面向多维时间序列异常检测的时空图卷积网络  

Spatial-temporal graph convolutional networks foranomaly detection in multivariate time series

作　　者：王静 何苗苗[3] 丁建立 李永华[3] WANG Jing;HE Miaomiao;DING Jianli;LI Yonghua(College of Safety Science and Engineering,Civil Aviation University of China,Tianjin 300300,China;Information Security Evaluation Center,Civil Aviation University of China,Tianjin 300300,China;College of Computer Science and Technology,Civil Aviation University of China,Tianjin 300300,China)

机构地区：[1]中国民航大学安全科学与工程学院,天津300300 [2]中国民航大学信息安全测评中心,天津300300 [3]中国民航大学计算机科学与技术学院,天津300300

出　　处：《西安电子科技大学学报》2024年第3期170-181,共12页Journal of Xidian University

基　　金：国家自然科学基金民航联合基金重点课题(U2033205);中国民航大学信息安全测评中心开放基金资助(ISECCA-202006)。

摘　　要：针对现有多维时间序列异常检测模型对局部和全局时空依赖性捕获能力不足的问题,提出一种基于时空图卷积网络的多维时间序列异常检测模型。首先,在时间维度上利用扩张因果卷积和多头自注意力机制,分别捕获短期和长期时间依赖性,并且引入通道注意力来学习不同通道的重要性权重;其次,在空间维度上利用静态图学习层根据节点嵌入构建静态图邻接矩阵,旨在捕获多维时间序列数据的全局空间依赖性,同时利用动态图学习层构建一系列演化的图邻接矩阵,旨在建模局部动态的空间依赖性;最后,联合优化重构模型和预测模型,通过重构误差和预测误差计算异常分数,然后比较阈值和异常分数的关系,进而检测异常。在MSL、SMAP和SWaT三个公开数据集上的实验结果表明,该模型在异常检测性能指标F1分数方面优于OmniAnomaly、MTAD-GAT和GDN等相关的基线模型。To address the problem that the existing multivariate time series anomaly detection models have an insufficient ability to capture local and global spatial-temporal dependencies,a multivariate time series anomaly detection model based on spatial-temporal graph convolutional networks is proposed.First,in the temporal dimension,the short-term and long-term temporal dependencies in time series data are captured by using dilated causal convolution and multi-headed self-attention mechanisms,respectively.And the channel attention is introduced to learn the importance weights of different channels.Second,in the spatial dimension,a graph adjacency matrix is constructed by the static graph learning layer according to the node embedding,which is used to model the global spatial dependencies.Meanwhile,a series of evolutionary graph adjacency matrices is constructed by using the dynamic graph learning layer,so as to capture the local dynamic spatial dependencies.Finally,the reconstruction model and the prediction model are jointly optimized,and the anomaly score is calculated by the reconstructed error and the prediction error.Then,the relationship between the threshold and the anomaly score is compared to detect the anomaly.Experimental results on three public datasets,MSL,SMAP,and SwaT,show that the model outperforms the relevant baseline models such as OmniAnomaly,MTAD-GAT,and GDN in terms of the anomaly detection performance metric F1 score.

关 键 词：图卷积网络 时空依赖 多维时间序列 异常检测 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]