Multivariate time series anomaly detection (MTSAD) remains challenging due to the complexity of spatiotemporal dependencies, non-stationary dynamics, and heterogeneous variable interactions. Existing methods often struggle to simultaneously model correlations within and across different time series components, limiting their ability to capture hierarchical patterns at multiple scales. To address these issues, we propose HCAAD (Hierarchical Component-Aware multivariate time series Anomaly Detection), an unsupervised framework that combines frequency-adaptive multiscale decomposition with cross-component correlation modeling. First, we use a Fast Fourier Transform (FFT)-based decomposition to split the time series into multiple components. This step isolates long-term trends, seasonal cycles, and transient fluctuations. Second, we design a dynamic correlation matrix to explicitly model intra-and inter-component dependencies. An attention mechanism further refines these correlations by adaptively integrating global spatiotemporal patterns. Experiments on six benchmark datasets show that HCAAD consistently achieves state-of-the-art performance.

Self-supervised learning (SSL) can extract useful temporal representations for time series classification (TSC) tasks. However, existing methods with subsequence and instance-level augmentation lead to the loss of global information and inductive bias. Meanwhile, neglecting multi-granularity temporal representations also poses challenges for modeling complex temporal structures and relationships. Therefore, in this work, we propose a multi-granularity temporal-aware time series classification method, called MGTC, that learns multi-granularity temporal representations, enhancing the ability to perceive class discrepancies. Specifically, we propose a multi-density masking strategy to adapt the dynamic time-varying patterns for learning comprehensive temporal representations. Next, we employ cluster-wise constraint to hierarchically aggregate these representations at the instance level. Finally, we design two self-supervised tasks: i) granularity-aware contrastive learning, to extract intra-instance fine-grained temporal structures and inter-instance coarse-grained class relationships, and ii) cross-view prediction pretext task, to capture global contextual temporal dependencies. We conducted comprehensive experimental evaluations on various types of dataset, and the experimental results validated the effectiveness of our method. The code is publicly available at https://github.com/mrxiliang/MGTC.

As a widely adopted protocol for anomaly detection in attributed networks, reconstruction error prioritizes comprehensive feature extraction to detect anomalies over interrogating the differential representation between normal and abnormal nodes. Intuitively, in attributed networks, normal nodes and their neighbors often exhibit similarities, whereas abnormal nodes demonstrate behaviors distinct from their neighbors. Hence, normal nodes can be accurately represented through their neighbors and effectively reconstructed. As opposed to normal nodes, abnormal nodes represented by their neighbors may be erroneously reconstructed as normal, resulting in increased reconstruction error. Leveraging from this observation, we propose a novel anomaly detection protocol called Neighbor-aware Mask-Filling Anomaly Detection (NMFAD) for attributed networks, aiming to maximize the variability between original and reconstructed features of abnormal nodes filled with information from their neighbors. Specifically, we utilize random-mask on nodes and integrate them into the backbone Graph Neural Networks (GNNs) to map nodes into a latent space. Subsequently, we fill the masked nodes with embeddings from their neighbors and smooth the abnormal nodes closer to the distribution of normal nodes. This optimization improves the likelihood of the decoder to reconstructing abnormal nodes as normal, thereby maximizing the reconstruction error of abnormal nodes. Experimental results demonstrate that, compared to the existing models, NMFAD exhibits superior performance.in attributed networks.

In unsupervised graph anomaly detection, existing methods usually focus on detecting outliers by learning local context information of nodes, while often ignoring the importance of global context. However, global context information can provide more comprehensive relationship information between nodes in the network. By considering the structure of the entire network, detection methods are able to identify potential dependencies and interaction patterns between nodes, which is crucial for anomaly detection. Therefore, we propose an innovative graph anomaly detection framework, termed CoCo (Context Correlation Discrepancy Analysis), which detects anomalies by meticulously evaluating variances in correlations. Specifically, CoCo leverages the strengths of Transformers in sequence processing to effectively capture both global and local contextual features of nodes by aggregating neighbor features at various hops. Subsequently, a correlation analysis module is employed to maximize the correlation between local and global contexts of each normal node. Unseen anomalies are ultimately detected by measuring the discrepancy in the correlation of nodes’ contextual features. Extensive experiments conducted on six datasets with synthetic outliers and five datasets with organic outliers have demonstrated the significant effectiveness of CoCo compared to existing methods.

Electrocardiogram(ECG) signal analysis is crucial in healthcare service computing. Ensuring accurate assessment of ECG signal quality is vital to prevent wastage of transmission bandwidth and ineffective analysis caused by noise. This enables the efficient utilization of service resources. However, existing ECG signal quality assessment(SQA) methods primarily focus on single-modal learning, overlooking the interrelation of ECG in a multimodal feature space and failing to effectively exploit available information for pattern mining. In this paper, we model the SQA for ECG as an anomaly detection problem and propose a multimodal unsupervised SQA method. It jointly explores the boundaries between high-quality ECG and noise in both the time and frequency domains by introducing time-frequency pseudo anomalies. Specifically, we first simulate real ECG noise from the time-domain using a combination of a series of noises and convert it to the frequency-domain to form time-frequency pseudo-anomalies. Next, we map the time-frequency pseudo anomalies onto hyperspheres and jointly refine the hyperspheres learned only from high-quality ECG samples in both feature spaces. Finally, the noise score is defined as the distance from the joint time-frequency features to the center of the hypersphere. Multiple experiments on various real-world ECG datasets validate the superior performance of our proposed method.

Cyber-Physical System needs high security to ensure the safe operation. Anomaly detection is one of the mainstream security technologies, the core of which is data analysis and learning. Unsupervised Deep-Learning-based Anomaly Detection Methods can be used in the scenarios that collects large amounts of unlabeled data and are more in line with the actual needs of CPS. However, the correlation among data did not attract enough attention to exploring their implicit relationship, and the adaptive training was deficient. Therefore, we propose an Adaptive-Correlation-aware Unsupervised Deep Learning (ACUDL) for anomaly detection in CPS. It constructs a directed graph structure to represent the implicit correlation among data and adaptively updates with dynamic graph; then, designs a dual-autoencoder to extract the original non-correlation, correlation, and reconstruction features, and builds an estimation network using the Gaussian mixture model (GMM) to estimate the anomaly energy. Experimental results on several CPS data scenarios show that ACUDL can be well adapted to many application scenarios with different data characteristics and achieves better overall results than some up-to-date DL-ADMs.

Capturing the complex interaction between the node attribute and the network structure is important for attributed network embedding and anomaly detection. However, there are few methods to explicitly model the correlation between these two views of the node attribute and the network structure. In this article, we propose an attributed network anomaly detection (CaCo) method based on the canonical correlation analysis, which assumes that there should be a strong correlation between the attribute and structure features of normal nodes, and a weak correlation one between those abnormal nodes, in the attributed networks. Consequently, a joint learning mechanism is designed in CaCo to explicitly measure the correlation between two views in the latent space. Specifically, the backbone of a weight-sharing graph convolutional network is employed to encode the node feature from two views of attribute and structure in the latent space, respectively. Then, a Kullback–Leibler divergence regularization is used to align the distributions of the two views. Finally, the parameters of CaCo are optimized by maximizing the correlation between attribute and structure features of normal nodes in the training phase, and anomalies can be detected by measuring the correlation between two views in the testing phase. Extensive experiments on six real-world datasets demonstrate the effectiveness of the proposed method compared to the state-of-the-art techniques.

A cyber–physical system (CPS) is a multidimensional complex system integrating computing, communication, and control technologies. Because of their key functionality within the system, CPS requires large robustness and security to ensure its reliable operation. Due to its importance in supporting overall system security, anomaly detection (AD) is likely to continue to play an important role in the CPS security. Moreover, unsupervised AD models based on deep learning have shown better performances in rule training, adaptive update, detection efficiency, and accuracy. Due to the nature of the CPS systems, CPS data is more likely to exhibit implicit correlative relationship among data, which would be vital to exploit for CPS security provisions in more complex data environments. In view of this observation, we propose the data-correlation-aware unsupervised deep learning model for AD in CPS, which uses an undigraph structure to store samples and implicit correlation among samples. We design a dual-autoencoder to train both original features and implicit correlation features among data, and we construct an estimation network using Gaussian mixture model (GMM) to evaluate the probability distribution of samples to complete the anomaly analysis. Experimental results compared the performance with relevant AD models based on deep learning which did not use data-correlation analysis. The results showed that, under some representative application scenarios of CPS considered, data-correlation-aware unsupervised deep-learning model achieved superior results in parameter sensitivity, ablation, relationship between correlation degree and detection performance, visualization, and detection effects.

The artificial immune system (AIS) is one of the important branches of artificial intelligence technology, and it is widely used in many fields. The detector set is the core knowledge set, and the AIS application effects are mainly determined by the generation, evolution, and detection of the detectors. Presently, the problem space (shape-space) of AIS mainly applied real-valued representation. But the real-valued detectors have some problems that have not been solved well, such as slow convergence speed of generation, holes in the nonself region, detector overlapping redundancy, dimension curse, etc., which lead to the unsatisfactory detection effects. Moreover, artificial immune anomaly detection is a dynamic adaptive model, needs to be evolved adaptively with the detection environments. Without better adaptive modeling, these problems mentioned before will get worse. In view of this, this article proposes a multisource immune detector adaptive model in neighborhood shape-space and applies it to anomaly detection: based on random, chaotic map and DNA genetic algorithm (DNA-GA), multisource neighborhood negative selection algorithm (MSNNSA), multisource neighborhood immune detector generation algorithm (MS-NIDGA), and neighborhood immune anomaly detection algorithm (NIADA) are proposed, so that the generation and detection of immune detectors can be improved efficiently; introducing immune adaptive and feedback mechanism, multisource neighborhood immune detector adaptive model (MS-NIDAM) is built, so that the detectors can be adaptively evolved in a more targeted search domain, and keep better distribution to the nonself region in real time, so as to solve various problems existing in the real-valued shape-space under dynamic environment mentioned before and improve the overall detection performances. The experimental results show that MS-NIDAM can improve the detector generation/evolution efficiency, keep the up-to-date understanding of the changing environment, so as to obtain better overall detection performances and stability than other comparative methods.