Journal of Xidian University ›› 2024, Vol. 51 ›› Issue (3): 170-181.doi: 10.19665/j.issn1001-2400.20230804

• Cyberspace Security • Previous Articles     Next Articles

Spatial-temporal graph convolutional networks foranomaly detection in multivariate time series

WANG Jing1,2(), HE Miaomiao3(), DING Jianli3(), LI Yonghua3()   

  1. 1. College of Safety Science and Engineering,Civil Aviation University of China,Tianjin 300300,China
    2. Information Security Evaluation Center,Civil Aviation University of China,Tianjin 300300,China
    3. College of Computer Science and Technology,Civil Aviation University of China,Tianjin 300300,China
  • Received:2023-06-14 Online:2024-06-20 Published:2023-11-21
  • Contact: LI Yonghua E-mail:j_wang@cauc.edu.cn;1782690867@qq.com;jlding@cauc.edu.cn;yh-li@cauc.edu.cn

Abstract:

To address the problem that the existing multivariate time series anomaly detection models have an insufficient ability to capture local and global spatial-temporal dependencies,a multivariate time series anomaly detection model based on spatial-temporal graph convolutional networks is proposed.First,in the temporal dimension,the short-term and long-term temporal dependencies in time series data are captured by using dilated causal convolution and multi-headed self-attention mechanisms,respectively.And the channel attention is introduced to learn the importance weights of different channels.Second,in the spatial dimension,a graph adjacency matrix is constructed by the static graph learning layer according to the node embedding,which is used to model the global spatial dependencies.Meanwhile,a series of evolutionary graph adjacency matrices is constructed by using the dynamic graph learning layer,so as to capture the local dynamic spatial dependencies.Finally,the reconstruction model and the prediction model are jointly optimized,and the anomaly score is calculated by the reconstructed error and the prediction error.Then,the relationship between the threshold and the anomaly score is compared to detect the anomaly.Experimental results on three public datasets,MSL,SMAP,and SwaT,show that the model outperforms the relevant baseline models such as OmniAnomaly,MTAD-GAT,and GDN in terms of the anomaly detection performance metric F1 score.

Key words: graph convolutional networks, spatial-temporal dependencies, multivariate time series, anomaly detection

CLC Number: 

  • TP391