# Graph Neural Network-Based Anomaly Detection in Multivariate Time Series

**Authors:** Ailin Deng, Bryan Hooi  
**arXiv:** [2106.06947](https://arxiv.org/abs/2106.06947)  
**Date:** 2021-06-13  
**Summary page:** https://www.summarizepaper.com/en/paper/2106.06947v1/

## Key points

- The paper proposes a novel approach for detecting anomalous events in high-dimensional time series data.
- The approach combines structure learning with graph neural networks to capture complex inter-sensor relationships.
- Attention weights are introduced to provide explainability for the detected anomalies.
- Experiments were conducted to evaluate the accuracy of the method compared to baseline approaches.
- An ablation study was performed to analyze the contribution of different components of the method.
- The interpretability of the model was investigated through examining embeddings and learned graph structure.
- The method was evaluated using real-world sensor datasets: SWaT and WADI, which provided labeled ground truth anomalies.
- The proposed method outperformed baseline approaches in terms of accuracy for anomaly detection in multivariate time series data with ground truth labels.
- It accurately captures correlations between sensors and allows users to deduce the root cause of detected anomalies.
- Localization information for anomalies is provided, helping identify affected sensors.
- This research contributes to improving anomaly detection by explicitly learning the structure of existing relationships between variables using graph neural networks.

## Summary

The paper titled "Graph Neural Network-Based Anomaly Detection in Multivariate Time Series" addresses the challenge of detecting anomalous events, such as system faults and attacks, in high-dimensional time series data. The authors propose a novel approach that combines structure learning with graph neural networks to capture complex inter-sensor relationships and detect anomalies that deviate from these relationships. They also introduce attention weights to provide explainability for the detected anomalies. The experiments conducted in the study aim to answer several research questions. Firstly, they evaluate the accuracy of their method compared to baseline approaches in detecting anomalies based on ground truth labeled anomalies. Secondly, they analyze how the different components of their method contribute to its performance through an ablation study. Thirdly, they investigate the interpretability of their model by examining its embeddings and learned graph structure. Lastly, they explore whether their method can localize anomalies and help users identify affected sensors while understanding how the anomaly deviates from expected behavior. To evaluate their approach, the authors use two real-world sensor datasets: SWaT and WADI. These datasets are based on water treatment physical test-bed systems where operators have simulated attack scenarios, providing labeled ground truth anomalies. The Secure Water Treatment (SWaT) dataset is coordinated by Singapore's national water agency, while WADI represents a large-scale critical infrastructure system. The results of the experiments demonstrate that the proposed method outperforms baseline approaches in terms of accuracy for anomaly detection in multivariate time series data with ground truth labels. It accurately captures correlations between sensors and allows users to deduce the root cause of detected anomalies. Additionally, it provides localization information for anomalies and helps identify affected sensors. Overall, this research contributes to improving anomaly detection in high-dimensional time series data by explicitly learning the structure of existing relationships between variables using graph neural networks. The combination of structure learning and attention weights enhances explainability for detected anomalies and enables users to understand deviations from expected behavior more effectively.