Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

GraphSubDetector: Time Series Subsequence Anomaly Detection via Density-Aware Adaptive Graph Neural Network

Weiqi Chen, Zhiqiang Zhou, Qingsong Wen, Liang Sun

TL;DR

A novel approach to subsequence anomaly detection, namely GraphSubDetector, which adaptively learns the appropriate subsequence length with a length selection mechanism that highlights the characteristics of both normal and anomalous patterns and a density-aware adaptive graph neural network (DAGNN), which can generate further robust representations against variance of normal data for anomaly detection.

Abstract

Time series subsequence anomaly detection is an important task in a large variety of real-world applications ranging from health monitoring to AIOps, and is challenging due to the following reasons: 1) how to effectively learn complex dynamics and dependencies in time series; 2) diverse and complicated anomalous subsequences as well as the inherent variance and noise of normal patterns; 3) how to determine the proper subsequence length for effective detection, which is a required parameter for many existing algorithms. In this paper, we present a novel approach to subsequence anomaly detection, namely GraphSubDetector. First, it adaptively learns the appropriate subsequence length with a length selection mechanism that highlights the characteristics of both normal and anomalous patterns. Second, we propose a density-aware adaptive graph neural network (DAGNN), which can generate further robust representations against variance of normal data for anomaly detection by message passing between subsequences. The experimental results demonstrate the effectiveness of the proposed algorithm, which achieves superior performance on multiple time series anomaly benchmark datasets compared to state-of-the-art algorithms.

GraphSubDetector: Time Series Subsequence Anomaly Detection via Density-Aware Adaptive Graph Neural Network

TL;DR

A novel approach to subsequence anomaly detection, namely GraphSubDetector, which adaptively learns the appropriate subsequence length with a length selection mechanism that highlights the characteristics of both normal and anomalous patterns and a density-aware adaptive graph neural network (DAGNN), which can generate further robust representations against variance of normal data for anomaly detection.

Abstract

Time series subsequence anomaly detection is an important task in a large variety of real-world applications ranging from health monitoring to AIOps, and is challenging due to the following reasons: 1) how to effectively learn complex dynamics and dependencies in time series; 2) diverse and complicated anomalous subsequences as well as the inherent variance and noise of normal patterns; 3) how to determine the proper subsequence length for effective detection, which is a required parameter for many existing algorithms. In this paper, we present a novel approach to subsequence anomaly detection, namely GraphSubDetector. First, it adaptively learns the appropriate subsequence length with a length selection mechanism that highlights the characteristics of both normal and anomalous patterns. Second, we propose a density-aware adaptive graph neural network (DAGNN), which can generate further robust representations against variance of normal data for anomaly detection by message passing between subsequences. The experimental results demonstrate the effectiveness of the proposed algorithm, which achieves superior performance on multiple time series anomaly benchmark datasets compared to state-of-the-art algorithms.

Paper Structure

This paper contains 28 sections, 4 theorems, 16 equations, 8 figures, 9 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Anomaly Detection based on Discords
  4. Anomaly Detection based on One-Class Classifier
  5. Anomaly Detection based on Reconstruction
  6. Other Anomaly Detection Methods
  7. Preliminaries
  8. Notations and Problem Definition
  9. Distance-based Anomaly Detection
  10. Graph Neural Networks
  11. Methodology
  12. Learning Representations of Subsequences with Appropriate Lengths
  13. Robust Representation Learning via Density-Aware Graph Neural Networks
  14. Model Learning
  15. Experiments
  16. ...and 13 more sections

Key Result

theorem 1

Define a fully-connected graph $\mathcal{G}$ of data samples with adjacency matrix $\mathbf{A} \in \mathbb{R} ^ {(N+M) \times (N+M)}$ encoding similarity measurement of pair-wise samples, and the entry $\mathbf{A}_{ij} = \exp{(-\|\mathbf{f}_i - \mathbf{f}_j \| ^ 2 / \delta})$, which transforms Eucli

Figures (8)

  • Figure 1: Point-wise anomalies (top) versus subsequence anomalies (bottom). The top is a website traffic time series with anomalies labeled by red dots that might be caused by cyberattacks. The bottom is an insect's activity signal recorded with an EPG apparatus, where time intervals marked in grey are subsequences exhibiting different anomalous characteristics, including period length variation, spike, and temporal morphological change. Patterns and duration of anomalies vary.
  • Figure 2: An illustration of the difficulty in selecting proper subsequence length for subsequence anomaly detection. This figure shows an electricity consumption time series with both daily and weekly periods, and a 2-day anomalous subsequence that might be caused by power rationing inside the dark grey zone. If we directly detect anomalies using this length, the anomaly might not be found as it is very similar to normal subsequences, e.g., the green zone. Instead, it is better to select a longer length of a week (light grey), including the anomaly with its context to highlight the anomalous trend change.
  • Figure 3: An overview of the proposed GraphSubDetector.
  • Figure 4: Learning subsequence representations using multi-length encoder and length selection mechanism.
  • Figure 5: Case studies and visualization of GraphSubDetector and Matrix Profile algorithms for subsequence anomaly detection with different lengths of subsequence anomalies and recurring anomalies.
  • ...and 3 more figures

Theorems & Definitions (4)

  • theorem 1
  • theorem 2
  • theorem 3
  • theorem 4