Graph Neural Network-Based Anomaly Detection in Multivariate Time Series

By Ailin Deng, Bryan Hooi. AAAI Conference on Artificial Intelligence, 2021

1,434 citations recorded by the source corpus.

Given high-dimensional time series data (e.g., sensor data), how can we detect anomalous events, such as system faults and attacks? More challengingly, how can we do this in a way that captures complex inter-sensor relationships, and detects and explains anomalies which deviate from these relationships? Recently, deep learning approaches have enabled improvements in anomaly detection in high-dimensional datasets; however, existing methods do not explicitly learn the structure of existing relationships between variables, or use them to predict the expected behavior of time series. Our approach combines a structure learning approach with graph neural networks, additionally using attention weights to provide explainability for the detected anomalies. Experiments on two real-world sensor datasets with ground truth anomalies show that our method detects anomalies more accurately than baseline approaches, accurately captures correlations between sensors, and allows users to deduce the root cause of a detected anomaly.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/21d2742e38f7167354dafcf7f565d3894b31d008

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

TranAD: Deep Transformer Networks for Anomaly Detection in Multivariate Time Series Data (2022, methodology): “also unable to model long-term trends effectively [4, 14, 62].”
Deep Learning for Anomaly Detection in Time-Series Data: Review, Analysis, and Guidelines (2021, methodology): “Recently, several approaches [73], [108], [109] that applied an attention mechanism to GNN have been proposed to improve performance for identifying root causes.”
The role of deep learning in urban water management: A critical review. (2022, methodology): “Test-bed systems (e.g., Deng and Hooi, 2021), synthetic data, benchmark networks (e.g., Taormina and Galelli, 2018) The BATADAL dataset ( Taormina et al., Synthetic data generated using flood models (Guo et al., 2021b; Li et al., 2021) Flood risk maps such as those from the UK Environment Agency.”
Deep Learning for Time Series Anomaly Detection: A Survey (2022, neutral): “3) GDN [49] S Un W ✓ GTA* [38] ST Semi GANF [45] ST Un W”
Anomaly Transformer: Time Series Anomaly Detection with Association Discrepancy (2021, methodology): “Recently, graph neural network (GNN) has been applied to learn the dynamic graph among multiple variables in multivariate time series (Zhao et al., 2020; Deng & Hooi, 2021).”
Deep Learning for Time Series Forecasting: Tutorial and Literature Survey (2020, methodology): “As of now, two main strategies have been proposed to learn the node embeddings, either simply by gradient descent [43, 193] or by taking representation from the time series [102, 163], with the latter approach to seemingly yielding better results.”
A Survey on Graph Neural Networks for Time Series: Forecasting, Classification, Imputation, and Anomaly Detection (2023, methodology): “GDN [36] is a representative work, consisting of a graph structure module that learns the underlying topology and a graph attention network that encodes input series representations for one-step-ahead forecasts.”
DCdetector: Dual Attention Contrastive Representation Learning for Time Series Anomaly Detection (2023, methodology): “Such versatility results in the community’s long-lasting interest in developing new unsupervised time-series anomaly detection methods, including DAGMM [88], OmniAnomaly [63], GDN [24], RDSSM [42] and so on.”
Deep Isolation Forest for Anomaly Detection (2022, methodology): “Following [34], [37], they directly handle time-series datasets by treating each timestamp as a data object.”
Learning Graph Structures With Transformer for Multivariate Time-Series Anomaly Detection in IoT (2021, methodology): “M is also reported as the number of features or variables in some literature [6], [13], [4].”