Anomaly detection in broadband networks: Using normalizing flows for multivariate time series

Abstract

Hybrid Fiber-Coaxial (HFC) networks are a popular infrastructure for delivering internet to consumers, however, they are complex and susceptible to various errors. Internet service providers currently rely on manual operations for network monitoring, underscoring the need for automated fault detection. We propose a novel framework for estimating the density of multivariate time series, tailored for anomaly detection in broadband networks. Our framework comprises two phases. In the first phase, we employ an autoencoder based on one-dimensional convolutions to learn a latent representation of time series windows, thereby preserving context. In the second phase, we utilize a Normalizing Flow (NF) to model the distribution within this latent space, enabling subsequent anomaly detection. For efficient separation, we propose an iterative weighing algorithm allowing the NF to model only the systematic behavior, thereby separating outlying behavior. We validated our methodology using a publically available synthetic dataset and real-world data from TDC NET, Denmark’s leading provider of digital infrastructure. Initial experiments with the synthetic dataset demonstrated that our density-based estimator effectively distinguishes anomalies from normal behavior. When applied to the unlabeled TDC NET dataset, our framework exhibits promising performance, identifying outliers clustering themselves away from the high-density region, thus enabling subsequent root cause analysis.