Please wait a minute...
Journal of ZheJiang University (Engineering Science)  2025, Vol. 59 Issue (10): 2134-2143    DOI: 10.3785/j.issn.1008-973X.2025.10.014
    
Multivariable time series data anomaly detection method based on spatiotemporal graph attention network
Gang XIAO(),Dapeng LU,Wenbo ZHENG,Zhenbo CHENG,Yuanming ZHANG*()
College of Computer Science and Technology, Zhejiang University of Technology, Hangzhou 310023, China
Download: HTML     PDF(1128KB) HTML
Export: BibTeX | EndNote (RIS)      

Abstract  

Existing anomaly detection methods of time series data focus on extracting the temporal variation features, while the spatial dependency features between multiple variables are ignored. To address this problem, a detection method based on a spatiotemporal graph attention network was proposed. The original multivariate time series data were transformed into a time-series graph with spatiotemporal dependencies, and a spatiotemporal graph attention network was designed to separately extract the temporal variation features and spatial dependency features. The periodic patterns of fused spatiotemporal features were learned by a multilayer perceptron, and an anomaly detection was performed based on the anomaly scores between prediction values and observation values. Experimental results on public datasets showed that the proposed method significantly outperformed state-of-the-art baseline methods in terms of anomaly detection accuracy and robustness.



Key wordsanomaly detection      spatiotemporal graph      graph deep learning      multivariate time series data      spatiotemporal feature fusion     
Received: 08 October 2024      Published: 27 October 2025
CLC:  TN 92  
Fund:  浙江省“尖兵”“领雁”研发攻关项目(2023C01022);国家自然科学基金资助项目(62476248).
Corresponding Authors: Yuanming ZHANG     E-mail: xg@zjut.edu.cn;zym@zjut.edu.cn
Cite this article:

Gang XIAO,Dapeng LU,Wenbo ZHENG,Zhenbo CHENG,Yuanming ZHANG. Multivariable time series data anomaly detection method based on spatiotemporal graph attention network. Journal of ZheJiang University (Engineering Science), 2025, 59(10): 2134-2143.

URL:

https://www.zjujournals.com/eng/10.3785/j.issn.1008-973X.2025.10.014     OR     https://www.zjujournals.com/eng/Y2025/V59/I10/2134


基于时空图注意力网络的多变量时序数据异常检测方法

现有时序数据异常检测方法侧重于提取时序数据的时间变化特征,忽略了多变量之间的空间依赖特征,为此提出基于时空图注意力网络的检测方法. 将多变量时序数据转换为具有时空依赖关系的时序图结构数据,设计时空图注意力网络分别提取时序图结构数据的时间变化特征和空间依赖特征. 通过多层感知机学习时空特征的周期性模式,根据时序数据的预测值与观测值的异常分数进行异常检测. 在公开数据集上的实验结果表明,所提方法在异常检测精准度和鲁棒性方面显著优于现有先进的基线方法.


关键词: 异常检测,  时序图,  图深度学习,  多变量时序数据,  时空特征融合 
Fig.1 Construction process of multivariate time series graph
Fig.2 Framework of spatiotemporal graph attention network
Fig.3 Structure of TimesNet model
数据集ntndnmra/%
SWaT396000990004491912.1
MSL46653116647372910.5
SMD5667241416817084204.2
PSM105984264978784127.8
Tab.1 Statistical information of dataset used for model performance evaluation
模型SWaTMSLSMDPSM
PRF1PRF1PRF1PRF1
DAGMM89.9257.8470.4089.6063.9374.6267.3049.8957.3093.4970.0380.08
LSTM86.1583.2784.6985.4582.5083.9578.5585.2881.7876.9389.6482.80
LSTM-VAE76.0089.5082.2073.7188.5480.4475.7690.0782.3073.6289.9280.96
BeatGAN64.0187.4673.9289.7585.4287.5272.9084.7179.4890.3093.8492.04
OminiAnomoly81.4284.3082.8389.7585.4087.5483.6886.8285.2288.3974.4680.83
THOC83.9386.3685.1386.4588.9287.6679.7690.9584.9988.1490.9989.54
MTAD-GAT81.4284.3082.8387.5484.4285.9590.1983.2586.5872.3977.4674.83
GDN99.3568.1280.8278.4563.0769.9274.0261.4367.0992.3285.8287.66
TimesNet86.7697.3291.7483.9286.4285.1588.6683.1485.8198.1996.7697.47
DLinear81.5195.6387.9686.4488.1287.3487.6283.8185.7297.2895.4696.32
STGAT90.9995.3793.1389.7486.8588.0689.9585.0487.4298.4996.6297.54
Tab.2 Performance evaluation metrics of different models in four datasets %
Fig.4 Time series data predictions and observations from different sensors using proposed model
Fig.5 Time series data predictions and observations from different sensors using proposed model (anomalous condition)
模型SWaTMSLSMDPSM
PRF1PRF1PRF1PRF1
TNO85.5988.2986.9176.4285.6180.7583.3580.2684.2593.7189.8291.72
GCNO72.1578.2775.0874.4576.5075.4660.5566.7463.4978.9382.6480.74
STGATA86.7888.5087.6385.7181.5483.5787.3684.0785.6890.0292.9391.45
STGATC85.1381.0883.0584.4182.5184.4284.9082.7183.7988.4585.4286.90
STGAT90.9995.3793.1389.7486.8588.0689.9585.0487.4298.4996.6297.54
Tab.3 Modular ablation experimental results for proposed model %
Fig.6 Impact of sequence length on anomaly detection performance
Fig.7 Impact of different time series graph on anomaly detection performance
[1]   丁小欧, 于晟健, 王沐贤, 等 基于相关性分析的工业时序数据异常检测[J]. 软件学报, 2020, 31 (3): 726- 747
DING Xiaoou, YU Shengjian, WANG Muxian, et al Anomaly detection on industrial time series based on correlation analysis[J]. Journal of Software, 2020, 31 (3): 726- 747
[2]   SIMMROSS-WATTENBERG F, ASENSIO-PEREZ J I, CASASECA-DE-LA-HIGUERA P, et al Anomaly detection in network traffic based on statistical inference and \alpha-stable modeling[J]. IEEE Transactions on Dependable and Secure Computing, 2011, 8 (4): 494- 509
doi: 10.1109/TDSC.2011.14
[3]   张圣林, 李东闻, 孙永谦, 等 面向云数据中心多语法日志通用异常检测机制[J]. 计算机研究与发展, 2020, 57 (4): 778- 790
ZHANG Shenglin, LI Dongwen, SUN Yongqian, et al Unified anomaly detection for syntactically diverse logs in cloud datacenter[J]. Journal of Computer Research and Development, 2020, 57 (4): 778- 790
doi: 10.7544/issn1000-1239.2020.20190875
[4]   苏卫星, 朱云龙, 刘芳, 等 时间序列异常点及突变点的检测算法[J]. 计算机研究与发展, 2014, 51 (4): 781- 788
SU Weixing, ZHU Yunlong, LIU Fang, et al Outliers and change-points detection algorithm for time series[J]. Journal of Computer Research and Development, 2014, 51 (4): 781- 788
doi: 10.7544/issn1000-1239.2014.20120542
[5]   HODGE V, AUSTIN J A survey of outlier detection methodologies[J]. Artificial Intelligence Review, 2004, 22 (2): 85- 126
doi: 10.1023/B:AIRE.0000045502.10941.a9
[6]   AGGARWAL C C, YU P S Outlier detection for high dimensional data[J]. ACM SIGMOD Record, 2001, 30 (2): 37- 46
doi: 10.1145/376284.375668
[7]   LI W, MAHADEVAN V, VASCONCELOS N Anomaly detection and localization in crowded scenes[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2014, 36 (1): 18- 32
doi: 10.1109/TPAMI.2013.111
[8]   MANEVITZ L M, YOUSEF M One-class svms for document classification[J]. Journal of Machine Learning Research, 2002, 2: 139- 154
[9]   LAPTEV N, AMIZADEH S, FLINT I. Generic and scalable framework for automated time-series anomaly detection [C]// Proceedings of the 21th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. Sydney: ACM, 2015: 1939–1947.
[10]   SAKURADA M, YAIRI T. Anomaly detection using autoencoders with nonlinear dimensionality reduction [C]// Proceedings of the MLSDA 2014 2nd Workshop on Machine Learning for Sensory Data Analysis. Gold Coast: ACM, 2014: 4–11.
[11]   ZENATI H, ROMAIN M, FOO C S, et al. Adversarially learned anomaly detection [C]// Proceedings of the IEEE International Conference on Data Mining. Singapore: IEEE, 2018: 727–736.
[12]   BROWN A, TUOR A, HUTCHINSON B, et al. Recurrent neural network attention mechanisms for interpretable system log anomaly detection [C]// Proceedings of the First Workshop on Machine Learning for Computing Systems. Tempe: ACM, 2018: 1–8.
[13]   GREFF K, SRIVASTAVA R K, KOUTNÍK J, et al LSTM: a search space odyssey[J]. IEEE Transactions on Neural Networks and Learning Systems, 2017, 28 (10): 2222- 2232
doi: 10.1109/TNNLS.2016.2582924
[14]   ZHOU H, ZHANG S, PENG J, et al Informer: beyond efficient transformer for long sequence time-series forecasting[J]. Proceedings of the AAAI Conference on Artificial Intelligence, 2021, 35 (12): 11106- 11115
doi: 10.1609/aaai.v35i12.17325
[15]   KIPF T N, WELLING M. Semi-supervised classification with graph convolutional networks [EB/OL]. (2017–02–22)[2024–08–23]. https://arxiv.org/pdf/1609.02907.
[16]   WEI Y, JANG-JACCARD J, XU W, et al LSTM-autoencoder-based anomaly detection for indoor air quality time-series data[J]. IEEE Sensors Journal, 2023, 23 (4): 3787- 3800
doi: 10.1109/JSEN.2022.3230361
[17]   XU H, PANG G, WANG Y, et al Deep isolation forest for anomaly detection[J]. IEEE Transactions on Knowledge and Data Engineering, 2023, 35 (12): 12591- 12604
doi: 10.1109/TKDE.2023.3270293
[18]   BARRIENTOS-TORRES D, MARTINEZ-RÍOS E A, NAVARRO-TUCH S A, et al Water flow modeling and forecast in a water branch of Mexico City through ARIMA and transfer function models for anomaly detection[J]. Water, 2023, 15 (15): 2792
doi: 10.3390/w15152792
[19]   SU Y, ZHAO Y, NIU C, et al. Robust anomaly detection for multivariate time series through stochastic recurrent neural network [C]// Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. Anchorage: ACM, 2019: 2828–2837.
[20]   霍纬纲, 梁锐, 李永华 基于随机Transformer的多维时间序列异常检测模型[J]. 通信学报, 2023, 44 (2): 94- 103
HUO Weigang, LIANG Rui, LI Yonghua Anomaly detection model for multivariate time series based on stochastic Transformer[J]. Journal on Communications, 2023, 44 (2): 94- 103
doi: 10.11959/j.issn.1000-436x.2023042
[21]   SHEN L, LI Z, KWOK J T. Timeseries anomaly detection using temporal hierarchical one-class network [C]// Proceedings of the 34th International Conference on Neural Information Processing Systems. Vancouver: ACM, 2020: 13016–13026.
[22]   ZONG B, SONG Q, MIN M R, et al. Deep autoencoding gaussian mixture model for unsupervised anomaly detection [C]// International Conference on Learning Representations. Vancouver: [s.n.], 2018: 1–19.
[23]   ABDULAAL A, LIU Z, LANCEWICKI T. Practical approach to asynchronous multivariate time series anomaly detection and localization [C]// Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. [S.l.]: ACM, 2021: 2485–2494.
[24]   ZHANG Z, LI W, DING W, et al STAD-GAN: unsupervised anomaly detection on multivariate time series with self-training generative adversarial networks[J]. ACM Transactions on Knowledge Discovery from Data, 2023, 17 (5): 1- 18
[25]   ZHOU B, LIU S, HOOI B, et al. BeatGAN: anomalous rhythm detection using adversarially generated time series [C]// Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence. [S.l.]: International Joint Conferences on Artificial Intelligence Organization, 2019: 4433–4439.
[26]   LIU Y, DING K, LU Q, et al. Towards self-interpretable graph-level anomaly detection [EB/OL]. (2023–10–25)[2024–09–13]. https://arxiv.org/pdf/2310.16520.
[27]   DENG A, HOOI B. Graph neural network-based anomaly detection in multivariate time series [C]// The 34th AAAI Conference on Artificial Intelligence. [S.l.]: AAAI, 2021: 4027–4035.
[28]   ZHENG Y, KOH H Y, JIN M, et al Correlation-aware spatial-temporal graph learning for multivariate time-series anomaly detection[J]. IEEE Transactions on Neural Networks and Learning Systems, 2024, 35 (9): 11802- 11816
doi: 10.1109/TNNLS.2023.3325667
[29]   DING K, SHU K, SHAN X, et al Cross-domain graph anomaly detection[J]. IEEE Transactions on Neural Networks and Learning Systems, 2022, 33 (6): 2406- 2415
doi: 10.1109/TNNLS.2021.3110982
[30]   ZHAO H, WANG Y, DUAN J, et al. Multivariate time-series anomaly detection via graph attention network [C]// Proceedings of the IEEE International Conference on Data Mining. Sorrento: IEEE, 2020: 841–850.
[31]   GUO G, WANG H, BELL D, et al. KNN model-based approach in classification [C]// On The Move to Meaningful Internet Systems 2003: CoopIS, DOA, and ODBASE. Berlin: Springer, 2003: 986–996.
[32]   PARK D, HOSHI Y, KEMP C C A multimodal anomaly detector for robot-assisted feeding using an LSTM-based variational autoencoder[J]. IEEE Robotics and Automation Letters, 2018, 3 (3): 1544- 1551
doi: 10.1109/LRA.2018.2801475
[33]   WU H, HU T, LIU Y, et al. TimesNet: temporal 2D-variation modeling for general time series analysis [EB/OL]. (2023–04–12)[2024–08–21]. https://arxiv.org/pdf/2210.02186.
[34]   MATHUR A P, TIPPENHAUER N O. SWaT: a water treatment testbed for research and training on ICS security [C]// Proceedings of the International Workshop on Cyber-physical Systems for Smart Water Networks. Vienna: IEEE, 2016: 31–36.
[35]   HUNDMAN K, CONSTANTINOU V, LAPORTE C, et al. Detecting spacecraft anomalies using LSTMs and nonparametric dynamic thresholding [C]// Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. London: ACM, 2018: 387–395.
[1] Jian XIAO,Liangliang WU,Xinze HE,Xin HU. Image feature matching algorithm based on anomaly detection[J]. Journal of ZheJiang University (Engineering Science), 2025, 59(6): 1140-1147.
[2] Qincheng JIANG,Jianfeng TAO,Yangyang WANG,Yulei ZHANG,Chengliang LIU. EWT-LSTM based industrial robot joint anomaly detection[J]. Journal of ZheJiang University (Engineering Science), 2025, 59(5): 982-994.
[3] Bote WANG,Qing WANG,Qiang LIU,Bo JIN. Self-supervised anomaly recognition method for wind turbine blade based on multi-channel vibration principal features[J]. Journal of ZheJiang University (Engineering Science), 2025, 59(3): 653-660.
[4] Fei SUN,Xiao-run LI,Liao-ying ZHAO,Shao-qi YU. Anomaly detection algorithm based on FrFT transform and total variation regularization[J]. Journal of ZheJiang University (Engineering Science), 2022, 56(7): 1276-1284.
[5] Peng ZHANG,Zi-du TIAN,Hao WANG. Flight parameter data anomaly detection method based on improved generative adversarial network[J]. Journal of ZheJiang University (Engineering Science), 2022, 56(10): 1967-1976.
[6] Yu LIU,Sen-lin LUO,Le-wei QU,Li-min PAN,Ji ZHANG. Full-featured information equalization modeling for insider threat detection[J]. Journal of ZheJiang University (Engineering Science), 2019, 53(4): 777-784.