deepantAD
Create anomaly detector model that uses CNN network to detect anomalies
Since R2025a
Description
Add-On Required: This feature requires the Time Series Anomaly Detection for MATLAB add-on.
detector = deepantAD(numChannels)DeepantDetector model with numChannels channels for each
time series input to the detector.
This object requires Deep Learning Toolbox™.
detector = deepantAD(
sets additional options using one or more name-value arguments.numChannels,Name=Value)
For example, detector = deepantAD(3,DetectionWindowLength=20)
creates a detector model for data containing three input channels and with a detection
window length of 20.
Examples
Load the file sineWaveAnomalyData.mat, which contains two sets of synthetic three-channel sinusoidal signals.
sineWaveNormal contains 10 sinusoids of stable frequency and amplitude. Each signal has a series of small-amplitude impact-like imperfections. The signals have different lengths and initial phases.
load sineWaveAnomalyData.mat sineWaveNormal sineWaveAbnormal s1 = 3;
Plot input signals
Plot the first three normal signals. Each signal contains three input channels.
tiledlayout("vertical") ax = zeros(s1,1); for kj = 1:s1 ax(kj) = nexttile; plot(sineWaveNormal{kj}) title("Normal Signal Channels") end
sineWaveAbnormal contains three signals, all of the same length. Each signal in the set has one or more anomalies.
All channels of the first signal have an abrupt change in frequency that lasts for a finite time.
The second signal has a finite-duration amplitude change in one of its channels.
The third signal has spikes at random times in all channels.
Plot the three signals with anomalies.
tiledlayout("vertical") ax = zeros(s1,1); for kj = 1:s1 ax(kj) = nexttile; plot(sineWaveAbnormal{kj}) title("Anomalous Signal") end
Create Detector
Use the deepantAD function to create a DeepantDetector model with default options.
detector_deepant = deepantAD(3)
detector_deepant =
DeepantDetector with properties:
ObservationWindowLength: 10
DetectionWindowLength: 5
FilterSize: [2 3]
DropoutProbability: 0.2500
NumFilters: [32 32]
TrainingStride: 1
IsTrained: 0
NumChannels: 3
Layers: [13×1 nnet.cnn.layer.Layer]
Dlnet: [1×1 dlnetwork]
Threshold: []
ThresholdMethod: "kSigma"
ThresholdParameter: 3
ThresholdFunction: []
Normalization: "zscore"
DetectionStride: 5
Train Detector
Prepare to train detector_deepant by customizing a trainingOptions option set with a solver of "adam" and a limit of 100 for the number of training epochs. Set verboseFrequency to 100 to reduce the training progress output once every 10 epochs, or 1000 iterations.
trainopts = trainingOptions("adam",MaxEpochs=100,VerboseFrequency=1000);Train detector_deepant using the normal data and trainopts.
detector_deepant = train(detector_deepant,sineWaveNormal,trainingOpts=trainopts);
Iteration Epoch TimeElapsed LearnRate TrainingLoss
_________ _____ ___________ _________ ____________
1 1 00:00:04 0.001 1.5112
1000 11 00:00:19 0.001 0.026706
2000 21 00:00:32 0.001 0.022852
3000 31 00:00:44 0.001 0.023459
4000 41 00:00:55 0.001 0.019243
5000 52 00:01:06 0.001 0.018022
6000 62 00:01:17 0.001 0.019228
7000 72 00:01:28 0.001 0.018697
8000 82 00:01:39 0.001 0.019877
9000 92 00:01:52 0.001 0.020489
9800 100 00:02:01 0.001 0.019887
Training stopped: Max epochs completed
Computing threshold...
Threshold computation completed.
View the threshold that train computes and saves within detector_deepant. This computed value is influenced by random factors, such as which subsets of the data are used for training, and can change somewhat for different training sessions and different machines.
thresh = detector_deepant.Threshold
thresh = 0.5414
Plot the histogram of the anomaly scores for the normal data. Each score is calculated over a single detection window. The threshold, plotted as a vertical line, does not always completely bound the scores.
plotHistogram(detector_deepant,sineWaveNormal)
Use Detector to Identify Anomalies
Use the detect function to determine the anomaly scores for the anomalous data.
results = detect(detector_deepant,sineWaveAbnormal)
results=3×1 cell array
259×3 table
259×3 table
259×3 table
results is a cell array that contains three tables, one table for each channel. Each cell table contains three variables: WindowLabel, WindowAnomalyScore, and WindowStartIndices. Confirm the table variable names.
varnames = results{1}.Properties.VariableNamesvarnames = 1×3 cell array
"'Labels'" "'AnomalyScores'" "'StartIndices'"
Plot Results
Plot a histogram that shows the normal data, the anomalous data, and the threshold in one plot.
plotHistogram(detector_deepant,sineWaveNormal,sineWaveAbnormal)
The histogram uses different colors for the normal and anomalous data.
Plot the detected anomalies of the third abnormal signal set.
plot(detector_deepant,sineWaveAbnormal{3})
The top plot shows an overlay of red where the anomalies occur. The bottom plot shows how effective the threshold is at dividing the normal from the abnormal scores for Signal set 3.
Input Arguments
Name-Value Arguments
Output Arguments
References
[1] Munir, Mohsin, et al. “DeepAnT: A Deep Learning Approach for Unsupervised Anomaly Detection in Time Series.” IEEE Access, vol. 7, 2019, pp. 1991–2005. DOI.org (Crossref), https://doi.org/10.1109/ACCESS.2018.2886457.
