Source-linked AI summary
A Deep Neural Network for Unsupervised Anomaly Detection and Diagnosis in Multivariate Time Series Data
Chuxu Zhang, Dongjin Song, Yuncong Chen, Xinyang Feng, Cristian Lumezanu, Wei Cheng, Jingchao Ni, Bo Zong, Haifeng Chen, Nitesh V. Chawla
TL;DR
Unsupervised anomaly detection and diagnosis in multivariate time series must handle scarce labels, temporal dependencies, inter-sensor correlations, noise, and anomaly severity. MSCRED uses multi-scale signature matrices with convolutional encoding, attention-based ConvLSTM, and decoding, and outperforms state-of-the-art baselines on synthetic and power plant datasets.
Problem
Few anomaly labels and the need to model temporal dependencies, inter-sensor correlations, noise, and anomaly severity make joint unsupervised detection and diagnosis challenging.
Method
MSCRED constructs multi-scale signature matrices, encodes inter-sensor correlations with a convolutional encoder, captures temporal patterns with attention-based ConvLSTM, and reconstructs the matrices for anomaly detection and diagnosis.
Results
MSCRED outperforms state-of-the-art baseline methods on synthetic and power plant datasets, with improvements over the best baseline ranging from 13.3% to 30.0%.
Takeaways & Limitations
The framework jointly addresses anomaly detection, root-cause identification, and anomaly severity (duration) interpretation.
Abstract
from arXiv · showhide
Nowadays, multivariate time series data are increasingly collected in various real world systems, e.g., power plants, wearable devices, etc. Anomaly detection and diagnosis in multivariate time series refer to identifying abnormal status in certain time steps and pinpointing the root causes. Building such a system, however, is challenging since it not only requires to capture the temporal dependency in each time series, but also need encode the inter-correlations between different pairs of time series. In addition, the system should be robust to noise and provide operators with different levels of anomaly scores based upon the severity of different incidents. Despite the fact that a number of unsupervised anomaly detection algorithms have been developed, few of them can jointly address these challenges. In this paper, we propose a Multi-Scale Convolutional Recurrent Encoder-Decoder (MSCRED), to perform anomaly detection and diagnosis in multivariate time series data. Specifically, MSCRED first constructs multi-scale (resolution) signature matrices to characterize multiple levels of the system statuses in different time steps. Subsequently, given the signature matrices, a convolutional encoder is employed to encode the inter-sensor (time series) correlations and an attention based Convolutional Long-Short Term Memory (ConvLSTM) network is developed to capture the temporal patterns. Finally, based upon the feature maps which encode the inter-sensor correlations and temporal information, a convolutional decoder is used to reconstruct the input signature matrices and the residual signature matrices are further utilized to detect and diagnose anomalies. Extensive empirical studies based on a synthetic dataset and a real power plant dataset demonstrate that MSCRED can outperform state-of-the-art baseline methods.
Introduction
MSCRED addresses unsupervised anomaly detection and diagnosis in multivariate time series by jointly modeling temporal dependencies, inter-sensor correlations, noise, and anomaly severity. It uses multi-scale signature matrices with an encoder-decoder architecture to detect anomalies and identify their root causes.
- Motivation: Few anomaly labels make supervised algorithms infeasible for automatically detecting and diagnosing anomalies in monitored systems.Accurate detection supports timely action, while root-cause identification helps operators diagnose and repair systems.
- Challenges: Multivariate time series require methods that capture temporal dependencies, resist noise, and interpret anomaly severity across different incidents.Existing approaches may miss temporal dependencies or become less reliable when noise is severe.
- Approach: MSCRED constructs multi-scale system signature matrices, encodes inter-sensor correlations with convolutions, captures temporal patterns with attention-based ConvLSTM, and reconstructs the matrices.Residual signature matrices are used for anomaly detection and diagnosis, while multiple status levels represent differing incident severity.
- Contributions: The paper formulates anomaly detection and diagnosis as anomaly detection, root-cause identification, and anomaly severity (duration) interpretation.The stated goal is to address these three tasks jointly rather than independently.
- Evaluation: Empirical studies on synthetic and power plant datasets report superior performance over state-of-the-art baseline methods.The contribution passage presents this evaluation as evidence for MSCRED’s performance across the studied datasets.
Related Work
Prior unsupervised anomaly-detection methods include distance, clustering, classification, density-estimation, temporal-prediction, and deep-learning approaches. The paper positions MSCRED as addressing temporal dependency, noise resistance, and anomaly-severity interpretation jointly.
- Traditional methods: Distance, clustering, classification, and density-estimation methods identify anomalies using distances, clusters, density distributions, or outlierness scores.These methods may not capture temporal dependencies appropriately in multivariate time series.
- Temporal prediction: Temporal prediction methods such as ARMA model temporal dependency but are sensitive to noise and may increase false positives.This creates a robustness limitation for noisy multivariate time series data.
- Deep learning methods: Deep learning methods use density modeling or LSTM encoder-decoder architectures to model multidimensional distributions or temporal dependencies.The cited LSTM encoder-decoder methods achieve better generalization capability than traditional methods.
- Remaining gap: Existing methods do not jointly consider temporal dependency, noise resistance, and interpretation of anomaly severity.MSCRED is introduced against this combined limitation in prior work.
- Design context: MSCRED’s design draws on fully convolutional networks, convolutional LSTM networks, and attention techniques alongside related time-series applications.The related applications include clustering, classification, and segmentation.
MSCRED Framework
MSCRED represents multivariate system status with multi-scale signature matrices, encodes spatial correlations and temporal patterns, then reconstructs the matrices for anomaly detection and diagnosis.
- MSCRED formulates anomaly detection and diagnosis as detecting future anomaly events, identifying likely abnormal time series, and interpreting anomaly duration.
- Characterizing Status with Signature Matrices: Signature matrices encode pairwise inter-sensor correlations within time segments and are designed to be robust to turbulence in individual series.Three matrices use window lengths w = 10, 30, 60, with segment intervals of 10.
- Convolutional Encoder: A fully convolutional encoder concatenates signature matrices from different scales and processes them through convolutional layers to encode spatial patterns.
- Attention based ConvLSTM: An attention-based ConvLSTM models temporal dependencies by adaptively selecting relevant hidden feature maps from previous time steps.The model uses 3D tensors and sets the previous-segment step length h to 5 based on empirical performance.
- Convolutional Decoder: A stacked deconvolutional decoder combines ConvLSTM outputs with intermediate feature maps to reconstruct signature matrices with the input size.The reconstruction uses four deconvolutional layers and skip-like concatenation across decoder and ConvLSTM layers.
- MSCRED minimizes reconstruction error and uses residual signature matrices to perform anomaly detection and diagnosis after training.
Experiments
The experiments evaluate MSCRED on anomaly detection, diagnosis, and robustness to noise through five research questions covering baseline comparisons and component effects.
- Anomaly detection: RQ1 and RQ2 test whether MSCRED outperforms baseline anomaly detectors and how its components affect performance.
- Anomaly diagnosis: RQ3 and RQ4 evaluate root cause identification and qualitative interpretation of anomaly severity or duration.
- Robustness to noise: RQ5 compares MSCRED with baseline methods for robustness to input noise.
Experimental Setup
The evaluation combines synthetic and real power-plant data, compares MSCRED with eight baselines, and uses reconstruction-based anomaly scores with repeated metric evaluation.
- The study uses a synthetic dataset and a real-world power-plant dataset with detailed statistics and settings reported in Table 1.
- Synthetic data: Synthetic data model temporal patterns, periodic cycles, Gaussian noise, and correlations induced by randomly selected frequencies and phases.The Gaussian noise is ϵ ∼ N(0, 1) scaled by λ = 0.3.
- Power plant data: The power-plant dataset contains 36 sensor time series, 23,040 time steps, one operator-identified anomaly, and four randomly injected test anomalies.
- Baselines: MSCRED is compared with eight baselines spanning classification, density estimation, temporal prediction, and MSCRED variants.
- Scoring: The anomaly score counts residual signature-matrix elements exceeding an empirically determined threshold θ.
- Evaluation: Precision, Recall, and F1 Score evaluate detection; the threshold is selected on validation data, and results average five repeated experiments.
Performance Evaluation
MSCRED outperforms baseline methods for anomaly detection and root-cause identification while supporting severity interpretation across anomaly durations. Its attention mechanism improves sensitivity to system-status changes, and its performance remains stronger under varying noise levels.
- Anomaly detection: MSCRED performs best across all anomaly-detection settings, improving over the best baseline by 13.3% to 30.0%.The comparison reports stronger performance than classification, density-estimation, and temporal-prediction baselines.
- Anomaly detection: MSCRED detects anomalies without false positives or false negatives in the reported case study, whereas ARMA and LSTM-ED show errors.ARMA produces unstable scores, while LSTM-ED is smoother but still has several false positives and false negatives.
- Ablation and attention: Attention-based ConvLSTM improves anomaly detection by assigning lower weights to older normal timesteps during abnormal periods.This weighting pattern indicates sensitivity to changes in system status.
- Root-cause identification: MSCRED outperforms LSTM-ED in root-cause identification by 25.9% on synthetic data and 32.4% on power-plant data.The comparison uses average recall@k with k = 3 across five repeated experiments.
- Severity interpretation: The three MSCRED channels differentiate anomaly durations: the small channel detects all durations, the medium channel detects medium and long durations, and the large channel detects only long durations.Joint channel outputs are used to interpret whether an anomaly is short, medium, or long duration.
- Robustness to noise: MSCRED consistently outperforms ARMA and LSTM-ED when noise varies from 0.2 to 0.45.The reported comparison uses precision and recall under an optimized cutting threshold.
Conclusion
MSCRED addresses multivariate anomaly detection and diagnosis by modeling inter-sensor correlations and temporal dependencies through multi-scale signature matrices and an encoder-decoder framework. Empirical studies on synthetic and power plant datasets show it outperforms state-of-the-art baselines.
- MSCRED uses multi-scale system signature matrices to characterize system statuses across different time segments.
- Its deep encoder-decoder framework models both inter-sensor correlations and temporal dependencies in multivariate time series.
- Residual signature matrices support anomaly detection and diagnosis after the model reconstructs the input signature matrices.
- Experiments on a synthetic dataset and a power plant dataset demonstrate that MSCRED outperforms state-of-the-art baseline methods.