Multivariate Time-Series Anomaly Detection based on Enhancing Graph Attention Networks with Topological Analysis

TL;DR

TopoGDN addresses unsupervised anomaly detection in multivariate time series by integrating a multi-scale temporal convolution with a topology-aware graph attention framework. It introduces a graph structure learning module and a topological feature attention module that uses persistence diagrams to capture higher-order dependencies. Across four benchmark datasets, it outperforms strong baselines in F1-score while maintaining efficiency, and ablation demonstrates the value of each component. The results suggest that combining fine-grained temporal features, learned inter-feature relations, and topological summaries yields robust anomaly detection suitable for industrial settings.

Abstract

Unsupervised anomaly detection in time series is essential in industrial applications, as it significantly reduces the need for manual intervention. Multivariate time series pose a complex challenge due to their feature and temporal dimensions. Traditional methods use Graph Neural Networks (GNNs) or Transformers to analyze spatial while RNNs to model temporal dependencies. These methods focus narrowly on one dimension or engage in coarse-grained feature extraction, which can be inadequate for large datasets characterized by intricate relationships and dynamic changes. This paper introduces a novel temporal model built on an enhanced Graph Attention Network (GAT) for multivariate time series anomaly detection called TopoGDN. Our model analyzes both time and feature dimensions from a fine-grained perspective. First, we introduce a multi-scale temporal convolution module to extract detailed temporal features. Additionally, we present an augmented GAT to manage complex inter-feature dependencies, which incorporates graph topology into node features across multiple scales, a versatile, plug-and-play enhancement that significantly boosts the performance of GAT. Our experimental results confirm that our approach surpasses the baseline models on four datasets, demonstrating its potential for widespread application in fields requiring robust anomaly detection. The code is available at https://github.com/ljj-cyber/TopoGDN.

Figures (5)

• Figure 1: Anomalous Behavior in Industrial Sensor Time Series Data: The first three anomalies shown in the chart occur in specific time intervals and are characterized by sudden changes in value relative to the surrounding context. The last anomaly indicates fluctuations in the water level's rise and fall rate. This anomaly exhibits a specific pattern but tends to diminish over time.
• Figure 2: TopoGDN model structure and local module diagrams. As shown in (a) Model Overview, we first employ a sliding window approach to select contextual data from sensor inputs in the initial stage. This data is processed using the (c) Multi-scale Temporal Convolution module, which applies convolutional kernels of varying sizes to capture temporal features. These extracted features are then passed to the Graph Structure Learning module, transforming them into a contextual graph. Next, the (b) Topological Feature Attention Module utilizes sensor embeddings and the learned graph to perform attention aggregation. The module then conducts graph filtrations, creating multiple views of the graph to enhance feature representation. The resulting outputs are vectorized and converted into persistence barcodes, which capture essential topological features. Finally, the anomaly score is calculated by comparing the predicted outputs with the ground truths.
• Figure 3: Effect of different hyperparameters on model performance.
• Figure 4: Visualization of Graph Structure.
• Figure 5: Visualization of Persistence Barcode.