Multivariate Time Series Anomaly Detection Based on Multiple Spatiotemporal Graph Convolution

Multivariate time series anomaly detection (MTSAD) plays a crucial role in the Internet of Things (IoT), identifying device malfunction or system attacks. Graph neural networks (GNNs) are widely applied in MTSAD to capture the spatial features among sensors. However, GNN requires an explicit graph structure and cannot work when spatial relationships are lacking or sensor dependencies are unknown. Hence, graph structure learning (GSL) emerges as a promising solution, which learns graph structures with the downstream tasks without requiring spatial relationships. However, a general cascade effect occurs in the industrial scene. Moreover, an attack event changes sensor data sequentially instead of simultaneously due to the multiple serial process that occurs (i.e., delay correlation). Existing GSL-based anomaly detection methods fail to tackle delay correlation and focus on low prediction errors. However, the low prediction error distribution is always dispersed, making it difficult to differentiate between normal and abnormal samples based on a threshold. Therefore, we propose an MTSAD based on multiple spatiotemporal graph convolution (MSTGAD). MSTGAD uses dynamic time warping (DTW) distance as prior knowledge instead of Euclidean, guiding graph learning to capture delay correlations effectively. MSTGAD designs an ensemble predictor, which uses two subpredictors with a shared and learnable graph to ensure high prediction accuracy while maintaining stable anomaly scores. Furthermore, we conduct extensive experiments to evaluate the MSTGAD method's effectiveness. Our method outperforms existing GSL-based methods in anomaly detection on four publicly available real-world datasets, demonstrating our proposed approach's effectiveness. Compared with the best GSL-based method, MSTGAD achieves an additional 0.83% improvement on average.