[论文解读] A Deep Neural Network for Unsupervised Anomaly Detection and Diagnosis in Multivariate Time Series Data

Chuxu Zhang, Dongjin Song+8 more|arXiv (Cornell University)|Nov 20, 2018

Anomaly Detection Techniques and Applications参考文献 30被引用 97

一句话总结

MSCRED 引入多尺度卷积递归编码器-解码器，通过重构签名矩阵并分析残差来检测和诊断多变量时间序列中的异常，在合成数据和电厂数据上优于基线。

ABSTRACT

Nowadays, multivariate time series data are increasingly collected in various real world systems, e.g., power plants, wearable devices, etc. Anomaly detection and diagnosis in multivariate time series refer to identifying abnormal status in certain time steps and pinpointing the root causes. Building such a system, however, is challenging since it not only requires to capture the temporal dependency in each time series, but also need encode the inter-correlations between different pairs of time series. In addition, the system should be robust to noise and provide operators with different levels of anomaly scores based upon the severity of different incidents. Despite the fact that a number of unsupervised anomaly detection algorithms have been developed, few of them can jointly address these challenges. In this paper, we propose a Multi-Scale Convolutional Recurrent Encoder-Decoder (MSCRED), to perform anomaly detection and diagnosis in multivariate time series data. Specifically, MSCRED first constructs multi-scale (resolution) signature matrices to characterize multiple levels of the system statuses in different time steps. Subsequently, given the signature matrices, a convolutional encoder is employed to encode the inter-sensor (time series) correlations and an attention based Convolutional Long-Short Term Memory (ConvLSTM) network is developed to capture the temporal patterns. Finally, based upon the feature maps which encode the inter-sensor correlations and temporal information, a convolutional decoder is used to reconstruct the input signature matrices and the residual signature matrices are further utilized to detect and diagnose anomalies. Extensive empirical studies based on a synthetic dataset and a real power plant dataset demonstrate that MSCRED can outperform state-of-the-art baseline methods.

研究动机与目标

• 在具有时间依赖性和传感器间相关性的多变量时间序列中，推动鲁棒异常检测。
• 提出一个框架，联合检测异常、识别根本原因并解释异常严重性。
• 用多尺度签名矩阵表示系统状态，以捕捉不同级别的异常。
• 开发一个编码器-解码器架构来学习传感器间相关性和时间模式，并使用残差进行异常评分。

提出的方法

• 从时间序列片段构建多尺度（分辨率）系统签名矩阵。
• 对拼接好的签名矩阵使用全卷积编码器编码传感器间相关性。
• 用基于注意力的 ConvLSTM 建模时间模式，选择性地关注相关的过去状态。
• 用卷积解码器解码以重构签名矩阵并获得残差。
• 端到端训练，使用平方重构损失，并使用残差进行异常检测与诊断。

实验结果

研究问题

• RQ1 MSCRED 能否在多变量时间序列上优于最先进的无监督异常检测基线？
• RQ2 单个组件（卷积编码器、注意力 ConvLSTM、多尺度签名）如何提升检测性能？
• RQ3 MSCRED 是否能够准确识别根本原因（哪些传感器驱动异常）并解释异常严重性（持续时间）？
• RQ4 与传统时间序列预测或基于密度的方法相比，MSCRED 对输入噪声是否鲁棒？

主要发现

• MSCRED 在合成数据和电厂数据上均显示出比所有基线更高的异常检测性能，最佳基线的 F1 分数提升范围为 13.3% 到 30.0%。
• 增加 ConvLSTM 层数可以提升性能，且基于注意力的 ConvLSTM 优于无注意力的变体。
• MSCRED 提供了优于 LSTM-ED 的根本原因识别能力（在 recall@k 上显著领先，报告中的情况为 29–32 个百分点）。
• 该模型在通过对应小/中/大尺度的三条签名矩阵通道实现对不同异常持续时间的鲁棒异常检测。
• MSCRED 对输入噪声表现出鲁棒性，随着噪声尺度从 0.2 到 0.45 变化，优于 ARMA 和 LSTM-ED。