PaperlayerView exact revision on arXiv

Source-linked AI summary

Multivariate Time-series Anomaly Detection via Graph Attention Network

Hang Zhao, Yujing Wang, Juanyong Duan, Congrui Huang, Defu Cao, Yunhai Tong, Bixiong Xu, Jing Bai, Jie Tong, Qi Zhang

arXiv:2009.02040v1cs.LGstat.ML

TL;DR

Multivariate anomaly detection needs methods that explicitly capture relationships among time-series. MTAD-GAT uses parallel feature- and time-oriented graph attention with jointly optimized forecasting and reconstruction, and it outperforms state-of-the-art models on three datasets while supporting diagnosis.

  • Problem

    Existing multivariate anomaly-detection methods do not explicitly capture relationships between different time-series, although such correlations matter for judging system-level anomalies.

  • Method

    MTAD-GAT uses parallel graph-attention layers to model feature-wise and temporal relationships, jointly optimizing forecasting and reconstruction objectives.

  • Results

    MTAD-GAT achieves the best F1 scores consistently on SMAP, MSL, and TSA, improving over the best state-of-the-art performance by 1%, 1%, and 9%, respectively.

  • Takeaways & Limitations

    Attention analysis supports interpretability, and the model demonstrates capability for anomaly diagnosis and helping identify root causes.

Abstract

from arXiv · show

Anomaly detection on multivariate time-series is of great importance in both data mining research and industrial applications. Recent approaches have achieved significant progress in this topic, but there is remaining limitations. One major limitation is that they do not capture the relationships between different time-series explicitly, resulting in inevitable false alarms. In this paper, we propose a novel self-supervised framework for multivariate time-series anomaly detection to address this issue. Our framework considers each univariate time-series as an individual feature and includes two graph attention layers in parallel to learn the complex dependencies of multivariate time-series in both temporal and feature dimensions. In addition, our approach jointly optimizes a forecasting-based model and are construction-based model, obtaining better time-series representations through a combination of single-timestamp prediction and reconstruction of the entire time-series. We demonstrate the efficacy of our model through extensive experiments. The proposed method outperforms other state-of-the-art models on three real-world datasets. Further analysis shows that our method has good interpretability and is useful for anomaly diagnosis.

I. INTRODUCTION

MTAD-GAT addresses the limitation that prior methods do not explicitly model relationships among multivariate time-series. It uses parallel graph-attention mechanisms and jointly trains forecasting and reconstruction objectives, with reported performance, interpretability, and diagnosis benefits.

  • Motivation: Multivariate anomaly detection must consider correlations among metrics because isolated changes may not indicate system failure.The paper contrasts consistent metric trends in healthy periods with inconsistent GC behavior during an anomalous period.
  • Motivation: Prior approaches modeled multivariate series without explicitly capturing correlations between different time-series.The authors identify explicit multivariate-correlation modeling as an unresolved limitation in earlier work.
  • Proposed framework: MTAD-GAT treats each univariate time-series as a feature and models feature correlations alongside temporal dependencies.Its architecture uses two graph-attention layers operating in parallel.
  • Reported contributions: 9% improvement in overall F1 score is reported on production data, alongside superior performance on two public datasets.The paper also reports state-of-the-art scores in the literature and impact on user satisfaction for production data.
  • Proposed framework: The framework jointly optimizes forecasting and reconstruction to combine single-timestamp prediction with representation learning for an entire time-series.The two objectives are optimized simultaneously through a joint target.
  • Reported contributions: Attention-score analysis provides interpretability, and the model is presented as useful for anomaly diagnosis.The learned attention scores are reported to correspond reasonably well with human intuition.

II. RELATED WORK

The related work distinguishes univariate from unified multivariate modeling and forecasting from reconstruction-based detection. MTAD-GAT is positioned as combining complementary forecasting and reconstruction strengths while explicitly modeling feature correlations.

  • Taxonomy: Existing anomaly-detection methods include univariate approaches and models that treat multiple time-series as a unified entity.The literature is categorized both by whether series are modeled individually or jointly and by detection paradigm.
  • Univariate anomaly detection: Classical and neural methods include handcrafted statistical techniques, robust PCA, seasonal tests, variational autoencoders, and convolutional models.The cited methods span hypothesis testing, wavelet analysis, SVD, ARIMA, robust PCA, S-H-ESD, DONUT, and SR-CNN.
  • Forecasting-based models: Forecasting-based models detect anomalies from prediction errors, including LSTM and hierarchical temporal-memory approaches.Examples include LSTM-NDT and a real-time method based on HTM and Bayesian networks.
  • Reconstruction-based models: Reconstruction-based models learn representations by reconstructing the original series from latent variables.Examples include LSTM encoder-decoder, Kitsune, MAD-GAN, GAN-Li, and LSTM-VAE.
  • Complementarity and gap: Forecasting and reconstruction are described as complementary: forecasting specializes in next-timestamp prediction, whereas reconstruction captures entire-series distributions.The paper argues that existing solutions also lack explicit modeling of correlations among multiple features.

III. METHODOLOGY

MTAD-GAT processes fixed-length multivariate windows with convolution, parallel graph-attention layers, recurrent modeling, and jointly optimized forecasting and reconstruction objectives. The methodology explicitly represents feature and temporal relationships.

  • Problem formulation: Multivariate anomaly detection maps an n × k input window to an n-dimensional binary vector labeling anomalous timestamps.Here, n denotes the maximum timestamp length and k the number of input features.
  • Network architecture: The model uses parallel graph-attention networks for inter-feature correlations and temporal dependencies, followed by a GRU for long-term sequential dependencies.A joint objective combines forecasting-based and reconstruction-based learning.
  • Network architecture: A one-dimensional convolution with kernel size 7 first extracts high-level local features before the parallel graph-attention layers process feature and timestamp relationships.The architecture then concatenates representations from the convolutional and graph-attention components.
  • Preprocessing: Normalization uses training-set maximum and minimum values, while data cleaning is applied only to the training set.Normalization is applied to both training and testing data.

2) Data cleaning:

The paper introduces graph attention layers as core designs of MTAD-GAT, with attention scores computed from neighboring node representations and learnable parameters.

  • GAT layers model relationships between nodes in an arbitrary graph and compute an output representation for each node.
  • For node i, the output representation aggregates neighboring node values weighted by attention scores αij.
  • The attention score αij measures node j’s contribution to node i among its adjacent nodes.
  • Attention scores are computed from concatenated node representations using a learnable parameter vector and LeakyReLU.

1) Feature-oriented graph attention layer:

The feature- and time-oriented graph attention layers represent dependencies across features and timestamps, then fuse their outputs with preprocessed inputs for downstream modeling.

  • 1) Feature-oriented graph attention layer:: The feature-oriented layer treats each of k time-series features as a node in a complete graph, using sequential vectors as node representations.
  • 2) Time-oriented graph attention layer:: The time-oriented layer treats timestamps within a sliding window as nodes in a complete graph to capture temporal dependencies.
  • The feature-oriented output has shape k × n, while the time-oriented output has shape n × k.
  • The two graph outputs and preprocessed input are concatenated into an n × 3k matrix representing timestamps.
  • The forecasting model predicts the value at the next timestamp using a GRU followed by three fully connected layers.

2) Reconstruction-based model:

The reconstruction-based component uses a VAE to model entire time-series distributions in a latent space, while inference combines reconstruction probabilities with forecasting errors.

  • 2) Reconstruction-based model:: The reconstruction model uses a VAE to describe entire time-series observations through a latent representation z.
  • The VAE reconstructs input x from the conditional distribution pθ(x|z), representing time-series values in latent space.
  • The recognition model qφ(z|x) approximates the intractable posterior, and the reconstruction loss combines likelihood and KL-divergence terms.
  • For each timestamp, inference produces a forecasting value and a reconstruction probability, then combines them into a feature-level score.
  • The score combines squared forecasting error with abnormal-value probability using hyper-parameter γ.

IV. EXPERIMENTS

MTAD-GAT is evaluated on three datasets using standard anomaly-detection metrics and comparisons with state-of-the-art baselines. It achieves the best F1 scores consistently, with gains linked to explicit feature correlations, temporal dependencies, and complementary forecasting and reconstruction models.

  • Experimental Setup: Three datasets—SMAP, MSL, and TSA—are used to evaluate MTAD-GAT, with precision, recall, and F1-score as primary metrics.AUC is also evaluated but is considered difficult to distinguish because most methods exceed 0.97 AUC.
  • Comparison with SOTAs: MTAD-GAT achieves the best F1 scores consistently across SMAP, MSL, and TSA, improving over the best state-of-the-art results by 1%, 1%, and 9%, respectively.The reported performance lifts are statistically significant according to hypothesis testing.
  • Comparison with SOTAs: Explicit feature-correlation modeling helps MTAD-GAT outperform OmniAnomaly significantly and consistently on all three datasets.The feature-oriented graph attention layer is designed to address OmniAnomaly’s lack of explicit feature-correlation modeling.
  • Comparison with SOTAs: GRU-based temporal modeling and time-oriented graph attention help MTAD-GAT outperform DAGMM, which does not incorporate temporal information.The time-oriented layer calculates attention between correlated timestamps, complementing the GRU’s long-term dependency modeling.
  • Comparison with SOTAs: Forecasting-based methods perform well on SMAP but poorly on MSL and TSA, whereas reconstruction-based methods perform better on MSL and TSA.These contrasting dataset-specific strengths support combining both model types through joint optimization.

D. Evaluation with Different Delays

The delay analysis evaluates whether MTAD-GAT can detect contiguous anomaly segments promptly. Across three datasets, it consistently outperforms OmniAnomaly, especially when only a small detection delay is allowed.

  • Delay Protocol: The delay protocol counts an anomaly segment as correctly detected only when a point is found within δ steps of its first anomaly.This evaluation reflects the practical need to identify continuous incidents quickly.
  • Delay Comparison: Figure 4 compares MTAD-GAT and OmniAnomaly using F1-scores under different delay constraints across three datasets.F1 increases as the allowable delay δ grows and eventually matches the unconstrained results in Table III.
  • Delay Comparison: At δ = 10, MTAD-GAT’s relative enhancements are 53.98%, 13.04%, and 19.93% on the three datasets.The reported gains are relative improvements over OmniAnomaly under the same delay constraint.
  • Delay Comparison: MTAD-GAT shows better performance consistently, with the largest advantage when the acceptable detection delay is small.Performance also improves on all three datasets when the delay increases from 5 to 10.
  • Graph Attention Analysis: Removing the feature-oriented GAT layer lowers average F1 by 3.2%, while removing the time-oriented layer lowers it by 2.5%.On TSA, removing the feature-oriented layer causes a 4.8% relative F1 drop; the time-oriented layer can model nonadjacent timestamp relationships.
  • Interpretability: Attention scores for DATA SENT FROM FLINK are visualized for normal and anomalous timestamps, with darker colors indicating higher scores.The feature-oriented layer learns relevant feature relationships under normal conditions.

B. Effectiveness of Joint Optimization

The joint optimization analysis tests whether forecasting and reconstruction should be trained together. The results show that each single-objective variant degrades the full model, while the two objectives address different anomaly patterns.

  • Joint Optimization: The reconstruction-only variant outperforms the forecasting-only variant, but both perform significantly worse than the jointly optimized model.This comparison is based on controlled F1-score experiments.
  • Model Complementarity: Forecasting predicts the next timestamp deterministically and is sensitive to time-series randomness, whereas reconstruction learns stochastic latent distributions and is more robust to noise.The two approaches therefore exhibit complementary strengths.
  • Model Complementarity: A reconstruction-based variant can miss periodicity-breaking anomalies when anomalous values still conform to the normal distribution.In the illustrated failure case, the forecasting-based variant detects the anomaly that reconstruction misses.
  • Joint Optimization: The joint optimization target combines forecasting and reconstruction to improve anomaly detection across these contrasting cases.The evidence attributes the benefit to the complementary behavior of the two objectives.

C. Analysis of γ

The paper examines the robustness of the weighting parameter γ and the model’s ability to support anomaly diagnosis. Performance is stable across a broad γ range, while attention-derived scores identify likely root-cause features.

  • Analysis of γ: Different γ settings produce similar precision, recall, and F1 scores on TSA, with γ = 0.8 giving the best performance.The parameter balances forecasting-based error against reconstruction-based probability.
  • Analysis of γ: Setting γ between 0.4 and 1.0 consistently yields better results than other state-of-the-art methods, indicating robustness to γ.The reported robustness concerns the evaluated TSA metrics and parameter range.
  • Anomaly Diagnosis: Anomaly diagnosis ranks features by inference scores and selects the top features as predicted root causes.The method computes one inference score per feature and uses the largest scores for ranking.
  • Anomaly Diagnosis: On TSA, more than 700 qualified test instances with clear incident-record root causes are labeled for diagnostic evaluation.HitRate@P% and NDCG measure root-cause inclusion and ranking accuracy.
  • Anomaly Diagnosis: The model captures 70% of true root causes in its diagnosis results and shows strong top-5 root-cause ranking performance.The authors connect this diagnostic capability to graph attention’s modeling of feature correlations.

VI. CASE STUDY

The case study shows MTAD-GAT avoiding false alarms when coordinated metric spikes preserve feature relationships, while also producing a false positive on a rare benign traffic peak.

  • True negative case: Coordinated spikes in Flink traffic metrics can be normal when feature correlations remain unchanged and CPU and GC stay stable.The increased traffic reflected more processed data rather than an unhealthy system state.
  • True negative case: MTAD-GAT avoids a false alarm in a healthy system where univariate detectors might incorrectly flag simultaneous metric spikes.The case involves DATA SENT FROM FLINK and DATA PROCESSED ON FLINK increasing while CPU and GC remain stable.
  • False positive case: A rare, short-lived traffic peak causes MTAD-GAT to falsely detect anomalies in FLINK CHECKPOINT DURATION and CPU.Related metrics show the same input-volume pattern, but the event is not considered anomalous because the peak quickly ends.
  • False positive case: The false positive illustrates that unsupervised detection can treat unusual historical events as abnormal even when domain context indicates normal behavior.The authors identify domain knowledge or user feedback as a possible direction for addressing this case.
  • Case-study implication: The conclusion reports that the approach decreases false alerts substantially in the monitoring system and supports anomaly diagnosis.The paper also notes that more complicated diagnosis scenarios remain a future direction.
Loading 2009.02040v1…