π€ AI Summary
Existing similarity measures for event-triggered traffic time series struggle to simultaneously capture complex temporal dynamics and meet the stringent requirements of safety-critical tasksβsuch as anomaly detection and clustering. To address this, we propose the first unsupervised similarity learning framework tailored to this setting: a coupled hierarchical multi-resolution sequence autoencoder jointly optimized with a Gaussian Mixture Model (GMM). This architecture jointly learns task-adapted, interpretable similarity representations and probabilistic cluster assignments in a compact latent space. Crucially, it preserves structural relationships without supervision and enables similarity visualization. Evaluated on multiple real-world traffic datasets, our framework achieves significant improvements over state-of-the-art methods in anomaly detection (F1-score), clustering (Adjusted Rand Index), and inference efficiency.
π Abstract
Time series analysis has achieved great success in cyber security such as intrusion detection and device identification. Learning similarities among multiple time series is a crucial problem since it serves as the foundation for downstream analysis. Due to the complex temporal dynamics of the event-triggered time series, it often remains unclear which similarity metric is appropriate for security-related tasks, such as anomaly detection and clustering. The overarching goal of this paper is to develop an unsupervised learning framework that is capable of learning similarities among a set of event-triggered time series. From the machine learning vantage point, the proposed framework harnesses the power of both hierarchical multi-resolution sequential autoencoders and the Gaussian Mixture Model (GMM) to effectively learn the low-dimensional representations from the time series. Finally, the obtained similarity measure can be easily visualized for the explanation. The proposed framework aspires to offer a stepping stone that gives rise to a systematic approach to model and learn similarities among a multitude of event-triggered time series. Through extensive qualitative and quantitative experiments, it is revealed that the proposed method outperforms state-of-the-art methods considerably.