Abstract:Anomaly detection in multivariate time series has been widely studied in one-class classification (OCC) setting. The training samples in this setting are assumed to be normal. In more practical situations, it is difficult to guarantee that all samples are normal. Meanwhile, preparing a completely clean training dataset is costly and laborious. Such a case may degrade the performance of OCC-based anomaly detection methods which fit the training distribution as the normal distribution. To overcome this limitation, in this paper, we propose MTGFlow, an unsupervised anomaly detection approach for Multivariate Time series anomaly detection via dynamic Graph and entity-aware normalizing Flow. MTGFlow first estimates the density of the entire training samples and then identifies anomalous instances based on the density of the test samples within the fitted distribution. This relies on a widely accepted assumption that anomalous instances exhibit more sparse densities than normal ones, with no reliance on the clean training dataset. However, it is intractable to directly estimate the density due to the complex dependencies among entities and their diverse inherent characteristics, not to mention detecting anomalies based on the estimated distribution. In order to address these problems, we utilize the graph structure learning model to learn interdependent and evolving relations among entities, which effectively captures the complex and accurate distribution patterns of multivariate time series. In addition, our approach incorporates the unique characteristics of individual entities by employing an entity-aware normalizing flow. This enables us to represent each entity as a parameterized normal distribution. Furthermore, considering that some entities present similar characteristics, we propose a cluster strategy that capitalizes on the commonalities of entities with similar characteristics, resulting in more precise and detailed density estimation. We refer to this cluster-aware extension as MTGFlow_cluster. Extensive experiments are conducted on six widely used benchmark datasets, in which MTGFlow and MTGFlow_cluster demonstrate their superior detection performance.

InfoFlow: A Transformer-based Time Series Anomaly Detection Model with Information Bottleneck and Normalizing Flows

Graph-Augmented Normalizing Flows for Anomaly Detection of Multiple Time Series

Label-Free Multivariate Time Series Anomaly Detection

TCF-Trans: Temporal Context Fusion Transformer for Anomaly Detection in Time Series

Detecting Multivariate Time Series Anomalies with Zero Known Label

Normalizing flows for novelty detection in industrial time series data

Anomaly Transformer: Time Series Anomaly Detection with Association Discrepancy

Anomaly Detection in Time Series Data Using Reversible Instance Normalized Anomaly Transformer

Anomaly Detection for Time Series Data Stream

SGFM: Conditional Flow Matching for Time Series Anomaly Detection With State Space Models

LGAT: A Novel Model for Multivariate Time Series Anomaly Detection with Imporved Anomaly Transformer and Learning Graph Structures

Multivariate Time Series Anomaly Detection with Fourier Time Series Transformer

MSFlow: Multi-Scale Flow-based Framework for Unsupervised Anomaly Detection

VQ-Flow: Taming Normalizing Flows for Multi-Class Anomaly Detection via Hierarchical Vector Quantization

SiET: Spatial information enhanced transformer for multivariate time series anomaly detection

FluxEV: A Fast and Effective Unsupervised Framework for Time-Series Anomaly Detection

FastFlow: Unsupervised Anomaly Detection and Localization via 2D Normalizing Flows

What Information Contributes to Log-based Anomaly Detection? Insights from a Configurable Transformer-Based Approach

Learnable Flow Model Conditioned on Graph Representation Memory for Anomaly Detection

Probabilistic Temporal Fusion Transformers for Large-Scale KPI Anomaly Detection