Multivariate time series anomaly detection by fusion of deep convolution residual autoencoding reconstruction model and ConvLstm forecasting model

Abstract

Multivariate time-series anomaly detection is very essential to ensure the normal operation of physical equipment. Great achievements have been made in this field in recent years. However, two critical challenges limit the generalization ability of the model. Graph attention networks without prior knowledge are unable to extract the distribution features of dependencies among variables in a fine granularity. This reduces the accuracy of the dependence matrix to represent the correlations between variables. Beyond this challenge, the reconstruction model loses the fine-grained seasonal feature information in the spatial dimension during the reconstruction analysis process of the sample. In order to solve the above challenges, we propose a multivariate time-series anomaly detection model consisting of characterization network and forecasting network. In the characterization network, we first remove non-existent dependencies between variables by using prior knowledge. This approach can accurately capture the fine-grained dependency distribution features between variables and improve the accuracy of the dependence matrix representation of the correlations between variables. We then construct a deep convolutional residual autoencoder to reduce the loss of seasonal feature information in the spatial dimension. In forecasting network, we construct a temporal attention-based ConvLstm forecasting network to make fine-grained anomaly decisions on the output of the characterization network in the time dimension. We perform systematic experiments on six open-source datasets, in social network security scenario,the malicous acount behavior can be detected. Experimental results show that the proposed method outperforms the baseline anomaly detection methods with excellent detection performance and robustness. Specifically, our method achieves an average F1 score improvement of 0.23 over the baseline method at its highest level.