Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Edge Conditional Node Update Graph Neural Network for Multi-variate Time Series Anomaly Detection

Hayoung Jo, Seong-Whan Lee

TL;DR

The paper tackles multivariate time-series anomaly detection in cyber-physical systems with unknown sensor relationships. It introduces ECNU-GNN, a graph neural network that updates target node representations via edge-conditioned transformations guided by node embedding vectors, avoiding graph-attention constraints. The model learns the graph structure from node embeddings, predicts next-step sensor values, and detects anomalies using Graph Deviation Scoring, achieving notable $F_1$ scores on SWaT, WADI, and PSM datasets. Limitations include fixed node embeddings and a fixed neighborhood size; future work will explore dynamic graph structures learned by a graph inference network.

Abstract

With the rapid advancement in cyber-physical systems, the increasing number of sensors has significantly complicated manual monitoring of system states. Consequently, graph-based time-series anomaly detection methods have gained attention due to their ability to explicitly represent relationships between sensors. However, these methods often apply a uniform source node representation across all connected target nodes, even when updating different target node representations. Moreover, the graph attention mechanism, commonly used to infer unknown graph structures, could constrain the diversity of source node representations. In this paper, we introduce the Edge Conditional Node-update Graph Neural Network (ECNU-GNN). Our model, equipped with an edge conditional node update module, dynamically transforms source node representations based on connected edges to represent target nodes aptly. We validate performance on three real-world datasets: SWaT, WADI, and PSM. Our model demonstrates 5.4%, 12.4%, and 6.0% higher performance, respectively, compared to best F1 baseline models.

Edge Conditional Node Update Graph Neural Network for Multi-variate Time Series Anomaly Detection

TL;DR

The paper tackles multivariate time-series anomaly detection in cyber-physical systems with unknown sensor relationships. It introduces ECNU-GNN, a graph neural network that updates target node representations via edge-conditioned transformations guided by node embedding vectors, avoiding graph-attention constraints. The model learns the graph structure from node embeddings, predicts next-step sensor values, and detects anomalies using Graph Deviation Scoring, achieving notable scores on SWaT, WADI, and PSM datasets. Limitations include fixed node embeddings and a fixed neighborhood size; future work will explore dynamic graph structures learned by a graph inference network.

Abstract

With the rapid advancement in cyber-physical systems, the increasing number of sensors has significantly complicated manual monitoring of system states. Consequently, graph-based time-series anomaly detection methods have gained attention due to their ability to explicitly represent relationships between sensors. However, these methods often apply a uniform source node representation across all connected target nodes, even when updating different target node representations. Moreover, the graph attention mechanism, commonly used to infer unknown graph structures, could constrain the diversity of source node representations. In this paper, we introduce the Edge Conditional Node-update Graph Neural Network (ECNU-GNN). Our model, equipped with an edge conditional node update module, dynamically transforms source node representations based on connected edges to represent target nodes aptly. We validate performance on three real-world datasets: SWaT, WADI, and PSM. Our model demonstrates 5.4%, 12.4%, and 6.0% higher performance, respectively, compared to best F1 baseline models.
Paper Structure (26 sections, 25 equations, 10 figures, 8 tables, 1 algorithm)

This paper contains 26 sections, 25 equations, 10 figures, 8 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Graph Neural Networks
  4. Time series anomaly detection
  5. Method
  6. Problem Statement
  7. Overview
  8. Node Condition Embedding
  9. Graph Structure Extraction
  10. Condition based prediction
  11. Edge Conditional Node Update Module
  12. Node Conditional Readout Module
  13. Anomaly Detection
  14. Experiments
  15. Datasets
  16. ...and 11 more sections

Figures (10)

  • Figure 1: Overview of our model
  • Figure 2: Method for updating target nodes in graph convolution networks: This method utilizes a uniform source node representation for different target nodes within the network.
  • Figure 3: Naive method for updating target nodes with different source node representations: This method employs transformation modules, corresponding in number to the edges, to adapt the source node representation according to each connected edge.
  • Figure 4: ECNUM Method for target node update: ECNUM utilizes a unified module approach to modify source node representations. The transformation process within this module is guided by the specific embedding vectors of both the target and source nodes.
  • Figure 5: NCRM reads the final node representations to predict the values for the nodes at the next time step. It is a single module using node embedding vectors as conditions, enabling it to perform precise and node-specific predictions.
  • ...and 5 more figures