[Paper Review] Multivariate Time-series Anomaly Detection via Graph Attention Network

Hang Zhao, Yujing Wang+8 more|arXiv (Cornell University)|Sep 4, 2020

Anomaly Detection Techniques and ApplicationsComputer Science25 references30 citations

TL;DR

MTAD-GAT introduces dual graph attention layers to explicitly model inter-feature and temporal dependencies in multivariate time-series, jointly optimizing forecasting and reconstruction objectives for anomaly detection.

ABSTRACT

Anomaly detection on multivariate time-series is of great importance in both data mining research and industrial applications. Recent approaches have achieved significant progress in this topic, but there is remaining limitations. One major limitation is that they do not capture the relationships between different time-series explicitly, resulting in inevitable false alarms. In this paper, we propose a novel self-supervised framework for multivariate time-series anomaly detection to address this issue. Our framework considers each univariate time-series as an individual feature and includes two graph attention layers in parallel to learn the complex dependencies of multivariate time-series in both temporal and feature dimensions. In addition, our approach jointly optimizes a forecasting-based model and are construction-based model, obtaining better time-series representations through a combination of single-timestamp prediction and reconstruction of the entire time-series. We demonstrate the efficacy of our model through extensive experiments. The proposed method outperforms other state-of-the-art models on three real-world datasets. Further analysis shows that our method has good interpretability and is useful for anomaly diagnosis.

Motivation & Objective

• Motivate the need to capture cross-feature correlations in multivariate time-series anomaly detection.
• Propose a self-supervised framework that models feature and temporal dependencies with two parallel graph attention layers.
• Enhance representations by jointly optimizing forecasting-based and reconstruction-based models.
• Provide interpretable attention-based insights for anomaly diagnosis and root-cause analysis.

Proposed method

• Represent each time-series feature as a node in a complete graph for a feature-oriented GAT layer.
• Represent each timestamp within a sliding window as a node in a complete graph for a time-oriented GAT layer.
• Combine GAT outputs with a 1-D convolution and a GRU to capture local and long-range temporal patterns.
• Jointly optimize a forecasting-based model (next-step prediction) and a reconstruction-based model (VAE) with Loss = Loss_for + Loss_rec.
• Compute an inference score per timestamp by combining prediction error and reconstruction probability, then detect anomalies via Peak Over Threshold (POT).
• Provide anomaly diagnosis by ranking feature-level scores to identify potential root causes.

Experimental results

Research questions

• RQ1 Can explicit modeling of inter-feature correlations via graph attention improve multivariate anomaly detection over baselines?
• RQ2 Does combining forecasting-based and reconstruction-based objectives yield better representations and detection performance?
• RQ3 How do the two GAT layers (feature-oriented and time-oriented) contribute to detection accuracy and interpretability?
• RQ4 Is the method effective across diverse real-world datasets and scenarios, including real-time delay considerations?
• RQ5 Can the model provide meaningful anomaly diagnoses by identifying root-cause features?

Key findings

• MTAD-GAT achieves state-of-the-art F1 scores across three datasets (SMAP, MSL, TSA) compared with baselines.
• The feature-oriented GAT layer and the time-oriented GAT layer each contribute to performance, with notable gains when either is removed.
• Joint optimization of forecasting and reconstruction models yields better anomaly detection than using either objective alone.
• MTAD-GAT improves F1 by up to 9% over the best baselines on TSA and shows robustness across delays and scenarios.
• The model provides interpretable attention patterns and effective anomaly diagnostics by ranking feature-wise scores.