An Approach to Explainable Anomaly Detection in Data Streams From Technological Systems

The purpose of the study: development of an approach to identify anomalies in process data based on explainable machine learning in order to further select countermeasures taking into account possible sources of anomalies. Research methods: statistical analysis, machine learning methods, methods of generating explanations for machine learning model predictions. Results obtained: an approach to explainable anomaly detection in the flow of data from technological processes is proposed, its main stages are presented, which is based on the transformation of the input data vector into a matrix, and the detection of anomalies using a convolutional neural network; the method of transformation of the data vector into a matrix is developed and the influence of the data transformation algorithm on the efficiency of solving the problem of anomaly detection is evaluated; the method of testing the accuracy of the generated explanations is developed and the experimental evaluation is carried out. Scientific novelty: the proposed approach to the identification of anomalies in process data differs from the existing ones by using the technique of transforming the input data vector into a matrix, which allows us to apply a convolutional neural network as an analytical model of anomaly detection and methods of generating explanations developed specifically for neural networks of this architecture. Contributions: Evgenia Novikova – development of a method for converting the input data flow; Marat Bukhtiyarov – experimental study of the proposed approach; Igor Kotenko – development of a general approach to explainable detection of anomalies of the concept of dynamic assessment of the security of information systems in conditions of uncertainty of the initial data; Igor Kotenko, Igor Saenko and Elena Fedorchenko – analysis of the state of arts in identifying anomalies in technological processes and forming explanations for forecasts of machine learning models.