Multivariate Time Series Anomaly Detection with Improved Encoder-Decoder Based Model

Abstract

The ubiquitous use of real-time sensors in the Internet-of-Things (IoT) has brought great convenience to data collection. Moreover, sensor anomalies generated by external factors or malicious attacks pose a critical threat to the security of the IoT. Detecting anomalies in multivariate time series has become one of the significant issues in Io T security research. Most existing time series anomaly detection methods, however, merely consider time and space complexity, without taking into account the distance metrics among time series data, which leads inevitably to the model’s insufficient ability to accurately recognize anomalies. This investigation proposes a new hybrid model based on encoder-decoder architecture for time series anomaly detection. This model designs a multi-dimensional feature embedding module to enable utilize more interrelated features. Meanwhile, the relationships between sensors are explicitly learned by using a graph structure and reconstruct the nodes vectors by using a message propagation mechanism with a specific sampling strategy in this model. On this basis, a data fusion method based on the multi-head self-attention mechanism which effectively integrates various information such as time, variables, positional relationships, and distance metrics is designed for capturing global feature information. The experimental results on the dataset SWAT show that, compared with the state-of-the-arts, the proposed approach improves the Recall and F1-score metrics of anomaly detection performance by 8.2% and 5.0% respectively.