An Evaluation of Anomaly Detection and Diagnosis in Multivariate Time Series

• Published in: IEEE transaction on neural networks and learning systems Vol. 33; no. 6; pp. 2508 - 2517
• Main Authors: Garg, Astha, Zhang, Wenyu, Samaran, Jules, Savitha, Ramasamy, Foo, Chuan-Sheng
• Format: Journal Article
• Language: English
• Published: United States IEEE 01.06.2022; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: Algorithms; Anomalies; Anomaly detection; anomaly diagnosis; Coders; Cyber-physical systems; deep learning; Diagnosis; evaluation; Hidden Markov models; Machine learning; Measurement; metrics; Multivariate analysis; multivariate time series (MVTS); Neural Networks, Computer; Predictive models; Supervised Machine Learning; Task analysis; Time Factors; Time series; Time series analysis; Training
• ISSN: 2162-237X; 2162-2388; 2162-2388
• DOI: 10.1109/TNNLS.2021.3105827

Several techniques for multivariate time series anomaly detection have been proposed recently, but a systematic comparison on a common set of datasets and metrics is lacking. This article presents a systematic and comprehensive evaluation of unsupervised and semisupervised deep-learning-based methods for anomaly detection and diagnosis on multivariate time series data from cyberphysical systems. Unlike previous works, we vary the model and post-processing of model errors, i.e., the scoring functions independently of each other, through a grid of ten models and four scoring functions, comparing these variants to state-of-the-art methods. In time-series anomaly detection, detecting anomalous events is more important than detecting individual anomalous time points. Through experiments, we find that the existing evaluation metrics either do not take events into account or cannot distinguish between a good detector and trivial detectors, such as a random or an all-positive detector. We propose a new metric to overcome these drawbacks, namely, the composite F-score (Fc 1 ), for evaluating time-series anomaly detection. Our study highlights that dynamic scoring functions work much better than static ones for multivariate time series anomaly detection, and the choice of scoring functions often matters more than the choice of the underlying model. We also find that a simple, channel-wise model-the univariate fully connected auto-encoder, with the dynamic Gaussian scoring function emerges as a winning candidate for both anomaly detection and diagnosis, beating state-of-the-art algorithms.