基于启发式时空图神经网络的多变量时序异常检测

Multivariable time series anomaly detection using heuristic spatio-temporal graph neural network

针对信息物理系统的多变量时序数据的异常检测是预防系统故障、保证安全生产的必要手段.由于系统变量间的强耦合性和传播效应,设计异常检测算法时应考虑系统变量间的耦合特性、传播有向性和因果时滞性,从系统结构变化的角度检测早期异常.本文提出一种端到端的启发式时空图神经网络(heuristic spatio-temporal graph neural network, HST-GNN)用于多变量时序数据的异常检测.首先,考虑变量间关系的有向性和集群性,设计一种有向相似性函数和基于启发式聚类算法的图结构学习算法,对多变量时序数据进行图建模以学习变量间的空间耦合关系;其次,使用门控卷积注意单元和多头图注意层作为时空图注意模块,从时空层面同时捕获系统的非线性因果时序和空间耦合深度特征;最后,量化系统的图结构特征,将其作为时空图网络提取的传感器深度特征的补充,输入自编码器中,从系统级别和传感器级别来检测异常.本文在4个公共数据集上验证了HST-GNN的性能.实验结果表明,稀疏有向的图结构有利于系统耦合特性的提取,从系统和传感器级别检测异常增加了模型对不显著的早期异常的敏感度.

Anomaly detection for multivariable time series in cyber-physical systems is crucial for preventing system failures and ensuring safe production. The presence of strong coupling between system variables and propagation effects imparts pronounced spatio-temporal characteristics to anomalies. Designing an effective anomaly detection algorithm necessitates consideration of the coupling relationships, propagation directionality,and causal time delays among variables. Furthermore, it is essential to account for the coupling relationships between variables when detecting anomalies from a system perspective. In this study, we propose an end-to-end heuristic spatio-temporal graph neural network(HST-GNN) for the detection of anomalies in multivariate time series(MTS) data. First, we address the directed and clustered inter-variable relationships by designing a directed similarity function and a heuristic clustering algorithm. These components contribute to learning the graph structure required for analyzing MTS data. Subsequently, we employ a combination of gated convolutional attention units and a multihead graph attention layer as a spatio-temporal graph attention module. This module facilitates the simultaneous capture of nonlinear causal temporal and spatially coupled features. Finally, the graph structure features of the system are quantified and used as a complement to the depth features extracted by the spatio-temporal graph attention module. These concatenated features are then fed into an autoencoder for detecting anomalies at both the system and sensor levels. The performance of HST-GNN is verified using four public datasets. Our results highlight the advantages of utilizing a sparse directed graph structure for extracting system coupling characteristics. Additionally, the detection of anomalies at both the system and sensor levels enhances the model's sensitivity to early, albeit potentially insignificant anomalies.