GRD: Anomaly Detection Algorithm for Multivariate Time Series Data Based on GNN and Diffusion Model

doi:10.19678/j.issn.1000-3428.0069780

Abstract

Abstract: As multivariate time series data become increasingly prevalent across various industries, anomaly detection methods that can ensure the stable operation and security of systems have become crucial. Owing to the inherent complexity and dynamic nature of multivariate time series data, higher demands are placed on anomaly detection algorithms. To address the inefficiencies of existing anomaly detection methods in processing high-dimensional data with complex variable relations, this study proposes an anomaly detection algorithm for multivariate time series data, based on Graph Neural Networks (GNNs) and a diffusion model, named GRD. By leveraging node embedding and graph structure learning, GRD algorithm proficiently captures the relations between variables and refines features through a Gated Recurrent Unit (GRU) and a Denoising Diffusion Probabilistic Model (DDPM), thereby facilitating precise anomaly detection. Traditional assessment methods often employ a Point-Adjustment (PA) protocol that involves pre-scoring, substantially overestimating an algorithm's capability. To reflect model performance realistically, this work adopts a new evaluation protocol along with new metrics. The GRD algorithm demonstrates F1@k scores of 0.741 4, 0.801 7, and 0.767 1 on three public datasets. These results indicate that GRD algorithm consistently outperforms existing methods, with notable advantages in the processing of high-dimensional data, thereby underscoring its practicality and robustness in real-world anomaly detection applications.

Key words: multivariate time series data, anomaly detection, Graph Neural Network (GNN), diffusion model, evaluation protocol

摘要： 随着多变量时序数据在各行业中的广泛应用,开发有效的异常检测方法对于保障系统的稳定运行和安全性变得极为关键,由于多变量时序数据内在的复杂性和动态变化特性,对异常检测算法提出了更高的要求。针对现有异常检测方法在处理含有复杂变量关系的高维数据时存在效率不足的问题,提出一种基于图神经网络(GNN)与扩散模型的多变量时序数据异常检测算法GRD。通过节点嵌入和图结构学习,GRD算法能有效地捕捉和表示变量间的复杂关系,并通过门控循环单元(GRU)和去噪扩散概率模型(DDPM)进一步提取特征,实现了对异常数据的高精度检测。在以往的实验评估中,大多数算法在评分前会采用点调整(PA)评估协议,该协议会严重高估算法的检测能力。为了更准确地评估算法性能,采用新的评估协议和评价指标。实验结果表明,GRD算法在3个公开数据集上的F1@k指标分别是0.741 4、0.801 7、0.767 1,性能优于现有方法。特别是在高维数据处理方面,GRD算法展现出显著优势,证明了其在现实场景的异常检测应用中的实用性和鲁棒性。

关键词: 多变量时序数据, 异常检测, 图神经网络, 扩散模型, 评估协议

CLC Number:

TP183

DI Qinbo, CHEN Shaoli, SHI Liangren. GRD: Anomaly Detection Algorithm for Multivariate Time Series Data Based on GNN and Diffusion Model[J]. Computer Engineering, 2025, 51(11): 35-44.

邸钦渤, 陈劭力, 时良仁. GRD:基于GNN和扩散模型的多变量时序数据异常检测算法[J]. 计算机工程, 2025, 51(11): 35-44.

/ Recommend / Download Citations

URL: https://www.ecice06.com/EN/10.19678/j.issn.1000-3428.0069780

https://www.ecice06.com/EN/Y2025/V51/I11/35

References

[1] SU Y, ZHAO Y J, NIU C H, et al. Robust anomaly detection for multivariate time series through stochastic recurrent neural network[C]//Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery[WT《Times New Roman》]& Data Mining. New York, USA: ACM Press, 2019: 2828-2837.
[2] 王俊, 赖会霞, 万玥, 等. 基于角度的图神经网络高维数据异常检测方法[J]. 计算机工程, 2024, 50(3): 156-165. WANG J, LAI H X, WAN Y, et al. Angle-based graph neural network method for anomaly detection in high dimensional data[J]. Computer Engineering, 2024, 50(3): 156-165. (in Chinese)
[3] 陈何雄, 罗宇薇, 韦云凯, 等. 基于联邦学习的SDN异常流量协同检测技术[J]. 计算机工程, 2023, 49(3): 168-176. CHEN H X, LUO Y W, WEI Y K, et al. Collaborative detection technology of SDN abnormal traffic based on federated learning[J]. Computer Engineering, 2023, 49(3): 168-176. (in Chinese)
[4] DENG A L, HOOI B. Graph neural network-based anomaly detection in multivariate time series[C]//Proceedings of the 35th AAAI Conference on Artificial Intelligence/33rd Conference on Innovative Applications of Artificial Intelligence/11th Symposium on Educational Advances in Artificial Intelligence. Palo Alto, USA: AAAI Press, 2021: 8-15.
[5] PARK D, HOSHI Y, KEMP C C. A multimodal anomaly detector for robot-assisted feeding using an LSTM-based variational autoencoder[J]. IEEE Robotics and Automation Letters, 2018, 3(3): 1544-1551.
[6] HUNDMAN K, CONSTANTINOU V, LAPORTE C, et al. Detecting spacecraft anomalies using LSTMs and nonparametric dynamic thresholding[C]//Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery[WT《Times New Roman》]& Data Mining. New York, USA: ACM Press, 2018: 387-395.
[7] KIM S, CHOI K, CHOI H S, et al. Towards a rigorous evaluation of time-series anomaly detection[EB/OL].[2024-03-17]. https://arxiv.org/abs/2109.05257.
[8] SEHILI M E A, ZHANG Z H. Multivariate time series anomaly detection: fancy algorithms and flawed evaluation methodology[EB/OL].[2024-03-17]. https://arxiv.org/abs/2308.13068.
[9] ZHAO H, WANG Y J, DUAN J Y, et al. Multivariate time-series anomaly detection via graph attention network[C]//Proceedings of the IEEE International Conference on Data Mining (ICDM). Washington D.C., USA: IEEE Press, 2020: 841-850.
[10] HO J, JAIN A, ABBEEL P. Denoising diffusion probabilistic models[J]. Advances in Neural Information Processing Systems, 2020, 33: 6840-6851.
[11] CHO K, VAN MERRIENBOER B, GULCEHRE C, et al. Learning phrase representations using RNN encoder — decoder for statistical machine translation[C]//Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP). Stroudsburg, USA: ACL Press, 2014: 1724-1734.
[12] EMADI H S, MAZINANI S M. A novel anomaly detection algorithm using DBSCAN and SVM in wireless sensor networks[J]. Wireless Personal Communications, 2018, 98(2): 2025-2035.
[13] ZARE MOAYEDI H, MASNADI-SHIRAZI M A. ARIMA model for network traffic prediction and anomaly detection[C]//Proceedings of the International Symposium on Information Technology. Washington D.C., USA: IEEE Press, 2008: 1-6.
[14] CHEN L D, LAO K W, MA Y L, et al. Error modeling and anomaly detection of smart electricity meter using TSVD+L method[J]. IEEE Transactions on Instrumentation and Measurement, 2022, 71: 1-14.
[15] LI T Y, COMER M L, DELP E J, et al. Anomaly scoring for prediction-based anomaly detection in time series[C]//Proceedings of the IEEE Aerospace Conference. Washington D.C., USA: IEEE Press, 2020: 1-7.
[16] MUNIR M, SIDDIQUI S A, DENGEL A, et al. DeepAnT: a deep learning approach for unsupervised anomaly detection in time series[J]. IEEE Access, 2019, 7: 1991-2005.
[17] PARK J, PARK Y, KIM C I. TCAE: temporal convolutional autoencoders for time series anomaly detection[C]//Proceedings of the 13th International Conference on Ubiquitous and Future Networks (ICUFN). Washington D.C., USA: IEEE Press, 2022: 421-426.
[18] MALHOTRA P, RAMAKRISHNAN A, ANAND G, et al. LSTM-based encoder — decoder for multi-sensor anomaly detection[EB/OL].[2024-03-17]. https://arxiv.org/abs/1607.00148.
[19] XU H W, FENG Y, CHEN J, et al. Unsupervised anomaly detection via variational auto-encoder for seasonal KPIs in Web applications[C]//Proceedings of the 2018 World Wide Web Conference. New York, USA: ACM Press, 2018: 187-196.
[20] LI Z Y, SUN Y, YANG L H, et al. Unsupervised machine anomaly detection using autoencoder and temporal convolutional network[J]. IEEE Transactions on Instrumentation and Measurement, 2022, 71: 1-13.
[21] LIANG H R, SONG L, DU J R, et al. Consistent anomaly detection and localization of multivariate time series via cross-correlation graph-based encoder — decoder GAN[J]. IEEE Transactions on Instrumentation Measurement, 2022, 71: 3139696.
[22] ZHAN J, WANG S Q, MA X D, et al. STGAT-MAD: spatial-temporal graph attention network for multivariate time series anomaly detection[C]//Proceedings of the 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). Washington D.C., USA: IEEE Press, 2022: 3568-3572.
[23] DOOLEY S, KHURANA G S, MOHAPATRA C, et al. ForecastPFN: synthetically-trained zero-shot forecasting[EB/OL].[2024-03-17]. https://arxiv.org/abs/2311.01933.
[24] GOSWAMI M, SZAFER K, CHOUDHRY A, et al. MOMENT: a family of open time-series foundation models[EB/OL].[2024-03-17]. https://arxiv.org/abs/2402.03885.
[25] JIN M, WANG S, MA L, et al. Time-LLM: time series forecasting by reprogramming large language models[EB/OL].[2024-03-17]. https://arxiv.org/abs/2310.01728.
[26] CHANG C, PENG W C, CHEN T F. LLM4TS: two-stage fine-tuning for time-series forecasting with pre-trained LLMs[EB/OL].[2024-03-17]. https://arxiv.org/abs/2308.08469.
[27] DHARIWAL P, NICHOL A. Diffusion models beat GANs on image synthesis[EB/OL].[2024-03-17]. https://arxiv.org/abs/2105.05233.
[28] BLATTMANN A, ROMBACH R, LING H, et al. Align your latents: high-resolution video synthesis with latent diffusion models[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Washington D.C., USA: IEEE Press, 2023: 22563-22575.
[29] YANG R H, SRIVASTAVA P, MANDT S. Diffusion probabilistic modeling for video generation[J]. Entropy, 2023, 25(10): 1469.
[30] YANG D C, YU J W, WANG H L, et al. Diffsound: discrete diffusion model for text-to-sound generation[J]. ACM Transactions on Audio, Speech, and Language Processing, 2023, 31: 1720-1733.
[31] YU C H, ZHOU Q, LI J L, et al. Points-to-3D: bridging the gap between sparse points and shape-controllable text-to-3D generation[C]//Proceedings of the 31st ACM International Conference on Multimedia. New York, USA: ACM Press, 2023: 6841-6850.
[32] WYATT J, LEACH A, SCHMON S M, et al. AnoDDPM: anomaly detection with denoising diffusion probabilistic models using simplex noise[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). Washington D.C., USA: IEEE Press, 2022: 19-35.
[33] ZHANG H, WANG Z, WU Z, et al. DiffusionAD: denoising diffusion for anomaly detection[EB/OL].[2024-03-17]. https://arxiv.org/abs/2303.08730.
[34] RASUL K, SEWARD C, SCHUSTER I, et al. Autoregressive denoising diffusion models for multivariate probabilistic time series forecasting[EB/OL].[2024-03-17]. https://arxiv.org/abs/2101.12072.
[35] PINTILIE I, MANOLACHE A, BRAD F. Time series anomaly detection using diffusion-based models[C]//Proceedings of the IEEE International Conference on Data Mining Workshops (ICDMW). Washington D.C., USA: IEEE Press, 2023: 570-578.
[36] LUO C, LOU J G, LIN Q W, et al. Correlating events with time series for incident diagnosis[C]//Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. Washington D.C., USA: IEEE Press, 2014: 1583-1592.
[37] KIPF T N, WELLING M. Semi-supervised classification with graph convolutional networks[EB/OL].[2024-03-17]. https://arxiv.org/abs/1609.02907.
[38] BIANCHI F M, GRATTAROLA D, LIVI L, et al. Graph neural networks with convolutional ARMA filters[J]. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022, 44(7): 3496-3507.
[39] JIN W, MA Y, LIU X R, et al. Graph structure learning for robust graph neural networks[C]//Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery[WT《Times New Roman》]& Data Mining. New York, USA: ACM Press, 2020: 66-74.
[40] SINGHAL A. Modern information retrieval: a brief overview[J]. IEEE Data Engineering Bulletin, 2001, 24(4): 35-43.
[41] GOH J, ADEPU S, JUNEJO K N, et al. A dataset to support research in the design of secure water treatment systems[M]. Berlin, Germany: Springer, 2017.
[42] MOHAMED A, OTHMAN A, GALAL W F, et al. Integrated geophysical approach of groundwater potential in Wadi AI Ranyah, Saudi Arabia, using gravity, electrical resistivity, and remote-sensing techniques[J]. Remote Sensing, 2023, 15(7): 1808.
[43] TULI S, CASALE G, JENNINGS N R. TranAD: deep Transformer networks for anomaly detection in multivariate time series data[EB/OL].[2024-03-17]. https://arxiv.org/abs/2201.07284.
[44] XU J, WU H, WANG J, et al. Anomaly Transformer: time series anomaly detection with association discrepancy[EB/OL].[2024-03-17]. https://transferlab.ai/pills/2022/anomaly-transformer/.
[45] SCHÖLKOPF B, PLATT J C, SHAWE-TAYLOR J, et al. Estimating the support of a high-dimensional distribution[J]. Neural Computation, 2001, 13(7): 1443-1471.
[46] VAN DER MAATEN L, HINTON G. Visualizing data using t-SNE[J]. Journal of Machine Learning Research, 2008, 9(11): 2579-2605.

Please choose a citation manager

Content to export