结合重构和图预测的多元时序异常检测框架

Combining Reconstruction and Graph Prediction for Multi-Dimensional Time Series Anomaly Detection Framework

高维时序异常检测一直是智能系统安全领域的重要挑战,主流解决方案通常使用基于数据降维的重构方法和基于时序建模的预测方法,但这些方法没有结合特征间相互影响和特征内时间关联进行学习,且大多使用点估计方法进行预测或重构,从而影响了异常检测的准确性。结合预测和重构的优点,考虑序列的整体分布,提出了一种新颖的端到端异常检测框架。设计改进的变分自动编码器重构模块,以学习原始时序数据中的特征内时间关联,同时得到编码后的低维表示。设计估计高斯分布的图神经网络预测模块,结合重构模块的低维表示和原始输入进行图结构学习,以捕捉特征间的结构依赖。模型采用异常评分模块联合重构和预测模块的损失,在考虑序列整体分布的基础上进行时空联合表征。为验证所提出模型的性能,在三个工业数据集上对模型进行了对比实验,与基线模型相比,所提出的模型在F1性能指标上表现良好。

High-dimensional time series anomaly detection has been a significant challenge in the field of intelligent system security.Existing mainstream solutions often rely on data dimensionality reduction for reconstruction or time series modeling for prediction.However,these methods lack the integration of inter-feature interactions and intra-feature temporal dependencies,and mostly utilize point estimation,thereby compromising the accuracy of anomaly detection.This paper proposes a novel end-to-end anomaly detection framework that combines the advantages of prediction and reconstruction,considering the overall distribution of sequences.Firstly,an improved variational autoencoder reconstruction module is designed to learn intra-feature temporal dependencies and obtain a low-dimensional encoded representation.Secondly,a graph neural network prediction module estimates Gaussian distributions,integrating the low-dimensional representation from the reconstruction module and the original input for capturing inter-feature structural dependencies.Lastly,the model employs an anomaly scoring module that combines the losses of the reconstruction and prediction modules,enabling spatiotemporal joint representation while considering the overall distribution of sequences.To validate the performance of the proposed model,comparative experiments are conducted on three industrial datasets,demonstrating its superior performance in terms of the F1 metric compared to baseline models.