西安电子科技大学学报 ›› 2024, Vol. 51 ›› Issue (3): 170-181.doi: 10.19665/j.issn1001-2400.20230804

• 网络空间安全 • 上一篇    下一篇

面向多维时间序列异常检测的时空图卷积网络

王静1,2(), 何苗苗3(), 丁建立3(), 李永华3()   

  1. 1.中国民航大学 安全科学与工程学院,天津 300300
    2.中国民航大学 信息安全测评中心,天津 300300
    3.中国民航大学 计算机科学与技术学院,天津 300300
  • 收稿日期:2023-06-14 出版日期:2024-06-20 发布日期:2023-11-21
  • 通讯作者: 李永华(1974—),女,讲师,E-mail:yh-li@cauc.edu.cn
  • 作者简介:王 静(1980—),女,副教授,E-mail:j_wang@cauc.edu.cn
    何苗苗(1998—),女,中国民航大学硕士研究生,E-mail:1782690867@qq.com
    丁建立(1963—),男,教授,E-mail:jlding@cauc.edu.cn
  • 基金资助:
    国家自然科学基金民航联合基金重点课题(U2033205);中国民航大学信息安全测评中心开放基金资助(ISECCA-202006)

Spatial-temporal graph convolutional networks foranomaly detection in multivariate time series

WANG Jing1,2(), HE Miaomiao3(), DING Jianli3(), LI Yonghua3()   

  1. 1. College of Safety Science and Engineering,Civil Aviation University of China,Tianjin 300300,China
    2. Information Security Evaluation Center,Civil Aviation University of China,Tianjin 300300,China
    3. College of Computer Science and Technology,Civil Aviation University of China,Tianjin 300300,China
  • Received:2023-06-14 Online:2024-06-20 Published:2023-11-21

摘要:

针对现有多维时间序列异常检测模型对局部和全局时空依赖性捕获能力不足的问题,提出一种基于时空图卷积网络的多维时间序列异常检测模型。首先,在时间维度上利用扩张因果卷积和多头自注意力机制,分别捕获短期和长期时间依赖性,并且引入通道注意力来学习不同通道的重要性权重;其次,在空间维度上利用静态图学习层根据节点嵌入构建静态图邻接矩阵,旨在捕获多维时间序列数据的全局空间依赖性,同时利用动态图学习层构建一系列演化的图邻接矩阵,旨在建模局部动态的空间依赖性;最后,联合优化重构模型和预测模型,通过重构误差和预测误差计算异常分数,然后比较阈值和异常分数的关系,进而检测异常。在MSL、SMAP和SWaT三个公开数据集上的实验结果表明,该模型在异常检测性能指标F1分数方面优于OmniAnomaly、MTAD-GAT和GDN等相关的基线模型。

关键词: 图卷积网络, 时空依赖, 多维时间序列, 异常检测

Abstract:

To address the problem that the existing multivariate time series anomaly detection models have an insufficient ability to capture local and global spatial-temporal dependencies,a multivariate time series anomaly detection model based on spatial-temporal graph convolutional networks is proposed.First,in the temporal dimension,the short-term and long-term temporal dependencies in time series data are captured by using dilated causal convolution and multi-headed self-attention mechanisms,respectively.And the channel attention is introduced to learn the importance weights of different channels.Second,in the spatial dimension,a graph adjacency matrix is constructed by the static graph learning layer according to the node embedding,which is used to model the global spatial dependencies.Meanwhile,a series of evolutionary graph adjacency matrices is constructed by using the dynamic graph learning layer,so as to capture the local dynamic spatial dependencies.Finally,the reconstruction model and the prediction model are jointly optimized,and the anomaly score is calculated by the reconstructed error and the prediction error.Then,the relationship between the threshold and the anomaly score is compared to detect the anomaly.Experimental results on three public datasets,MSL,SMAP,and SwaT,show that the model outperforms the relevant baseline models such as OmniAnomaly,MTAD-GAT,and GDN in terms of the anomaly detection performance metric F1 score.

Key words: graph convolutional networks, spatial-temporal dependencies, multivariate time series, anomaly detection

中图分类号: 

  • TP391