Label-Free Multivariate Time Series Anomaly Detection

TL;DR

MTGFlow is proposed, an unsupervised anomaly detection approach for Multivariate Time series anomaly detection via dynamic Graph and entity-aware normalizing Flow and a cluster strategy that capitalizes on the commonalities of entities with similar characteristics, resulting in more precise and detailed density estimation.

Abstract

Anomaly detection in multivariate time series (MTS) has been widely studied in one-class classification (OCC) setting. The training samples in OCC are assumed to be normal, which is difficult to guarantee in practical situations. Such a case may degrade the performance of OCC-based anomaly detection methods which fit the training distribution as the normal distribution. In this paper, we propose MTGFlow, an unsupervised anomaly detection approach for MTS anomaly detection via dynamic Graph and entity-aware normalizing Flow. MTGFlow first estimates the density of the entire training samples and then identifies anomalous instances based on the density of the test samples within the fitted distribution. This relies on a widely accepted assumption that anomalous instances exhibit more sparse densities than normal ones, with no reliance on the clean training dataset. However, it is intractable to directly estimate the density due to complex dependencies among entities and their diverse inherent characteristics. To mitigate this, we utilize the graph structure learning model to learn interdependent and evolving relations among entities, which effectively captures complex and accurate distribution patterns of MTS. In addition, our approach incorporates the unique characteristics of individual entities by employing an entity-aware normalizing flow. This enables us to represent each entity as a parameterized normal distribution. Furthermore, considering that some entities present similar characteristics, we propose a cluster strategy that capitalizes on the commonalities of entities with similar characteristics, resulting in more precise and detailed density estimation. We refer to this cluster-aware extension as MTGFlow_cluster. Extensive experiments are conducted on six widely used benchmark datasets, in which MTGFlow and MTGFlow cluster demonstrate their superior detection performance.

Figures (13)

• Figure 1: Schematic diagram of OCC-based and density-based methods on a dataset with mixed normal and abnormal data. Left: OCC-based methods are vulnerable to noisy labels, leading to inaccurate decision boundaries. Right: Unlike OCC-based methods, density-based methods estimate the density of the test samples, where anomalies are located in low-density regions. Note that the deeper the color, the higher the density.
• Figure 2: Overview of the proposed MTGFlow and MTGFlow_cluster. Within a sliding window of size $T$, time series $x^{c}$ is fed to the RNN module to capture the temporal correlations. Hidden states of RNN are regarded as time encoding, $H^{c}$. Meanwhile, $x^{c}$ is also input to the graph structure learning module to capture dynamic interdependencies among entities, which are modeled as adjacency matrix $A^{c}$. The spatio-temporal conditions $C^{c}$ are derived via the graph convolution operation for $H^{c}$ and $A^{c}$. Finally, $C^{c}$ is used to help entity/cluster-aware normalizing flow model to produce entity/cluster-specific density estimation for the distribution of time series.
• Figure 3: Comparison with advanced methods on ROC curves for four datasets.
• Figure 4: Log likelihoods for anomalies on MTGFlow and MTGFlow_cluster.
• Figure 5: Discrimination comparison on SWaT between GANF, MTGFlow, and MTGFlow_cluster.