Most of current anomaly detection models assume that the normal pattern remains same all the time. However, the normal patterns of Web services change dramatically and frequently. The model trained on old-distribution data is outdated after such changes. Retraining the whole model every time is expensive. Besides, at the beginning of normal pattern changes, there is not enough observation data from the new distribution. Retraining a large neural network model with limited data is vulnerable to overfitting. Thus, we propose a Light and Anti-overfitting Retraining Approach (LARA) for deep variational auto-encoder based time series anomaly detection methods (VAEs). This work aims to make three novel contributions: 1) the retraining process is formulated as a convex problem and can converge at a fast rate as well as prevent overfitting; 2) designing a ruminate block, which leverages the historical data without the need to store them; 3) mathematically proving that when fine-tuning the latent vector and reconstructed data, the linear formations can achieve the least adjusting errors between the ground truths and the fine-tuned ones. Moreover, we have performed many experiments to verify that retraining LARA with even 43 time slots of data from new distribution can result in its competitive F1 Score in comparison with the state-of-the-art anomaly detection models trained with sufficient data. Besides, we verify its light overhead.

翻译：当前大多数异常检测模型假设正常模式恒定不变。然而，Web服务的正常模式会频繁发生剧烈变化。基于旧分布数据训练的模型在此类变化后便会过时。每次对整个模型进行重训练代价高昂。此外，在正常模式变化初期，缺乏来自新分布的足够观测数据。用有限数据重训练大型神经网络模型容易出现过拟合。为此，我们提出一种面向基于深度变分自编码器的时间序列异常检测方法（VAEs）的轻量化防过拟合重训练方法（LARA）。本研究旨在实现三项创新贡献：1）将重训练过程建模为凸优化问题，既能快速收敛又可防止过拟合；2）设计记忆模块，可在无需存储历史数据的条件下利用历史数据；3）数学证明，在微调潜在向量与重构数据时，线性形式可在真实值与微调值之间实现最小调整误差。此外，我们通过大量实验验证，即使仅使用来自新分布的43个时间槽数据对LARA进行重训练，其F1分数仍可与使用充足数据训练的最先进异常检测模型相媲美。同时，我们验证了其轻量级开销特性。