作者机构：
[Wu, Yanwen; Cao, Shuangshuang; Ma, Yanmei; Ge, Di] Cent China Normal Univ, Sch Phys Sci & Technol, Wuhan 430079, Peoples R China.;[Cheng, Yuhang] Shaanxi GSXZ Technol Co Ltd, Xian 710018, Peoples R China.;[Wu, Yanwen] Cent China Normal Univ, Natl Digital Learning Engn Technol Res Ctr, Wuhan 430079, Peoples R China.
通讯机构：
[Wu, YW ] C;Cent China Normal Univ, Sch Phys Sci & Technol, Wuhan 430079, Peoples R China.;Cent China Normal Univ, Natl Digital Learning Engn Technol Res Ctr, Wuhan 430079, Peoples R China.
关键词：
Anomaly detection;Multivariate time-series;Spatiotemporal;Abnormal information expression;Graph contrastive learning
摘要：
The detection of anomalies in high-dimensional time-series has always played a crucial role in the domain of system security. Recently, with rapid advancements in transformer model and graph neural network (GNN) technologies, spatiotemporal modeling approaches for anomaly detection tasks have been greatly improved. However, most methods focus on optimizing upstream time-series prediction tasks by leveraging joint spatiotemporal features. Through experiments, we found that this modeling approach not only risks the loss of some original anomaly information during data preprocessing, but also focuses on optimizing the performance of the upstream prediction task and does not directly enhance the performance of the downstream detection task. We propose a spatiotemporal anomaly detection model that incorporates an improved attention mechanism in the process of temporal modeling. We adopt a heterogeneous graph contrastive learning approach in spatio modeling to compensate for the representation of anomalous behavioral information, thereby guiding the model through thorough training. Through validation on two widely used real-world datasets, we demonstrate that our model outperforms baseline methods. We also explore the impact of multivariate time-series prediction tasks on the detection task, and visualize the reasons behind the benefits gained by our model.
作者机构：
[Wu, Yanwen; Ge, Di] Cent China Normal Univ, Sch Phys Sci & Technol, 152 Luoyu Rd, Wuhan 430079, Peoples R China.;[Dong, Zheng] Beijing Bytedance Technol Co Ltd, 48 Zhichun Rd, Beijing 200000, Peoples R China.;[Cheng, Yuhang] SHAANXI GSXZ Technol Co Ltd, 57 Fengchan Rd, Xian 710061, Shaanxi, Peoples R China.;[Wu, Yanwen] Cent China Normal Univ, Natl Digital Learning Engn Technol Res Ctr, 152 Luoyu Rd, Wuhan 430079, Peoples R China.
通讯机构：
[Wu, YW ] C;Cent China Normal Univ, Sch Phys Sci & Technol, 152 Luoyu Rd, Wuhan 430079, Peoples R China.
关键词：
Multivariate time series;Spatio-temporal modeling;Graph contrastive learning;Unsupervised anomaly detection
摘要：
Anomaly detection using multivariate time series plays a crucial role in system security. Conventional deep learning detection techniques mainly depend on temporal dependency and employ reconstruction or prediction-based methods. However, as feature variables grow more intricate, there is a risk of neglecting essential spatio-temporal structural information, potentially leading to insufficient model training in unsupervised settings. Hence, we propose an end-to-end anomaly detection model with multiple pre-training tasks designed for the spatio-temporal dimension to enhance our constraints. Specifically, in the temporal dimension, we employ an autoregressive task to train timestamp associations using data’s concealed autocorrelation and periodicity. In the spatio dimension, we acquire knowledge of a diverse feature-related heterogeneous graph. Subsequently, we design three different graph contrastive learning tasks to tap into the effective information arising from the inherent heterogeneity and hierarchy in spatio structures. Through joint spatio-temporal modeling, we can effectively capture inter and intra-feature associations from series and graph structural features, enhancing model robustness to cope with the complex chain reactions between features. Finally, we assess our model on three real-world datasets: SWaT, WADI(2017, 2019), our F1 scores demonstrate enhancements of 6.17%, 18.3% and 5.35% over the top-tier baseline performance. Our model is applicable for both temporal and graph, is self-supervised learning for sparse data which is suitable for data sparsity and complex scenarios that need to capture spatio-temporal characteristics at the same time, for example, traffic flow detection and anomaly detection of intelligent systems. Further visualization experiments and case studies will provide a better interpretation of our model.
作者机构：
华中师范大学国家数字化学习工程技术研究中心 武汉430079;华中师范大学物理科学与技术学院 武汉430079;华中师范大学教育大数据应用技术国家工程实验室 武汉430079;[Qiuting C.; Yunze D.] College of Physical Science and Technology, Central China Normal University, Wuhan, 430079, China;[Yanwen W.] National Engineering Research Center for E-Learning, Central China Normal University, Wuhan, 430079, China, College of Physical Science and Technology, Central China Normal University, Wuhan, 430079, China
