面向多维时间序列异常检测的时空图卷积网络

doi:10.19665/j.issn1001-2400.20230804

摘要/Abstract

摘要：

针对现有多维时间序列异常检测模型对局部和全局时空依赖性捕获能力不足的问题,提出一种基于时空图卷积网络的多维时间序列异常检测模型。首先,在时间维度上利用扩张因果卷积和多头自注意力机制,分别捕获短期和长期时间依赖性,并且引入通道注意力来学习不同通道的重要性权重;其次,在空间维度上利用静态图学习层根据节点嵌入构建静态图邻接矩阵,旨在捕获多维时间序列数据的全局空间依赖性,同时利用动态图学习层构建一系列演化的图邻接矩阵,旨在建模局部动态的空间依赖性;最后,联合优化重构模型和预测模型,通过重构误差和预测误差计算异常分数,然后比较阈值和异常分数的关系,进而检测异常。在MSL、SMAP和SWaT三个公开数据集上的实验结果表明,该模型在异常检测性能指标F1分数方面优于OmniAnomaly、MTAD-GAT和GDN等相关的基线模型。

关键词: 图卷积网络, 时空依赖, 多维时间序列, 异常检测

Abstract:

To address the problem that the existing multivariate time series anomaly detection models have an insufficient ability to capture local and global spatial-temporal dependencies,a multivariate time series anomaly detection model based on spatial-temporal graph convolutional networks is proposed.First,in the temporal dimension,the short-term and long-term temporal dependencies in time series data are captured by using dilated causal convolution and multi-headed self-attention mechanisms,respectively.And the channel attention is introduced to learn the importance weights of different channels.Second,in the spatial dimension,a graph adjacency matrix is constructed by the static graph learning layer according to the node embedding,which is used to model the global spatial dependencies.Meanwhile,a series of evolutionary graph adjacency matrices is constructed by using the dynamic graph learning layer,so as to capture the local dynamic spatial dependencies.Finally,the reconstruction model and the prediction model are jointly optimized,and the anomaly score is calculated by the reconstructed error and the prediction error.Then,the relationship between the threshold and the anomaly score is compared to detect the anomaly.Experimental results on three public datasets,MSL,SMAP,and SwaT,show that the model outperforms the relevant baseline models such as OmniAnomaly,MTAD-GAT,and GDN in terms of the anomaly detection performance metric F1 score.

Key words: graph convolutional networks, spatial-temporal dependencies, multivariate time series, anomaly detection

中图分类号:

TP391

王静, 何苗苗, 丁建立, 李永华. 面向多维时间序列异常检测的时空图卷积网络[J]. 西安电子科技大学学报, 2024, 51(3): 170-181.

WANG Jing, HE Miaomiao, DING Jianli, LI Yonghua. Spatial-temporal graph convolutional networks foranomaly detection in multivariate time series[J]. Journal of Xidian University, 2024, 51(3): 170-181.

图/表 9

表1

图1

图2

图3

表2

表3

图4

图5

图6

参考文献 25

[1]	WENIG P, SCHMIDL S, PAPENBROCK T. TimeEval:A Benchmarking Toolkit for Time Series Anomaly Detection Algorithms[J]. Proceedings of the VLDB Endowment, 2022, 15(12):3678-3681.
[2]	丁小欧, 于晟健, 王沐贤, 等. 基于相关性分析的工业时序数据异常检测[J]. 软件学报, 2020, 31(3):726-747.
	DING Xiaoou, YU Shengjian, WANG Muxian, et al. Anomaly Detection on Industrial Time Series Based on Correlation Analysis[J]. Journal of Software, 2020, 31(3):726-747.
[3]	SCHMIDL S, WENIG P, PAPENBROCK T. Anomaly Detection in Time Series:A Comprehensive Evaluation[J]. Proceedings of the VLDB Endowment, 2022, 15(9):1779-1797.
[4]	顾兆军, 刘婷婷, 隋翯. 一种ICS异常检测的优化GAN模型[J]. 西安电子科技大学学报, 2022, 49(2):173-181.
	GU Zhaojun, LIU Tingting, SUI He. Latent Feature Reconstruction Generative GAN Model for ICS Anomaly Detection[J]. Journal of Xidian University, 2022, 49(2):173-181.
[5]	YU Y, SI X, HU C, et al. A Review of Recurrent Neural Networks:LSTM Cells and Network Architectures[J]. Neural Computation, 2019, 31(7):1235-1270.
[6]	PARK D, HOSHI Y, KEMP C C. A Multimodal Anomaly Detector for Robot-Assisted Feeding Using an LSTM-Based Variational Autoencoder[J]. IEEE Robotics and Automation Letters, 2018, 3(3):1544-1551.
[7]	SU Y, ZHAO Y, NIU C, et al. Robust Anomaly Detection for Multivariate Time Series Through Stochastic Recurrent Neural Network[C]//Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. New York: ACM, 2019:2828-2837.
[8]	LI D, CHEN D, JIN B, et al. MAD-GAN:Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks[C]//I nternational Conference on Artificial Neural Networks. Heidelberg:Springer, 2019:703-716.
[9]	AUDIBERT J, MICHIARDI P, GUYARD F, et al. USAD:Unsupervised Anomaly Detection on Multivariate Time Series[C]//Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. New York: ACM, 2020:3395-3404.
[10]	吴博, 梁循, 张树森, 等. 图神经网络前沿进展与应用[J]. 计算机学报, 2022, 45(1):35-68.
	WU Bo, LIANG Xun, ZHANG Shusen, et al. Advances and Applications in Graph Neural Network[J]. Chinese Journal of Computers, 2022, 45(1):35-68.
[11]	DENG A, HOOI B. Graph Neural Network-Based Anomaly Detection in Multivariate Time Series[C]//Proceedings of the AAAI Conference on Artificial Intelligence. Palo Alto: AAAI, 2021:4027-4035.
[12]	ZHAO H, WANG Y, DUAN J, et al. Multivariate Time-Series Anomaly Detection via Graph Attention Network[C]//2020 IEEE International Conference on Data Mining(ICDM).Piscataway:IEEE, 2020:841-850.
[13]	CHEN Z, CHEN D, ZHANG X, et al. Learning Graph Structures with Transformer for Multivariate Time-Series Anomaly Detection in IoT[J]. IEEE Internet of Things Journal, 2021, 9(12):9179-9189.
[14]	VASWANI A, SHAZEER N, PARMAR N, et al. Attention is All You Need[C]//Advances in Neural Information Processing Systems(NIPS). San Diego: NIPS, 2017:6000-6010.
[15]	KIPF T N, WELLING M. Semi-Supervised Classification with Graph Convolutional Networks(2016)[J/OL].[2016-09-09]. https://arxiv.org/pdf/1609.02907.pdf.
[16]	BAI S, KOLTER J Z, KOLTUN V. An Empirical Evaluation of Generic Convolutional and Recurrent Networks for Sequence Modeling(2018)[J/OL].[2018-03-04]. https://arxiv.org/pdf/1803.01271.pdf.
[17]	WOO S, PARK J, LEE J Y, et al. CBAM:Convolutional Block Attention Module[C]//Proceedings of the European Conference on Computer Vision(ECCV). Heidelberg:Springer, 2018:3-19.
[18]	WU Z, PAN S, LONG G, et al. Connecting the Dots:Multivariate Time Series Forecasting with Graph Neural Networks[C]//Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining. New York: ACM, 2020:753-763.
[19]	FENG C, TIAN P. Time Series Anomaly Detection for Cyber-Physical Systems via Neural System Identification and Bayesian Filtering[C]//Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining. New York: ACM, 2021:2858-2867.
[20]	XIE J, CUI Y, HUANG F, et al. MARINA:An MLP-Attention Model for Multivariate Time-Series Analysis[C]//Proceedings of the 31st ACM International Conference on Information & Knowledge Management. New York: ACM, 2022:2230-2239.
[21]	KIM S, CHOI K, CHOI H S, et al. Towards a Rigorous Evaluation of Time-Series Anomaly Detection[C]//Proceedings of the AAAI Conference on Artificial Intelligence. Palo Alto: AAAI, 2022:7194-7201.
[22]	HAN S, WOO S S. Learning Sparse Latent Graph Representations for Anomaly Detection in Multivariate Time Series[C]//Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. New York: ACM, 2022:2977-2986.
[23]	ZHANG Z, LI W, DING W, et al. STAD-GAN:Unsupervised Anomaly Detection on Multivariate Time Series with Self-Training Generative Adversarial Networks[J]. ACM Transactions on Knowledge Discovery from Data, 2023, 17(5):1-18.
[24]	ZONG B, SONG Q, MIN M R, et al. Deep Autoencoding Gaussian Mixture Model for Unsupervised Anomaly Detection[C]//International Conference on Learning Representations. Piscataway:IEEE, 2018:1-19.
[25]	DING C, SUN S, ZHAO J. MST-GAT:A Multimodal Spatial-Temporal Graph Attention Network for Time Series Anomaly Detection[J]. Information Fusion, 2023, 89:527-536.

符号	描述	符号	描述
N	变量的数目	C	通道数
P	历史时间步的长度	γ	超参数,计算异常分数时的组合比例
w	滑动窗口的大小	Z	时间模块的输出特征
L	测试集的长度	H	空间模块的输出特征
χ	滑动窗口输入	score⁽^t⁾	t时刻的异常分数

数据集	特征维度	训练集样本数	测试集样本数	测试集异常样本比例/%
MSL	55	58 317	73 729	10.72
SMAP	25	135 183	427 617	13.13
SWaT	51	496 800	449 919	11.98

Model	MSL			SMAP			SWaT
Model	Precision	Recall	F1	Precision	Recall	F1	Precision	Recall	F1
DAGMM	0.541 2	0.993 4	0.700 7	0.584 5	0.905 8	0.710 5	0.274 6	0.695 2	0.393 7
LSTM-VAE	0.525 7	0.954 6	0.678 0	0.855 1	0.636 6	0.729 8	0.962 4	0.599 1	0.738 5
OmniAnomaly	0.886 7	0.911 7	0.899 0	0.741 6	0.977 6	0.843 4	0.982 5	0.649 7	0.782 2
USAD	0.881 0	0.978 6	0.927 2	0.769 7	0.983 1	0.863 4	0.985 1	0.661 8	0.791 7
GDN	0.913 5	0.861 2	0.886 6	0.893 2	0.887 2	0.890 2	0.993 5	0.681 2	0.808 2
MTAD-GAT	0.875 4	0.944 0	0.908 4	0.890 6	0.912 3	0.901 3	0.971 8	0.695 7	0.810 9
MST-GAT	0.950 6	0.891 0	0.919 8	0.912 6	0.898 3	0.905 4	0.987 3	0.724 1	0.835 5
Ours	0.981 1	0.951 6	0.966 1	0.935 9	0.972 6	0.953 9	0.986 6	0.798 7	0.882 8