MAD-SGS: Multivariate Anomaly Detection with Multi-scale Self-learned Graph Structures

Junnan Tang,Dan Li,Zibin Zheng
DOI: https://doi.org/10.1007/978-981-97-2275-4_2
2024-01-01
Abstract:Cyber-Physical Systems (CPSs) integrate sensing, computation, cybernetics, and networking to control a hybrid physical system consisting of different functional subsystems. Accurate and efficient anomaly detection for Multivariate Time Series (MTS) with rich temporal and spatial information generated by highly intertwined sensors and actuators in CPS to reduce the negative influence caused by abnormalities. Since existing methods with temporal modeling cannot effectively recognize anomalies without sufficiently utilizing spatial correlations conveyed by MTS data, Graph Convolution Networks (GCNs) have recently been exploited to extract spatial correlations in MTS data. However, most previous works that utilized spatial information focused on learning static long-term graph structures and did not explore the potential variations of short-term spatial correlations. This paper proposed a Multivariate Anomaly Detection framework with multi-scale Self-learned Graph Structures (MAD-SGS) based on the Variational Autoencoder (VAE) architecture. Specifically, the Long Short-Term Memory (LSTM) was applied to extract and exploit the temporal information, and the Graph Convolution Network (GCN) was employed to exploit spatial correlations at different scales (the long-term static correlation and short-term dynamic correlation). Besides, we utilized a self-learning approach for long-term graph static structure learning and employed feature similarity to learn short-term dynamic graph structures. The proposed MAD-SGS framework was tested on four datasets collected from three real-world CPSs: the Secure Water Treatment (SWaT), the Water Distribution (WADI), and the BATtle of Attack Detection Algorithm (BATADAL) datasets. Experimental results indicated that the proposed MAD-SGS outperformed the state-of-the-art methods.
What problem does this paper attempt to address?