摘要：

传统时间序列异常检测模型在处理信息物理系统(CPS)中的多元传感器和执行器数据时, 难以准确提取多元数据之间的时序联系, 从而影响异常检测性能。为此, 提出一种新的时间序列异常检测方法, 称为自相关-变分自编码(VAE)-对抗学习网络AMVG。以生成对抗网络(GAN)为基础, 使用Noise数据增强方法扩展训练数据量, 并通过引入自相关矩阵增强数据依赖关系, 结合VAE的数据重建能力, 在加强模型鲁棒性的同时进一步提高异常检测模型性能, 由AMVG 2个解码器构成互相对抗的G网络和D网络, G网络和D网络不断对抗训练优化模型的检测能力。在3个真实世界的CPS数据集上的实验结果表明, AMVG方法相较于最新研究方法在精确率、召回率以及F1值等综合性能上均取得显著提高, AMVG在3个数据集上的F1值分别为0.953、0.758、0.891, 其中较次优USAD和GRELEN的F1值最低可提高6.2、3.4、7.5个百分点。

关键词: 异常检测, 时间序列, 对抗生成网络, 自编码器, 信息物理系统

Abstract:

Traditional time-series anomaly detection models struggle to accurately extract temporal connections between the multivariate sensor and actuator data in Cyber-Physical Systems (CPS), thereby affecting anomaly detection performance. To address this issue, this paper proposes a novel time-series anomaly detection method called the autocorrelation-Variational Auto-Encoder(VAE)-adversarial learning network AMVG. Built on a Generative Adversarial Network (GAN), this method uses Noise data augmentation to expand the training dataset. By introducing autocorrelation matrices to enhance data dependencies and combining the data reconstruction capabilities of VAE, the robustness of the model is strengthened, further improving the anomaly detection performance. The two decoders of the AMVG form mutually antagonistic G and D networks, engaging in continuous adversarial training to optimize the detection capability of the model. Experimental validation on three real-world CPS datasets demonstrates that the AMVG method achieves significant improvements in accuracy, recall, and F1 value compared to state-of-the-art methods. Specifically, the F1 values for the three datasets are 0.953, 0.758, and 0.891. Compared to the suboptimal USAD and GRELEN methods, the AMVG method can increase the F1 values by at least 6.2, 3.4, and 7.5 percentage points, respectively.

Key words: anomaly detection, time series, Generative Adversarial Network(GAN), Auto-Encoder(AE), Cyber-Physical Systems(CPS)