In the Internet of Things (IoT), substantial time series data is recorded by sensors and other devices. Multivariate time series anomaly detection (MTSAD) identifies anomalies derived from device malfunctioning or system attacks to reduce economic losses. Graph structure learning (GSL)-based anomaly detection method learns an optimal graph structure joint with the downstream anomaly detection task, which achieves superior performance. However, the existing GSL-based methods only learn a single graph structure and can not represent multiple and complex relationships. Therefore, we propose a multi-graph structure learning-based multivariate time series anomaly detection with extended prior knowledge (MEGLAD). MEGLAD selects three kinds of typical graph structure learners to learn as many relationship types among sensors as possible. Extensive experiments show that our approach has better detection performance than state-of-the-art single graph structure learning techniques on four public and real-world datasets.

Multivariate time series anomaly detection (MTSAD) plays a crucial role in the Internet of Things (IoT) to identify device malfunction or system attacks. Graph neural networks (GNN) are widely applied in MTSAD to capture the spatial features among sensors. However, GNNs depend on a graph structure and explicit graph structures are not always available. To solve the problem of missing explicit graph structure, graph structure learning is introduced to learn an accurate graph structure joint with a GNNs-based anomaly detection task. However, the existing GSL-based methods provide only a partial view of the graph structure and cannot represent multiple and complex relationships. The noise of data also brings noisy edges. Therefore, we propose a fusion graph structure learning-based multivariate time-series anomaly detection with structured prior knowledge (FuGLAD). To the best of our knowledge, it appears to be the first application of fusion graphs in time series anomaly detection. FuGLAD selects three kinds of typical graph structure learners to learn as many relationship types among sensors as possible and exploits the prior similarity to evaluate the importance of all learned graphs and adaptively learn the fusion weight instead of the direct average weight. To handle noise in raw data, FuGLAD compares the neighbors of nodes by Jaccard similarity to identify and remove the noisy edges in the prior graph. Extensive experiments demonstrate that our approach outperforms state-of-the-art single-graph structure learning techniques in detection performance across four public and real-world datasets.