Graph-Augmented Normalizing Flows for Anomaly Detection of Multiple Time Series

TL;DR

This paper introduces GANF, a novel graph-augmented normalizing flow model that leverages Bayesian networks to improve unsupervised anomaly detection in multiple interdependent time series, demonstrating superior density estimation and drift detection.

Contribution

The paper proposes a new flow model that integrates Bayesian networks with normalizing flows for better anomaly detection in multiple time series.

Findings

GANF effectively detects anomalies in real-world datasets.

GANF outperforms existing density estimation methods.

It successfully identifies distribution drift in time series.

Abstract

Anomaly detection is a widely studied task for a broad variety of data types; among them, multiple time series appear frequently in applications, including for example, power grids and traffic networks. Detecting anomalies for multiple time series, however, is a challenging subject, owing to the intricate interdependencies among the constituent series. We hypothesize that anomalies occur in low density regions of a distribution and explore the use of normalizing flows for unsupervised anomaly detection, because of their superior quality in density estimation. Moreover, we propose a novel flow model by imposing a Bayesian network among constituent series. A Bayesian network is a directed acyclic graph (DAG) that models causal relationships; it factorizes the joint probability of the series into the product of easy-to-evaluate conditional probabilities. We call such a graph-augmented normalizing flow approach GANF and propose joint estimation of the DAG with flow parameters. We conduct extensive experiments on real-world datasets and demonstrate the effectiveness of GANF for density estimation, anomaly detection, and identification of time series distribution drift.