Graph Neural Network-Based Anomaly Detection in Multivariate Time Series
Authors: Ailin Deng, Bryan Hooi4027-4035
AAAI 2021 | Conference PDF | Archive PDF | Plain Text | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | Experiments on two real-world sensor datasets with ground truth anomalies show that our method detects anomalies more accurately than baseline approaches, accurately captures correlations between sensors, and allows users to deduce the root cause of a detected anomaly. |
| Researcher Affiliation | Academia | Ailin Deng, Bryan Hooi National University of Singapore ailin@comp.nus.edu.sg, bhooi@comp.nus.edu.sg |
| Pseudocode | No | The paper describes the proposed framework and its components using textual descriptions and mathematical formulas, but it does not include any clearly labeled pseudocode or algorithm blocks. |
| Open Source Code | Yes | 1The code is available at https://github.com/d-ailin/GDN |
| Open Datasets | Yes | We use two sensor datasets based on water treatment physical test-bed systems: SWa T and WADI, where operators have simulated attack scenarios of real-world water treatment plants, recording these as the ground truth anomalies. The Secure Water Treatment (SWa T) dataset comes from a water treatment test-bed coordinated by Singapore s Public Utility Board (Mathur and Tippenhauer 2016). As an extension of SWa T, Water Distribution (WADI) is a distribution system comprising a larger number of water distribution pipelines (Ahmed, Palleti, and Mathur 2017). The datasets contain two weeks of data from normal operations, which are used as training data for the respective models. |
| Dataset Splits | Yes | The datasets contain two weeks of data from normal operations, which are used as training data for the respective models. A number of controlled, physical attacks are conducted at different intervals in the following days, which correspond to the anomalies in the test set. Table 1 summarises the statistics of the two datasets. In each time tick t, the sensor values s(t) train RN form an N dimensional vector representing the values of our N sensors. Following the usual unsupervised anomaly detection formulation, the training data is assumed to consist of only normal data. To detect anomalies, we use the maximum anomaly score over the validation dataset to set the threshold. |
| Hardware Specification | Yes | We implement our method and its variants in Py Torch (Paszke et al. 2017) version 1.5.1 with CUDA 10.2 and Py Torch Geometric Library (Fey and Lenssen 2019) version 1.5.0, and train them on a server with Intel(R) Xeon(R) CPU E5-2690 v4 @ 2.60GHz and 4 NVIDIA RTX 2080Ti graphics cards. |
| Software Dependencies | Yes | We implement our method and its variants in Py Torch (Paszke et al. 2017) version 1.5.1 with CUDA 10.2 and Py Torch Geometric Library (Fey and Lenssen 2019) version 1.5.0, and train them on a server with Intel(R) Xeon(R) CPU E5-2690 v4 @ 2.60GHz and 4 NVIDIA RTX 2080Ti graphics cards. |
| Experiment Setup | Yes | The models are trained using the Adam optimizer with learning rate 1e-3 and (β1, β2) = (0.9, 0.99). We train models for up to 50 epochs and use early stopping with patience of 10. We use embedding vectors with length of 128(64), k with 30(15) and hidden layers of 128(64) neurons for the WADI (SWa T) dataset, corresponding to their difference in input dimensionality. We set the sliding window size w as 5 for both datasets. |