MAD-SGCN: Multivariate Anomaly Detection with Self-learning Graph Convolutional Networks

Today's Cyber Physical Systems (CPSs) are large and complex data-intensive systems. Constant monitoring and analysis of the data generated by a multitude of interconnected sensors and actuators are required in order to detect anomalies due to possible intrusions or faults with high accuracy and timeliness. Recently, unsupervised anomaly detection techniques based on deep learning for multivariate time series have been proposed for detecting CPSs attacks with promising performance. However, the current methods are either limited by their representation learning methods in encoding the temporal and spatial information simultaneously and effectively, or cannot easily scale to other tasks without having explicit knowledge of the internal relationships between the different variables or sensors, which are both important for characterising CPSs data. In this paper, we propose a novel unsupervised anomaly detection method for multivariate time series MAD-SGCN which effectively captures the temporal and spatial correlations of the input sequences simultaneously using Long Short-Term Memory networks (LSTMs) and spectral-based Graph Convolutional Networks (GCNs). We design a self-supervised graph structure learning mechanism to minimize the usage of the prior knowledge about the network structures of the CPSs. Experiments on four CPS datasets demonstrate the superiority of the proposed method.