Deep Unrolling for Anomaly Detection in Network Flows

Anomaly detection becomes increasingly important in the design of future resilient communication systems. In this work, anomaly detection in network flows with incomplete measurements on the basis of robust PCA, where normal flows are characterized as low-rank components and anomalies as sparse components, is considered. Based on the block-successive convex approximation framework, we first introduce a novel modelbased algorithm for normal and anomalous traffic recovery. Since robust-PCA-based anomaly detection alone is suboptimal in terms of the receiver operating characteristic, we apply deep unrolling to this algorithm and use a homotopy optimization method to train the resulting deep network architecture to explicitly optimize the area under the curve of the receiver operating characteristic. Thereby, the domain knowledge introduced by robust PCA is retained. Our deep unrolling-based network architecture outperforms the classical methods while generalizing well and featuring excellent data efficiency.