Learning Spatial Graph Structure for Multivariate KPI Anomaly Detection in Large-Scale Cyber-Physical Systems

Abstract

Anomaly detection on multivariate Key Performance Indicators (KPIs) is a key procedure for the quality and reliability of large-scale Cyber-Physical Systems (CPSs). Although extensive efforts have been paid in learning normal data distributions, the spatial dependence of different dimensional KPIs is barely explored to reasonably represent the complexity and time-varying nature of systems. In this paper, we propose to model the spatial dependence of multivariate KPI by combining a more reasonable graph learning method with a graph attention mechanism to obtain the complex spatial dependence in an unsupervised manner. First, we transform the multivariate KPI into graph structures with a specially designed KPI graph learning module. Second, the Graph Attention mechanism extracts the spatial dependence in the KPI graphs. Finally, our method jointly trains forecasting-based model and reconstruction-based model to detect anomalies. Through a large number of related experiments on four real-world datasets, we demonstrate the feasibility of our method and the F1-Score improves by 9% over the baseline model. Further analysis shows that the graph learning method in this paper can more reasonably describe the dependence between multivariate KPI, and the graph attention mechanism can more accurately capture the correlation between them, which is helpful for fault diagnosis.