面向多变量时间序列异常检测的双图注意力网络模型

doi:10.3778/j.issn.1673-9418.2405053

摘要/Abstract

摘要： 时间序列异常检测在时序任务中属于经典研究领域，并已在学术界和工业界取得了一系列研究成果。针对多变量时间序列数据中蕴含的多角度深层特征和内在复杂依赖关系，提出一种融合时空特征的异常检测模型。该模型采用图注意力网络结构，由时间图模块（T-GAT）和空间图模块（F-GAT）组成。T-GAT构建一种单向加权图，图的边表示时间依赖特性，以此来模拟时间图结构的先验信息并融入图网络中获取时间依赖关系。F-GAT将时间序列转换为以幅值表示的频域序列，通过建立全局双向加权图来模拟多变量之间的关联关系，并通过正则化来维护邻居节点的稀疏性，以此来保证对空间关系的准确捕捉。同时模型引入多维注意力机制确保对不同特征的深层信息进行有效挖掘和利用。由门控循环单元进一步处理时空信息并融合为全面特征，并通过预测值与观测值的差异来判定异常。实验结果表明，该模型以4个公共数据集上优异的F1分数在12个对比模型中实现先进的性能，并在消融实验中证实了同时建模时空关系的先验双图结构模式和注意力机制有效提升了异常检测精度，可以有效地识别时间序列数据中的异常情况。

关键词: 多变量时间序列, 异常检测, 深度学习, 时空信息, 图注意力网络

Abstract: Time series anomaly detection is a well-established research area within sequential tasks, achieving significant results in both academia and industry. Addressing the multi-dimensional deep features and complex inherent dependencies in multivariate time series data, a novel anomaly detection model integrating spatiotemporal features is proposed. The model employs a graph attention network structure composed of a temporal graph attention network (T-GAT) and a spatial graph attention network (F-GAT). T-GAT constructs a unidirectional weighted graph where edges represent temporal dependencies, simulating prior information about the temporal graph structure and integrating it into the network to capture time-related relationships. F-GAT converts time series into frequency domain sequences represented by amplitudes and establishes a global bi-directional weighted graph to simulate associations between multivariate elements, using regularization to maintain sparsity among neighboring nodes and ensure accurate capture of spatial relationships. The model incorporates a multi-dimensional attention mechanism to effectively mine and utilize deep features across different characteristics. A gated recurrent unit further processes the spatiotemporal information, integrating it into comprehensive features, with anomalies identified by differences between predicted and observed values. Experimental results on four public datasets demonstrate that the model achieves advanced performance among twelve comparison models with superior F1 scores, and ablation studies confirm that the dual graph structure and attention mechanisms significantly enhance anomaly detection accuracy, effectively identifying anomalies in time series data.

Key words: multivariate time series, anomaly detection, deep learning, spatiotemporal information, graph attention networks

李汉章, 严宣辉, 李镇力, 严雨薇, 王廷银. 面向多变量时间序列异常检测的双图注意力网络模型[J]. 计算机科学与探索, 2025, 19(4): 1048-1064.

LI Hanzhang, YAN Xuanhui, LI Zhenli, YAN Yuwei, WANG Tingyin. Dual Graph Attention Model for Multivariate Time Series Anomaly Detection[J]. Journal of Frontiers of Computer Science and Technology, 2025, 19(4): 1048-1064.

参考文献

[1] BASU S. Machine learning and visualizations for time-series healthcare data[C]//Proceedings of the 2023 IEEE 11th International Conference on Healthcare Informatics. Piscataway: IEEE, 2023: 485.
[2] HUSáK M, KOMáRKOVá J, BOU-HARB E, et al. Survey of attack projection, prediction, and forecasting in cyber security[J]. IEEE Communications Surveys & Tutorials, 2019, 21(1): 640-660.
[3] PALIT A K, POPOVIC D. Computational intelligence in time series forecasting: theory and engineering applications[M]. London: Springer, 2005.
[4] SEZER O B, GUDELEK M U, OZBAYOGLU A M. Financial time series forecasting with deep learning: a systematic literature review: 2005—2019[J]. Applied Soft Computing, 2020, 90: 106181.
[5] BLáZQUEZ-GARCíA A, CONDE A, MORI U, et al. A review on outlier/anomaly detection in time series data[J]. ACM Computing Surveys, 2021, 54(3): 1-33.
[6] HUNDMAN K, CONSTANTINOU V, LAPORTE C, et al. Detecting spacecraft anomalies using LSTMs and nonparametric dynamic thresholding[C]//Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. New York: ACM, 2018: 387-395.
[7] CHEN Z K, CHEN D S, ZHANG X, et al. Learning graph structures with transformer for multivariate time-series anomaly detection in IoT[J]. IEEE Internet of Things Journal, 2022, 9(12): 9179-9189.
[8] BRAUCKHOFF D, SALAMATIAN K, MAY M. Applying PCA for traffic anomaly detection: problems and solutions[C]//Proceedings of the IEEE INFOCOM 2009. Piscataway: IEEE, 2009: 2866-2870.
[9] HUANG T, ZHU Y, ZHANG Q N, et al. An LOF-based adaptive anomaly detection scheme for cloud computing[C]//Proceedings of the 2013 IEEE 37th Annual Computer Software and Applications Conference Workshops. Piscataway: IEEE, 2013: 206-211.
[10] MENG J L, SHANG H K, BIAN L. The application on intrusion detection based on K-means cluster algorithm[C]//Proceedings of the 2009 International Forum on Information Technology and Applications. Piscataway: IEEE, 2009: 150- 152.
[11] MA J, PERKINS S. Time-series novelty detection using one-class support vector machines[C]//Proceedings of the 2003 International Joint Conference on Neural Networks. Piscataway: IEEE, 2003: 1741-1745.
[12] PANG G S, SHEN C H, CAO L B, et al. Deep learning for anomaly detection: a review[J]. ACM Computing Surveys, 2021, 54(2): 1-38.
[13] MUNIR M, SIDDIQUI S A, DENGEL A, et al. DeepAnT: a deep learning approach for unsupervised anomaly detection in time series[J]. IEEE Access, 2018, 7: 1991-2005.
[14] SU Y, ZHAO Y J, NIU C H, et al. Robust anomaly detection for multivariate time series through stochastic recurrent neural network[C]//Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. New York: ACM, 2019: 2828-2837.
[15] LI D, CHEN D C, JIN B H, et al. MAD-GAN: multivariate anomaly detection for time series data with generative adversarial networks[C]//Proceedings of the 28th International Conference on Artificial Neural Networks. Cham: Springer, 2019: 703-716.
[16] TULI S, CASALE G, JENNINGS N R. TranAD: deep transformer networks for anomaly detection in multivariate time series data[J]. Proceedings of the VLDB Endowment, 2022, 15(6): 1201-1214.
[17] DENG A L, HOOI B. Graph neural network-based anomaly detection in multivariate time series[J]. Proceedings of the AAAI Conference on Artificial Intelligence, 2021, 35(5): 4027-4035.
[18] BAI Y F, WANG J, ZHANG X E, et al. CrossFuN: multiview joint cross-fusion network for time-series anomaly detection[J]. IEEE Transactions on Instrumentation and Measurement, 2023, 72: 1-9.
[19] ZHAO H, WANG Y J, DUAN J Y, et al. Multivariate time-series anomaly detection via graph attention network[C]//Proceedings of the 2020 IEEE International Conference on Data Mining. Piscataway: IEEE, 2020: 841-850.
[20] MATHUR A P, TIPPENHAUER N O. SWaT: a water treatment testbed for research and training on ICS security[C]//Proceedings of the 2016 International Workshop on Cyber-physical Systems for Smart Water Networks. Piscataway: IEEE, 2016: 31-36.
[21] AHMED C M, PALLETI V R, MATHUR A P. WADI: a water distribution testbed for research in the design of secure cyber physical systems[C]//Proceedings of the 3rd International Workshop on Cyber-Physical Systems for Smart Water Networks. New York: ACM, 2017: 25-28.
[22] O’NEILL P, ENTEKHABI D, NJOKU E, et al. The NASA soil moisture active passive (SMAP) mission: overview[C]//Proceedings of the 2010 IEEE International Geoscience and Remote Sensing Symposium. Piscataway: IEEE, 2010: 3236-3239.
[23] SENGUPTA A, STELTZNER A, WITKOWSKI A, et al. An overview of the Mars science laboratory parachute decelerator system[C]//Proceedings of the 2007 IEEE Aerospace Conference. Piscataway: IEEE, 2007: 1-8.
[24] ZONG B, SONG Q, MIN M R, et al. Deep autoencoding Gaussian mixture model for unsupervised anomaly detection[C]//Proceedings of the 6th International Conference on Learning Representations, 2018.
[25] LAI G K, CHANG W C, YANG Y M, et al. Modeling long- and short-term temporal patterns with deep neural networks[C]//Proceedings of the 41st International ACM SIGIR Conference on Research & Development in Information Retrieval. New York: ACM, 2018: 95-104.
[26] HOCHREITER S, SCHMIDHUBER J. Long short-term memory[J]. Neural Computation, 1997, 9(8): 1735-1780.
[27] PARK D, HOSHI Y, KEMP C C. A multimodal anomaly detector for robot-assisted feeding using an LSTM-based variational autoencoder[J]. IEEE Robotics and Automation Letters, 2018, 3(3): 1544-1551.
[28] CHUNG J, GULCEHRE C, CHO K, et al. Empirical evaluation of gated recurrent neural networks on sequence modeling[EB/OL]. [2024-02-20]. https://arxiv.org/abs/1412.3555.
[29] AUDIBERT J, MICHIARDI P, GUYARD F, et al. USAD[C]//Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. New York: ACM, 2020: 3395-3404.
[30] REN H S, XU B X, WANG Y J, et al. Time-series anomaly detection service at microsoft[C]//Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. New York: ACM, 2019: 3009-3017.
[31] ZHANG C L, ZHOU T, WEN Q S, et al. TFAD: a decomposition time series anomaly detection architecture with time-frequency analysis[C]//Proceedings of the 31st ACM International Conference on Information & Knowledge Management. New York: ACM, 2022: 2497-2507.
[32] WANG J, SHAO S K, BAI Y F, et al. Multiscale wavelet graph autoencoder for multivariate time-series anomaly detection[J]. IEEE Transactions on Instrumentation and Measurement, 2022, 72: 2502911.
[33] JIN M, KOH H Y, WEN Q S, et al. A survey on graph neural networks for time series: forecasting, classification, imputation, and anomaly detection[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2024, 46(12): 10466-10485.
[34] HO T K K, KARAMI A, ARMANFARD N. Graph-based time-series anomaly detection: a survey[EB/OL]. [2024-02-20]. https://arxiv.org/abs/2302.00058.
[35] DING C Y, SUN S L, ZHAO J. MST-GAT: a multimodal spatial-temporal graph attention network for time series anomaly detection[J]. Information Fusion, 2023, 89: 527-536.
[36] ANGIULLI F, PIZZUTI C. Fast outlier detection in high dimensional spaces[C]//Proceedings of the 6th European Conference on Principles of Data Mining and Knowledge Discovery. Berlin, Heidelberg: Springer, 2002: 15-27.
[37] AGGARWAL C C. An introduction to outlier analysis[M]//Outlier analysis. Cham: Springer, 2017: 1-33.
[38] CHEN K, FENG M, WIRJANTO T S. Multivariate time series anomaly detection via dynamic graph forecasting[EB/OL]. [2024-02-20]. https://arxiv.org/abs/2302.02051.
[39] ZHANG W Q, ZHANG C, TSUNG F. GRELEN: multivariate time series anomaly detection from the perspective of graph relational learning[C]//Proceedings of the 31st International Joint Conference on Artificial Intelligence. Palo Alto: AAAI, 2022: 2390-2397.

编辑推荐 0

Metrics

阅读次数

全文

HTML			PDF

最新录用	在线预览	正式出版	最新录用	在线预览	正式出版
0	0	0	12	0	42

	来源	本网站

	次数	54
	比例	100%

摘要

最新录用	在线预览	正式出版

20	0	27

	来源	本网站

	次数	47
	比例	100%