MAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks

TL;DR

MAD-GAN introduces an unsupervised generative adversarial network approach for multivariate time series anomaly detection, effectively capturing spatial-temporal dependencies and outperforming traditional methods in real-world cyber-physical systems.

Contribution

This work presents a novel MAD-GAN framework that leverages GANs to model multivariate dependencies for anomaly detection in time series data, utilizing a new DR-score for improved accuracy.

Findings

Effective detection of cyber-intrusions in real-world datasets

Outperforms traditional threshold-based and supervised methods

Demonstrates robustness across different CPS environments

Abstract

The prevalence of networked sensors and actuators in many real-world systems such as smart buildings, factories, power plants, and data centers generate substantial amounts of multivariate time series data for these systems. The rich sensor data can be continuously monitored for intrusion events through anomaly detection. However, conventional threshold-based anomaly detection methods are inadequate due to the dynamic complexities of these systems, while supervised machine learning methods are unable to exploit the large amounts of data due to the lack of labeled data. On the other hand, current unsupervised machine learning approaches have not fully exploited the spatial-temporal correlation and other dependencies amongst the multiple variables (sensors/actuators) in the system for detecting anomalies. In this work, we propose an unsupervised multivariate anomaly detection method based on Generative Adversarial Networks (GANs). Instead of treating each data stream independently, our proposed MAD-GAN framework considers the entire variable set concurrently to capture the latent interactions amongst the variables. We also fully exploit both the generator and discriminator produced by the GAN, using a novel anomaly score called DR-score to detect anomalies by discrimination and reconstruction. We have tested our proposed MAD-GAN using two recent datasets collected from real-world CPS: the Secure Water Treatment (SWaT) and the Water Distribution (WADI) datasets. Our experimental results showed that the proposed MAD-GAN is effective in reporting anomalies caused by various cyber-intrusions compared in these complex real-world systems.