摘要：

多元时间序列异常检测方法常被用于及时发现和识别系统中的异常模式和行为，以提高系统的安全性和稳定性。为了解决多元时间序列内部复杂依赖关系导致的异常检测精度降低的问题，提出一种多元时间序列异常检测模型HGAT，它基于图注意力网络并联合使用预测与重构方法进行优化。首先使用图注意力网络捕获多元时间序列在时间和空间维度上的依赖性；其次采用融合变分自编码器(VAE)的Transformer作为重构模块，并使用时间卷积网络(TCN)作为预测模块，联合实现对异常序列的检测，Transformer的自注意力机制允许重构模块在整个时间序列上建模，从而直接考虑序列中任意2个位置之间的关系，以捕捉序列的全局依赖关系，TCN通过堆叠卷积层并且增大感受野，可以有效地提取时间序列的局部特征；最后通过异常分数综合考虑重构模块和预测模块，在进行时空联合表征的基础上以全局和局部角度分析序列的整体分布。在SMAP、MSL和SMD数据集上进行实验，结果表明，HGAT的F1值分别为96.20%、97.50%和92.85%，均优于基线方法。

关键词: 多元时间序列, 异常检测, 图注意力网络, 预测, 重构

Abstract:

For improving system security and stability, multivariate time series anomaly detection methods are generally used to detect and identify abnormal patterns and behaviors in systems. To mitigate reduced anomaly detection accuracy caused by complex dependencies within multivariate time series, a multivariate time series anomaly detection model, HGAT, is proposed. This model is based on a graph attention network and is optimized by combining prediction and reconstruction methods. First, graph attention networks are used to capture the temporal and spatial dependencies of multivariate time series. Second, a Transformer that integrates Variational Autoencoders (VAE) is used as the reconstruction module and a Time Convolutional Network (TCN) is used as the prediction module to jointly detect abnormal sequences. The self-attention mechanism of the Transformer enables the reconstruction module to model the entire time series by directly considering the relationship between any two positions in the sequence to capture the global dependency relationship of the sequence. TCN can effectively extract local features of the time series by stacking convolutional layers and increasing the receptive field. Finally, by comprehensively considering the reconstruction and prediction modules via abnormal scores, the overall distribution of the sequence is analyzed from both global and local perspectives based on spatiotemporal joint representation. Experiments are conducted on the SMAP, MSL, and SMD datasets, and the results show that the F1 values for the HGAT are 96.20%, 97.50%, and 92.85%, respectively. These values are superior to those for the baseline method.

Key words: multivariate time series, anomaly detection, graph attention network, prediction, reconstruction