Most of current anomaly detection models assume that the normal pattern remains same all the time. However, the normal patterns of Web services change dramatically and frequently. The model trained on old-distribution data is outdated after such changes. Retraining the whole model every time is expensive. Besides, at the beginning of normal pattern changes, there is not enough observation data from the new distribution. Retraining a large neural network model with limited data is vulnerable to overfitting. Thus, we propose a Light and Anti-overfitting Retraining Approach (LARA) for deep variational auto-encoder based time series anomaly detection methods (VAEs). This work aims to make three novel contributions: 1) the retraining process is formulated as a convex problem and can converge at a fast rate as well as prevent overfitting; 2) designing a ruminate block, which leverages the historical data without the need to store them; 3) mathematically proving that when fine-tuning the latent vector and reconstructed data, the linear formations can achieve the least adjusting errors between the ground truths and the fine-tuned ones. Moreover, we have performed many experiments to verify that retraining LARA with even 43 time slots of data from new distribution can result in its competitive F1 Score in comparison with the state-of-the-art anomaly detection models trained with sufficient data. Besides, we verify its light overhead.

翻译：当前大多数异常检测模型假设正常模式始终保持不变。然而，Web服务的正常模式会频繁发生剧烈变化。基于旧分布数据训练的模型在模式变化后会失效。每次对整个模型进行重新训练成本高昂。此外，在正常模式变化的初期，缺乏来自新分布的充足观测数据。用有限数据重新训练大型神经网络模型容易导致过拟合。为此，我们提出了一种基于深度变分自编码器的时间序列异常检测方法的轻量级抗过拟合再训练方法（LARA）。本研究旨在作出三项新颖贡献：1）将再训练过程转化为凸优化问题，既能快速收敛又能防止过拟合；2）设计了一种可利用历史数据而无需存储它们的反思模块；3）数学证明了当微调潜在向量与重构数据时，线性形式能在真实值与微调值之间实现最小调整误差。此外，我们通过大量实验验证了即使仅使用新分布中43个时隙的数据重新训练LARA，其F1分数也能与使用充足数据训练的最先进异常检测模型相媲美。同时，我们验证了其低开销特性。