Source-linked AI summary
Graph Neural Network-Based Anomaly Detection in Multivariate Time Series
Ailin Deng, Bryan Hooi
TL;DR
High-dimensional sensor time series require anomaly detection that captures complex inter-sensor relationships, while existing methods generally do not explicitly learn those relationships. GDN combines sensor embeddings, learned graph structure, graph attention-based forecasting, and deviation scoring; experiments on two real-world datasets show greater accuracy than baselines and interpretable anomaly localization. The method assumes training data contain only normal observations.
Problem
High-dimensional sensor data contain complex inter-sensor relationships, but existing anomaly-detection methods generally do not explicitly learn the sensor graph or use it to predict expected behavior.
Method
GDN combines sensor embeddings, graph structure learning, graph attention-based forecasting, and graph deviation scoring to model sensor relationships and detect deviations.
Results
Experiments on two real-world sensor datasets show that GDN outperforms baseline methods in anomaly-detection accuracy and provides interpretable models that help localize and understand anomalies.
Takeaways & Limitations
Learned graphs, sensor embeddings, and attention mechanisms support accurate anomaly detection and explanations based on sensor relationships and deviations.
Takeaways & Limitations
Training data are assumed to consist only of normal data, reflecting the unsupervised anomaly-detection formulation.
Abstract
from arXiv · showhide
Given high-dimensional time series data (e.g., sensor data), how can we detect anomalous events, such as system faults and attacks? More challengingly, how can we do this in a way that captures complex inter-sensor relationships, and detects and explains anomalies which deviate from these relationships? Recently, deep learning approaches have enabled improvements in anomaly detection in high-dimensional datasets; however, existing methods do not explicitly learn the structure of existing relationships between variables, or use them to predict the expected behavior of time series. Our approach combines a structure learning approach with graph neural networks, additionally using attention weights to provide explainability for the detected anomalies. Experiments on two real-world sensor datasets with ground truth anomalies show that our method detects anomalies more accurately than baseline approaches, accurately captures correlations between sensors, and allows users to deduce the root cause of a detected anomaly.
1 Introduction
GDN addresses unsupervised anomaly detection in high-dimensional sensor data by learning inter-sensor relationships and detecting deviations from them. Experiments on two water-treatment datasets show improved detection accuracy and explainability.
- Motivation: Interconnected CPS sensors generate complex, high-dimensional time series that are increasingly difficult for humans to monitor manually.Automated methods must detect anomalies rapidly and help operators diagnose and respond to them.
- Research gap: Existing classical and deep-learning methods generally do not explicitly learn which sensors are related to one another.This limits their ability to model sensor relationships in multivariate time series.
- Approach: GDN learns a graph of sensor dependence relationships and detects deviations from those learned patterns.Its components include sensor embeddings, graph structure learning, graph attention-based forecasting, and graph deviation scoring.
- Evaluation: Experiments on two water-treatment datasets with ground-truth anomalies show that GDN detects anomalies more accurately than baseline approaches.The datasets are SWaT and WADI, which record simulated attack scenarios in water-treatment test beds.
- Explainability: GDN uses attention weights, learned subgraphs, and comparisons between predicted and actual sensor behavior to explain detected anomalies.Case studies show that these representations help users interpret deviations and localize anomalies.
2 Related Work
Prior work includes classical, deep-learning, and graph-based approaches for anomaly detection and multivariate time-series modeling. GDN focuses on explicitly learning sensor relationships for nonlinear, potentially non-stationary sensor data.
- Anomaly Detection: Related anomaly-detection methods include classical density, linear-model, distance-based, classification, ensemble, and deep-learning approaches.Autoencoders use reconstruction error as an anomaly score, while variational and Gaussian-mixture variants provide related probabilistic approaches.
- Multivariate Time Series Modelling: Multivariate time-series methods model series from their past behavior using autoregressive, ARIMA, CNN, LSTM, and GAN approaches.Classical autoregressive and ARIMA models are linear, whereas deep-learning methods target nonlinear high-dimensional time series.
- Graph-Based Methods: Graph-based methods represent sensor interdependencies with edges, but many existing approaches target stationary time series and struggle with complex, highly non-stationary sensor settings.Probabilistic graphical models are one example of this graph-based strategy.
- Graph Neural Networks: GNNs model node states using neighboring nodes, with graph attention networks assigning different weights to different neighbors.These approaches can represent complex graph-structured patterns.
- Research Gap: Standard GNNs use shared parameters across nodes and typically require a graph as input, but sensor graphs may be unknown and sensor behaviors may differ substantially.GDN therefore targets explicit graph learning for multivariate time series.
3 Proposed Framework
GDN learns sensor characteristics and directed dependence relationships, then uses graph-attention forecasting to predict sensor values and identify, localize, and explain deviations from expected behavior.
- 3.1 Problem Statement: The framework assumes normal multivariate sensor data for training and detects binary anomaly labels at each test time tick.Training data contains N sensors over Ttrain ticks, while testing uses the same sensors over Ttest separate ticks.
- 3.2 Sensor Embedding: Sensor embeddings capture unique characteristics, guide graph structure learning, and support heterogeneous attention over different sensor types.Similarity between embeddings indicates behavioral similarity and is used both to determine related sensors and to weight neighbors.
- 3.4 Graph Structure Learning: The learned directed graph represents asymmetric sensor dependencies, selecting top-k candidate relations using normalized embedding similarity.Candidate relations may be unrestricted or constrained by prior information, and k controls the desired graph sparsity.
- 3.5 Graph Attention-Based Forecasting: Graph attention forecasting aggregates each sensor’s information with learned neighbors and predicts current sensor values from a historical sliding window.The feature extractor incorporates sensor embeddings, and the model uses mean squared error between predicted and observed outputs for training.
- 3.6 Graph Deviation Scoring: Graph deviation scoring compares predicted and observed sensor behavior, producing per-sensor scores and a combined time-tick score to localize anomalies.The framework is designed to identify which sensors deviate, how they deviate, and why by comparing expected and observed behavior.
4 Experiments
The experiments evaluate GDN on two water-treatment sensor datasets with ground-truth attack anomalies, using normal-operation data for training and controlled attacks for testing.
- Experiments address accuracy, ablation, interpretability, and anomaly-localization questions for GDN.
- 4.1 Datasets: The evaluation uses SWaT and WADI, two water-treatment test-bed datasets with operator-simulated attacks recorded as ground-truth anomalies.
- 4.1 Datasets: SWaT models a smaller water-treatment CPS, whereas WADI extends it to a larger water-distribution network with more pipelines.
- 4.1 Datasets: Each dataset provides two weeks of normal-operation data for training, followed by controlled physical attacks that form test-set anomalies.
- 4.1 Datasets: Samples are downsampled to one median measurement every 10 seconds, labels use the most common 10-second label, and the first 2160 samples are removed.
4.2 Baselines
The study compares GDN with classical, ensemble, autoencoding, recurrent variational, and generative adversarial anomaly detectors.
- The baselines include PCA, KNN, Feature Bagging, Autoencoders, DAGMM, LSTM-VAE, and MAD-GAN.
- PCA scores anomalies by reconstruction error after projecting data into a low-dimensional space that captures most variance.
- KNN uses each observation’s distance to its kth nearest neighbor as its anomaly score.
- Feature Bagging fits detectors on different dataset subsamples and aggregates their anomaly scores.
- AE, DAGMM, and LSTM-VAE use reconstruction-based scoring, with DAGMM adding Gaussian-mixture modeling and LSTM-VAE adding recurrent dynamics.
- MAD-GAN trains on normal data and combines an LSTM-RNN discriminator with reconstruction to compute sample anomaly scores.
4.3 Evaluation Metrics
Performance is evaluated with precision, recall, and F1-Score against ground-truth labels, using a validation-derived anomaly threshold.
- Precision, recall, and F1-Score evaluate GDN and baselines over the test dataset against ground-truth values.
- F1-Score is defined as F1 = 2×Prec×Rec / (Prec+Rec), with precision and recall computed from true- and false-positive counts.
- Because the datasets are unbalanced, the study uses precision, recall, and F1-Score as suitable evaluation metrics.
- The anomaly threshold is the maximum validation-set anomaly score; test time steps above it are classified as anomalous.
4.4 Experimental Setup
The setup implements GDN and variants in PyTorch with PyTorch Geometric, trains with Adam and early stopping, and compares accuracy across SWaT and WADI.
- GDN and its variants are implemented in PyTorch 1.5.1 with CUDA 10.2 and PyTorch Geometric 1.5.0.
- Table 2 reports precision(%), recall(%), and F1-score for GDN and baselines on two datasets with ground-truth labelled anomalies.
- Training uses Adam with learning rate 1 × 10^-3, runs for up to 50 epochs, and applies early stopping with patience 10.
- Embedding, neighborhood, and hidden-layer sizes differ between WADI and SWaT to reflect their different input dimensionalities.
- GDN achieves precision 0.99 on SWaT and 0.98 on WADI, outperforms baselines on SWaT F-measure, and has 54% higher F-measure than the next-best WADI baseline.
4.6 RQ2. Ablation
The ablation study shows that learned graph structure, sensor embeddings, and graph attention each contribute to GDN’s anomaly-detection accuracy. Removing attention causes the largest degradation, while replacing the learned graph is especially harmful on WADI.
- 4.6 RQ2. Ablation: Replacing the learned graph with a complete graph degrades performance on both datasets, especially WADI.The comparison evaluates whether explicitly learning sensor relationships is necessary.
- 4.6 RQ2. Ablation: Removing sensor embeddings from the attention mechanism underperforms the original model on both datasets.The authors attribute this to embeddings improving the learning of graph-attention weight coefficients.
- 4.6 RQ2. Ablation: Removing attention produces the largest performance degradation in the experiments.Equal weighting of all neighbors introduces noise because sensors exhibit different behaviors.
- 4.6 RQ2. Ablation: Together, the ablations indicate that graph structure learning, sensor embeddings, and attention mechanisms all contribute to GDN’s accuracy.These components jointly explain the model’s better performance over baseline methods.
4.7 RQ3. Interpretability of Model
GDN supports interpretability through sensor embeddings, learned graph edges, and attention weights. Embedding similarity reveals groups of sensors with similar behavior, while edges and weights identify related and influential neighbors.
- 4.7 RQ3. Interpretability of Model: Sensor-embedding similarity indicates similarity between sensors’ behaviors and allows users to identify groups with similar behavior.The embeddings can be visualized with t-SNE to inspect these groupings.
- 4.7 RQ3. Interpretability of Model: The WADI embedding visualization shows localized clusters that reflect the behavior similarity of sensors in the corresponding classes.A circled cluster contains two FIC x01 CO sensors measuring similar indicators.
- 4.7 RQ3. Interpretability of Model: Learned graph edges indicate which sensors are related, while attention weights indicate each neighbor’s importance for modeling a node’s behavior.The learned graph and weights are used in a subsequent anomaly-localization case study.
4.8 RQ4. Localizing Anomalies
GDN localizes anomalies through individual anomaly scores and explains them using related sensors’ attention weights and predicted-versus-observed behavior. In the WADI case study, this exposes how false flow-sensor readings violated a learned valve-flow relationship.
- 4.8 RQ4. Localizing Anomalies: The WADI case study examines a false-reading attack on flow sensor 1 FIT 001 PV, whose readings remain within its normal range.This makes the attack nontrivial to detect from the attacked sensor alone.
- 4.8 RQ4. Localizing Anomalies: GDN identifies 1 MV 001 STATUS as the sensor with the highest anomaly score during the attack period.The result demonstrates localization through individual sensor anomaly scores.
- 4.8 RQ4. Localizing Anomalies: The highest-attention neighbors reveal that 1 FIT 001 PV and 1 MV 001 STATUS are closely related through the valve-flow relationship.The valve status controls the flow measured by the attacked sensor.
- 4.8 RQ4. Localizing Anomalies: Comparing predicted and observed values shows that GDN expected 1 MV 001 STATUS to increase, but the attack produced no change and a large detection error.The prediction was based on the learned tendency of the related sensors to increase together.
5 Conclusion
The paper concludes that GDN learns sensor relationships and detects deviations from them while incorporating sensor embeddings. Experiments show improved accuracy, interpretability, and anomaly localization and understanding.
- 5 Conclusion: GDN learns a graph of relationships between sensors, detects deviations from those patterns, and incorporates sensor embeddings.The approach is evaluated on two real-world sensor datasets.
- 5 Conclusion: Experiments on two real-world sensor datasets show that GDN outperforms baselines in accuracy and helps users interpret, localize, and understand anomalies.The paper identifies additional architectures and online training methods as future directions for improving practicality.