ensuring the resilience of future communication systems. While deep learning has shown state-of-the-art AD performance, its application in critical systems is hindered by concerns regarding training data efficiency, domain adaptation and interpretability. This work considers AD in network flows using incomplete measurements, leveraging a robust tensor decomposition approach and deep unrolling techniques to address these challenges. We first propose a novel block-successive convex approximation algorithm based on a regularized model-fitting objective where the normal flows are modeled as low-rank tensors and anomalies as sparse. An augmentation of the objective is introduced to decrease the computational cost. We apply deep unrolling to derive a novel deep network architecture based on our proposed algorithm, treating the regularization parameters as learnable weights. Inspired by Bayesian approaches, we extend the model architecture to perform online adaptation to per-flow and per-time-step statistics, improving AD performance while maintaining a low parameter count and preserving the problem's permutation equivariances. To optimize the deep network weights for detection performance, we employ a homotopy optimization approach based on an efficient approximation of the area under the receiver operating characteristic curve. Extensive experiments on synthetic and real-world data demonstrate that our proposed deep network architecture exhibits a high training data efficiency, outperforms reference methods, and adapts seamlessly to varying network topologies.