[论文解读] Multivariate Time Series Anomaly Detection via Dynamic Graph Forecasting

Katrina Chen, Mingbin Feng+1 more|arXiv (Cornell University)|Feb 4, 2023

Anomaly Detection Techniques and Applications被引用 9

一句话总结

DyGraphAD 通过联合预测动态的跨序列图和未来值来检测多变量时间序列的异常，利用演化中的图结构提升检测精度。

ABSTRACT

Anomalies in univariate time series often refer to abnormal values and deviations from the temporal patterns from majority of historical observations. In multivariate time series, anomalies also refer to abnormal changes in the inter-series relationship, such as correlation, over time. Existing studies have been able to model such inter-series relationships through graph neural networks. However, most works settle on learning a static graph globally or within a context window to assist a time series forecasting task or a reconstruction task, whose objective is not tailored to explicitly detect the abnormal relationship. Some other works detect anomalies based on reconstructing or forecasting a list of inter-series graphs, which inadvertently weakens their power to capture temporal patterns within the data due to the discrete nature of graphs. In this study, we propose DyGraphAD, a multivariate time series anomaly detection framework based upon a list of dynamic inter-series graphs. The core idea is to detect anomalies based on the deviation of inter-series relationships and intra-series temporal patterns from normal to anomalous states, by leveraging the evolving nature of the graphs in order to assist a graph forecasting task and a time series forecasting task simultaneously. Our numerical experiments on real-world datasets demonstrate that DyGraphAD has superior performance than baseline anomaly detection approaches.

研究动机与目标

• 通过捕捉演化中的序列间关系，推动高维多变量时间序列的鲁棒异常检测。
• 提出一个动态图框架，联合预测序列间的图以及时间序列值。
• 证明结合图预测和时间序列预测能够提升异常检测性能。
• 在真实工业基准上评估，展示最先进的结果。

提出的方法

• 通过 DTW 基于相似性在时间窗口内构建动态相关图。
• 使用结合短期动态和静态长期图的图编码器对图进行编码。
• 利用以图历史为输入的 Transformer 编码的图预测模块来预测最新图。
• 通过整合图感知表示的 TS 预测模块来预测下一个时间点的序列值。
• 以联合训练的方式进行训练，损失包含下一步 TS 预测误差和图预测误差。
• 通过将图预测误差和时间序列预测误差结合，计算每个时间步的调和平均异常分数。

实验结果

研究问题

• RQ1 如何利用演化中的序列间关系来检测多变量时间序列中的异常？
• RQ2 动态图与时间序列的联合预测是否在性能上优于静态图或单任务基线？
• RQ3 短期图动态与长期关系对检测准确性的贡献各自是多少？
• RQ4 一个半监督框架（仅有正常训练数据）是否能够利用动态图表示有效识别异常？

主要发现

Model	SWaT F1	SWaT Pre	SWaT Rec	WADI F1	WADI Pre	WADI Rec	SMAP F1	SMAP Pre	SMAP Rec	MSL F1	MSL Pre	MSL Rec	SMD F1	SMD Pre	SMD Rec
DyGraphAD	92.31	94.29	90.42	85.38	84.13	86.66	94.94	93.39	96.55	95.92	97.01	94.86	96.55	95.14	98.19
DyGraphAD(Graph)	89.57	83.80	87.49	71.54	72.92	70.21	92.31	91.64	92.98	94.62	94.91	94.34	94.84	94.08	96.16
(Graph) recent graph only	87.31	69.49	85.10	84.34	74.16	97.76	89.89	88.67	91.17	88.57	83.34	94.49	??	??	??
(Graph) wo. recent graph	88.58	78.19	87.04	91.38	85.55	98.07	94.43	93.44	95.43	96.11	93.80	98.71	??	??	??
(Graph) wo. recent&static graph	86.90	71.82	86.59	89.89	88.67	91.17	88.57	83.34	94.49	??	??	??	??	??

• DyGraphAD 在多个真实数据集上相比基线具有更高的 F1 分数，表明异常检测有效。
• 图预测与时间序列预测的联合优化优于单一任务优化。
• 模型通过结合短期演化的图和静态长期图，获取瞬态与持久的跨序列关系。
• 图预测误差与时间序列预测误差的调和平均提供了鲁棒的异常分数。
• 消融研究证实图组件和 TS 组件均对性能有显著贡献。