Spatial-temporal normalizing flow for robust multivariate time series anomaly detection

Recent advancements in Artificial Intelligence of Things (AIoT) technologies have brought about an increasing popularity in leveraging deep learning algorithms to detect potential failures in cyber-physical systems (CPS). Typically, an anomaly detection model is deployed to monitor the multivariate time series (MTS) generated by sensors to identify abnormal operation states. However, the contemporary unsupervised deep learning models for MTS anomaly detection are susceptible to contamination in the training dataset and are incapable of capturing the spatial-temporal correlations in MTS, resulting in suboptimal detection performance. In this paper, we propose a novel framework called Spatial-Temporal Normalizing Flow (STNF) to tackle the above problems. Our framework extends the conditional normalizing flow for MTS density estimation, aiming to achieve robust anomaly detection against training dataset pollution. Additionally, we introduce a patched Long Short-Term Memory (LSTM) module to effectively learn robust representations of long-term dependencies within MTS. Moreover, a dynamic graph construction module is devised to model the complex, evolving interdependencies across MTS dimensions. We evaluate our approach on three real-world CPS datasets and achieve significant improvements over the state-of-the-art approaches in terms of both performance and robustness.

This paper aims to address the limitations of current deep learning-based unsupervised time series anomaly detection methods, which are prone to training set contamination and struggle to effectively capture the complex spatio-temporal dependencies inherent to MTS sequential data.

This paper applies normalizing flows for MTS anomaly detection by estimating the density of a time series through conditioning on temporal and spatial dependencies. In detail, we first introduce a patched LSTM module to learn robust representations of long-term dependencies in MTS. Second, considering the dynamic relations among dimensions, we design a graph structure learning module based on the self-attention mechanism to model these changeable interdependencies. Finally, we employ the conditional normalizing flow, combined with the obtained temporal and spatial dependencies, to achieve fine-grained density estimation of MTS. The samples located in the low-density regions are then classified as anomalies.

We conduct experiments on three real-world CPS datasets and show that STNF outperforms seven state-of-the-art baselines. We also conduct comprehensive ablation studies and further analyses to demonstrate the effectiveness and interpretability of each proposed module.

In this study, we propose STNF, a novel unsupervised method for MTS anomaly detection. STNF leverages the power of conditional normalizing flow to estimate the density of MTS and identify instances with low density as anomalies. The incorporation of our proposed patched LSTM module and dynamic graph construction module enables the modeling of complex spatial-temporal dependencies within MTS, thereby facilitating accurate density estimation and enhancing the overall detection performance. Extensive experiments on real-world CPS datasets demonstrate the remarkable superiority of the STNF, even in scenarios where the training datasets exhibits a high level of anomaly contamination. In our future research, we plan to explore anomaly detection for MTS under slightly relaxed conditions, specifically in semi-supervised settings, rather than relying solely on fully unsupervised approaches. We believe that acquiring a small amount of labeled anomaly data is feasible in practice and that this external knowledge can assist the model in better distinguishing between anomalous and normal instances.