Multivariate time series anomaly detection via separation, decomposition, and dual transformer-based autoencoder

Abstract

Multivariate time series usually have entangled temporal patterns and various anomaly types. Meanwhile, they often contain both continuous and discrete features. Many existing methods directly model correlations in complex multivariate time series to conduct anomaly detection. Decomposing time series into different components, such as the overall trend and fluctuations, can contribute to better extracting semantic information and detecting anomalies. Existing decomposition-based anomaly detection methods still have several limitations. First, they directly decompose all features without considering that discrete features are unsuitable for decomposition because they do not have trends or fluctuations. Second, they adopt the same networks for different components with different characteristics, limiting their ability to extract semantic information. Moreover, due to the nature of Transformers, existing reconstruction-based methods using Transformers rarely form information bottlenecks, reducing the differentiation between the reconstruction errors of normal data and anomalies. This paper proposes a multivariate time series anomaly detection method with separation, decomposition, and dual Transformer-based autoencoder (SDDformer). Different from existing methods, SDDformer separates continuous and discrete features and only decomposes continuous features into trend and residual components. Considering the different characteristics of different components, SDDformer adopts Crossformer and the vanilla Transformer as the backbone of two different autoencoders to reconstruct the trend and residual components. Information bottlenecks are better formed using an extra token as the latent variable between the encoder and the decoder. SDDformer regards reconstructing a discrete feature as a classification task and calculates Cross-Entropy as its reconstruction error. Three different metrics are adopted in this paper to compare SDDformer with a variety of typical anomaly detection methods on public data sets, and the experimental results prove that SDDformer can achieve state-of-the-art performance.