Robust Anomaly Detection for Multivariate Time Series through Stochastic Recurrent Neural Network

TLDR

Industry devices such as servers, spacecraft, and engines are monitored with multivariate time series, and detecting anomalies in these series is essential for service quality management. This paper introduces OmniAnomaly, a stochastic recurrent neural network designed to robustly detect anomalies in multivariate time series across diverse devices. OmniAnomaly learns robust representations of normal patterns using stochastic variable connections and planar normalizing flows, reconstructs inputs, and flags anomalies based on reconstruction probabilities, also providing per‑series interpretations. On three real‑world datasets, OmniAnomaly achieves an F1‑score of 0.86, outperforming the best baseline by 0.09, and attains up to 0.89 interpretation accuracy.

Abstract

Industry devices (i.e., entities) such as server machines, spacecrafts, engines, etc., are typically monitored with multivariate time series, whose anomaly detection is critical for an entity's service quality management. However, due to the complex temporal dependence and stochasticity of multivariate time series, their anomaly detection remains a big challenge. This paper proposes OmniAnomaly, a stochastic recurrent neural network for multivariate time series anomaly detection that works well robustly for various devices. Its core idea is to capture the normal patterns of multivariate time series by learning their robust representations with key techniques such as stochastic variable connection and planar normalizing flow, reconstruct input data by the representations, and use the reconstruction probabilities to determine anomalies. Moreover, for a detected entity anomaly, OmniAnomaly can provide interpretations based on the reconstruction probabilities of its constituent univariate time series. The evaluation experiments are conducted on two public datasets from aerospace and a new server machine dataset (collected and released by us) from an Internet company. OmniAnomaly achieves an overall F1-Score of 0.86 in three real-world datasets, signicantly outperforming the best performing baseline method by 0.09. The interpretation accuracy for OmniAnomaly is up to 0.89.