Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Explainable Online Unsupervised Anomaly Detection for Cyber-Physical Systems via Causal Discovery from Time Series

Daniele Meli

TL;DR

This work addresses online unsupervised anomaly detection in cyber-physical systems by replacing black-box neural models with a causal-discovery-based approach. It learns a nominal temporal causal graph using PCMCI via Conditional Mutual Information $I(X;Y|Z)$ and detects online anomalies by tracking deviations in the learned causal links. The method achieves 100% precision/recall/F1 on SWAT and strong recall on Pepper, with significantly faster training than neural baselines and the added benefit of interpretable root-cause explanations. Overall, causal-discovery-based OUAD demonstrates explainable, efficient real-time monitoring for CPS.

Abstract

Online unsupervised detection of anomalies is crucial to guarantee the correct operation of cyber-physical systems and the safety of humans interacting with them. State-of-the-art approaches based on deep learning via neural networks achieve outstanding performance at anomaly recognition, evaluating the discrepancy between a normal model of the system (with no anomalies) and the real-time stream of sensor time series. However, large training data and time are typically required, and explainability is still a challenge to identify the root of the anomaly and implement predictive maintainance. In this paper, we use causal discovery to learn a normal causal graph of the system, and we evaluate the persistency of causal links during real-time acquisition of sensor data to promptly detect anomalies. On two benchmark anomaly detection datasets, we show that our method has higher training efficiency, outperforms the accuracy of state-of-the-art neural architectures and correctly identifies the sources of >10 different anomalies. The code is at https://github.com/Isla-lab/causal_anomaly_detection.

Explainable Online Unsupervised Anomaly Detection for Cyber-Physical Systems via Causal Discovery from Time Series

TL;DR

This work addresses online unsupervised anomaly detection in cyber-physical systems by replacing black-box neural models with a causal-discovery-based approach. It learns a nominal temporal causal graph using PCMCI via Conditional Mutual Information and detects online anomalies by tracking deviations in the learned causal links. The method achieves 100% precision/recall/F1 on SWAT and strong recall on Pepper, with significantly faster training than neural baselines and the added benefit of interpretable root-cause explanations. Overall, causal-discovery-based OUAD demonstrates explainable, efficient real-time monitoring for CPS.

Abstract

Online unsupervised detection of anomalies is crucial to guarantee the correct operation of cyber-physical systems and the safety of humans interacting with them. State-of-the-art approaches based on deep learning via neural networks achieve outstanding performance at anomaly recognition, evaluating the discrepancy between a normal model of the system (with no anomalies) and the real-time stream of sensor time series. However, large training data and time are typically required, and explainability is still a challenge to identify the root of the anomaly and implement predictive maintainance. In this paper, we use causal discovery to learn a normal causal graph of the system, and we evaluate the persistency of causal links during real-time acquisition of sensor data to promptly detect anomalies. On two benchmark anomaly detection datasets, we show that our method has higher training efficiency, outperforms the accuracy of state-of-the-art neural architectures and correctly identifies the sources of >10 different anomalies. The code is at https://github.com/Isla-lab/causal_anomaly_detection.
Paper Structure (11 sections, 6 equations, 2 figures, 2 tables, 1 algorithm)

This paper contains 11 sections, 6 equations, 2 figures, 2 tables, 1 algorithm.

Table of Contents

  1. INTRODUCTION
  2. CAUSAL DISCOVERY
  3. CAUSAL DISCOVERY FOR OUAD
  4. DATASETS
  5. SWAT
  6. Pepper
  7. RESULTS
  8. Normal causal models
  9. Quantitative analysis
  10. Anomaly explanations
  11. CONCLUSION

Figures (2)

  • Figure 1: The two testing scenarios: a) SWAT; b) Pepper social robot; c) a functional scheme of SWAT stages P1-P6.
  • Figure 2: Normal causal graph for SWAT. auto-MCI is for autoregressive dependency, cross-MCI is for cross-variable dependency. Only links with $|\text{MCI}|>0.3$ are shown for ease of visualization.