GCAD: Anomaly Detection in Multivariate Time Series from the Perspective of Granger Causality

TL;DR

GCAD targets anomaly detection in multivariate time series by learning dynamic, nonlinear Granger-causality relations from gradients of a deep predictor. It constructs a gradient-driven Granger causality graph, sparsifies it to reduce noise, and computes a causal-pattern plus temporal-pattern deviation score to detect anomalies. Empirical results on five real-world sensor datasets show GCAD achieving state-of-the-art performance against multiple baselines, illustrating the value of causal-pattern analysis for complex systems. The approach provides interpretable insights into evolving dependencies without online optimization during testing, offering practical applicability for real-time monitoring.

Abstract

Multivariate time series anomaly detection has numerous real-world applications and is being extensively studied. Modeling pairwise correlations between variables is crucial. Existing methods employ learnable graph structures and graph neural networks to explicitly model the spatial dependencies between variables. However, these methods are primarily based on prediction or reconstruction tasks, which can only learn similarity relationships between sequence embeddings and lack interpretability in how graph structures affect time series evolution. In this paper, we designed a framework that models spatial dependencies using interpretable causal relationships and detects anomalies through changes in causal patterns. Specifically, we propose a method to dynamically discover Granger causality using gradients in nonlinear deep predictors and employ a simple sparsification strategy to obtain a Granger causality graph, detecting anomalies from a causal perspective. Experiments on real-world datasets demonstrate that the proposed model achieves more accurate anomaly detection compared to baseline methods.

Figures (5)

• Figure 1: Overall Architecture of GCAD. During the training phase, the gradient generator is trained for the prediction task. In the sampling and testing phases, the gradient information from the training samples and test data within the predictor is used to perform Granger causality discovery, and the causal graphs are obtained through sparsification. Anomaly scores are calculated by measuring the deviation of the causal graphs from the normal pattern.
• Figure 2: Effect of parameters. AUROC and AUPRC as functions of (a) maximum time lag $\tau$ in Granger causality and (b) sparsification threshold $h$ of the causal graph
• Figure 3: Causal Pattern Deviation Matrix in an Example Anomaly on the SWaT Dataset
• Figure 4: Physical Structure of the SWaT Testbed, Attack Points of Anomalous Events (marked in red), and Main Affected Points (marked in blue)
• Figure 5: Two Affected Sensors and the Changes in the Total Anomaly Score in the Example Anomalous Instances

Theorems & Definitions (1)

• Definition 1