Graph Anomaly Detection in Time Series: A Survey

TL;DR

This survey introduces graph-based time-series anomaly detection (G-TSAD) as a framework to capture intra-variable and inter-variable dependencies by constructing static or dynamic graphs over multivariate time series, videos, and social networks. It provides a unified taxonomy of G-TSAD methods into AE-based, GAN-based, predictive-based, and self-supervised categories, detailing their mechanisms, strengths, and limitations, with representative methods and datasets. The work highlights the five graph anomaly types—nodes, edges, sub-graphs, graphs, and Sim relations—and discusses practical challenges, datasets, and evaluation practices, offering directions for theory, explainability, and robust, hybrid methods. Its significance lies in guiding researchers and practitioners toward graph-aware TSAD solutions that can localize anomalies in complex, evolving systems, from traffic networks to video surveillance. Overall, G-TSAD represents a growing, impactful approach for robust anomaly detection in high-dimensional, non-stationary, graph-structured time-series data.

Abstract

With the recent advances in technology, a wide range of systems continue to collect a large amount of data over time and thus generate time series. Time-Series Anomaly Detection (TSAD) is an important task in various time-series applications such as e-commerce, cybersecurity, vehicle maintenance, and healthcare monitoring. However, this task is very challenging as it requires considering both the intra-variable dependency (relationships within a variable over time) and the inter-variable dependency (relationships between multiple variables) existing in time-series data. Recent graph-based approaches have made impressive progress in tackling the challenges of this field. In this survey, we conduct a comprehensive and up-to-date review of TSAD using graphs, referred to as G-TSAD. First, we explore the significant potential of graph representation for time-series data and and its contributions to facilitating anomaly detection. Then, we review state-of-the-art graph anomaly detection techniques, mostly leveraging deep learning architectures, in the context of time series. For each method, we discuss its strengths, limitations, and the specific applications where it excels. Finally, we address both the technical and application challenges currently facing the field, and suggest potential future directions for advancing research and improving practical outcomes.

Figures (7)

• Figure 1: An example of anomaly detection in a multivariate time-series signal data to show the difference between TSAD (Block 1) and G-TSAD (Block 2). The inputs are three successive time intervals (S: Sensor). In the constructed graphs, the solid and dash lines, respectively, indicate the inter-variable and intra-variable dependencies, $m = 3$, and the edge features are not shown for simplicity. Normal and abnormal cases are respectively shown in black and red colors. G-TSAD has the potential to detect anomalous sensors, local-relations, regions, and time intervals.
• Figure 2: Examples of time-series data and the corresponding constructed graphs. Each example is shown with three consecutive observations. The top figures show the original data and the bottom figures show the constructed graphs. In the constructed graphs, the solid and dash lines, respectively, indicate the inter-variable and intra-variable dependencies, $m = 3$, and the edge features are not shown for simplicity. Normal and abnormal cases are respectively shown in black and red colors.
• Figure 3: Example of node-level, edge-level, sub-graph-level, graph-level, and $\text{Sim}\{\cdot,\cdot\}$-level anomalies in a graph set $\mathbb{G}$ with three successive observations. In each graph $\mathcal{G}, m = 4$ and $m' = 1$.
• Figure 4: Overall framework of AE-based methods. The input is a graph $\mathbb{G}$ with three successive observations. In each $\mathcal{G}, m=3$ and the edge features are not shown for simplicity.
• Figure 5: Overall framework of GAN-based methods. The input is a graph $\mathbb{G}$ with three successive observations. In each $\mathcal{G}, m=3$ and the edge features are not shown for simplicity.