A Survey of Anomaly Detection Methods Based on Clustering Analysis and Deep Learning

Abstract

As information systems continuously expand, such as networks, the Internet of Things, and cloud computing, security and economic losses, as a consequence of anomalous events, have become increasingly prominent, and anomaly detection has become a fundamental competence for ensuring system reliability and security. High-dimensional, strongly nonlinear, and strongly temporally dependent data restrict the performance of anomaly detection methods based on a single technical route. Within this background, this research provides a formal description of anomaly detection and a classification of anomaly types, and categorizes time-series methods into six paradigms: clustering, prediction, reconstruction, representation learning, statistical, and hybrid. The paper expatiates on the anomaly discrimination mechanisms, parameter sensitivity, and complexity constraints of partitioning-, density-, and hierarchy-based clustering detection methods, as well as reconstruction-based and prediction-based detection frameworks based on autoencoders, long short-term memory networks, convolutional networks, Transformers, and generative adversarial networks, and then presents the objective functions and anomaly scoring forms of each method. A classification framework for fusion methods is constructed on the basis of three strategies: serial, parallel, and embedded. The findings show that combining the structural priors of clustering with the representation learning capability of deep models yields performance superior to that of a single method, however, the benefits are accompanied by increased model complexity and interpretation costs. In the meantime, four unresolved issues are identified: a unified fusion theory, adaptability to small samples and training set contamination, lightweight edge-side inference, and the construction of interpretable criteria.