Triple Attention: An Integrated Approach for Interpretable Anomaly Detection in Temporal and Association Dimensions

Due to the increasing complexity of industrial systems and the rise in automation levels, their safety and reliability have assumed greater importance. In operation, actuators and sensors generate a large amount of multivariate time series (MTS) data, wherein anomalous patterns could indicate malfunctions. However, existing methods for detecting anomalies in MTS often struggle with accuracy, particularly in complex industrial environments, and frequently lack interpretability of detected anomalies. Specifically, many current approaches fail to effectively capture temporal dependencies and parameter coupling relationships, leading to suboptimal detection performance. To address these issues, we propose a triple attention graph (TAG) structure, which integrates a triple attention mechanism and a normalized flow-based explainable graph encoder. The graph encoder applies Attention-enhanced long short-term memory (LSTM) to capture temporal features, focusing particularly on detecting temporal anomalies. Subsequently, through edge attention, we emphasize parameter coupling relationships and highlight parameters that trigger anomalies via a global attention mechanism. Finally, we integrate the features extracted by the graph encoder with conditional probability and normalized flow to assess the density of the time series. This model facilitates anomaly detection through anomaly density estimation and provides explanations for anomalies through attention coefficients. To validate TAG's effectiveness, we tested it on two publicly available datasets. The results demonstrate superior detection accuracy and recall rates compared with existing methods. Furthermore, we present a detailed analysis of our approach's interpretability in terms of temporal characteristics, associations, and global perspectives through a case study.