Abstract: As the existing reconstruction-based anomaly detection methods cannot extract coupling relationships between components in cyber physical systems (CPS) well and tends to cause information omission, a graph convolutional method based on explicit and implicit associations fusion (GCEIAF) for multivariate time series anomaly detection is proposed. The improved cosine similarity function is used to extract explicit associations that can be measured by distance. An association extraction module based on multi-head self-attention mechanism is designed to capture implicit associations in a learnable way. The two kinds of associations are integrated to build a fusion graph, which is fed into a graph-convolutional autoencoder along with raw data to reconstruct time series combining temporal and spatial dependencies. The anomaly score of CPS can be calculated based on the reconstruction result, and then the anomalies are detected using the adaptive threshold selection algorithm. Experimental results on four public datasets indicate that GCEIAF outperforms the state-of-the-art and latest methods in terms of F1-Score. The experimental results also show that GCEIAF can interpret and analyze abnormal events by outputting the association weight matrix.

Key words: cyber-physical systems, multivariate time series anomaly detection, multi-head self-attention
mechanism, graph convolutional network, explicit and implicit associations extraction