TSAD: Temporal–spatial association differences-based unsupervised anomaly detection for multivariate time-series

Abstract

Modern industrial control systems are vast and intricate, requiring the monitoring of data from numerous interconnected sensors and actuators for precise intrusion and anomaly detection. While unsupervised time series anomaly detection methods based on deep learning effectively capture complex nonlinear contextual dependencies, the anomaly metrics employed by current methods lack contextual anomaly information, thereby hindering the distinction between anomalies and normalies. Addressing this issue, a Temporal–Spatial Association Differences-based Anomaly Detection model (TSAD) is proposed. This model introduces temporal association difference learning, capturing the temporal association distribution of normal sequences while considering temporal association loss to calculate temporal association differences. Additionally, it incorporates spatial association difference learning, capturing the spatial association distribution of normal sequences while considering spatial association loss to calculate spatial association differences. By focusing on extracting temporal–spatial association patterns from multivariate time-series data under normal operating conditions, the model aggregates reconstruction errors and temporal–spatial association differences during testing to detect anomalies using a novel anomaly metric. Experimental results on four real-world datasets (SWaT, WADI, PSM, and MSL) demonstrate the state-of-the-art performance of the approach.