[Paper Review] A Deep Neural Network for Unsupervised Anomaly Detection and Diagnosis in Multivariate Time Series Data

Chuxu Zhang, Dongjin Song+8 more|arXiv (Cornell University)|Nov 20, 2018

Anomaly Detection Techniques and Applications30 references97 citations

TL;DR

MSCRED introduces a Multi-Scale Convolutional Recurrent Encoder-Decoder to detect and diagnose anomalies in multivariate time series by reconstructing signature matrices and analyzing residuals, outperforming baselines on synthetic and power plant data.

ABSTRACT

Nowadays, multivariate time series data are increasingly collected in various real world systems, e.g., power plants, wearable devices, etc. Anomaly detection and diagnosis in multivariate time series refer to identifying abnormal status in certain time steps and pinpointing the root causes. Building such a system, however, is challenging since it not only requires to capture the temporal dependency in each time series, but also need encode the inter-correlations between different pairs of time series. In addition, the system should be robust to noise and provide operators with different levels of anomaly scores based upon the severity of different incidents. Despite the fact that a number of unsupervised anomaly detection algorithms have been developed, few of them can jointly address these challenges. In this paper, we propose a Multi-Scale Convolutional Recurrent Encoder-Decoder (MSCRED), to perform anomaly detection and diagnosis in multivariate time series data. Specifically, MSCRED first constructs multi-scale (resolution) signature matrices to characterize multiple levels of the system statuses in different time steps. Subsequently, given the signature matrices, a convolutional encoder is employed to encode the inter-sensor (time series) correlations and an attention based Convolutional Long-Short Term Memory (ConvLSTM) network is developed to capture the temporal patterns. Finally, based upon the feature maps which encode the inter-sensor correlations and temporal information, a convolutional decoder is used to reconstruct the input signature matrices and the residual signature matrices are further utilized to detect and diagnose anomalies. Extensive empirical studies based on a synthetic dataset and a real power plant dataset demonstrate that MSCRED can outperform state-of-the-art baseline methods.

Motivation & Objective

• Motivate robust anomaly detection in multivariate time series with temporal dependencies and inter-sensor correlations.
• Propose a framework to jointly detect anomalies, identify root causes, and interpret anomaly severity.
• Represent system status with multi-scale signature matrices to capture different levels of anomalies.
• Develop an encoder-decoder architecture to learn inter-sensor correlations and temporal patterns and use residuals for anomaly scoring.

Proposed method

• Construct multi-scale (resolution) system signature matrices from time series segments.
• Encode inter-sensor correlations with a fully convolutional encoder over concatenated signature matrices.
• Model temporal patterns with an attention-based ConvLSTM to selectively attend to relevant past states.
• Decode with a convolutional decoder to reconstruct signature matrices and obtain residuals.
• Train end-to-end using a square reconstruction loss and use residuals for anomaly detection and diagnosis.

Experimental results

Research questions

• RQ1 Can MSCRED outperform state-of-the-art unsupervised anomaly detection baselines on multivariate time series?
• RQ2 How do individual components (convolutional encoder, attention ConvLSTM, multi-scale signatures) contribute to detection performance?
• RQ3 Can MSCRED accurately identify root causes (which sensors drive anomalies) and interpret anomaly severity (duration)?
• RQ4 Is MSCRED robust to input noise compared to traditional temporal prediction or density-based methods?

Key findings

• MSCRED achieves higher anomaly detection performance than all baselines on both synthetic and power plant datasets, with improvements over the best baseline ranging from 13.3% to 30.0% in F1 scores.
• Increasing the number of ConvLSTM layers improves performance, and the attention-based ConvLSTM outperforms non-attention variants.
• MSCRED provides superior root-cause identification (higher recall@k) than LSTM-ED by substantial margins (29–32 percentage points in reported cases).
• The model demonstrates robust anomaly detection across different anomaly durations via three signature-matrix channels corresponding to small/medium/large scales.
• MSCRED shows robustness to input noise, outperforming ARMA and LSTM-ED as noise scales vary from 0.2 to 0.45.