MTGFlow: Dynamic Graph & Entity-Aware Anomaly Detection

• MTGFlow is an unsupervised anomaly detection framework for multivariate time series that models the complete probability distribution using dynamic graph learning and entity-aware normalizing flows.
• It dynamically captures evolving inter-entity dependencies via attention-based graph construction and RNN fusion, enabling robust detection even with contaminated training data.
• The framework enhances interpretability through decomposed entity-level anomaly scores and a cluster-aware extension that boosts AUROC performance on benchmark datasets.

MTGFlow is an unsupervised anomaly detection framework for multivariate time series (MTS) that relies on dynamic graph structure learning and entity-aware normalizing flows. MTGFlow is specifically designed to relax the standard assumption of a clean, normal-only training set and instead models the overall probability distribution—enabling robust detection of anomalies in real-world settings where training data may be contaminated. The key innovation lies in its two-stage design: dynamically encoding evolving inter-entity dependencies via a learned graph structure, and modeling the statistical heterogeneity of individual entities through parameterized normalizing flows, including a cluster-aware extension that aggregates entities with similar characteristics. MTGFlow advances the state of the art in MTS anomaly detection by improving fine-grained density estimation, providing increased detection accuracy and interpretability over conventional methods (Zhou et al., 2022, Zhou et al., 2023).

1. Motivation and Problem Formulation

Traditional MTS anomaly detection approaches typically operate under a one-class classification (OCC) or semi-supervised regime. These frameworks require a set of training samples that are strictly normal—an unrealistic precondition in many practical deployments. Failure to guarantee clean training data degrades the performance of OCC-based methods, as they fit the training distribution as the "normal" baseline even if anomalies are present.

MTGFlow addresses this challenge by moving from class-based boundaries to explicit density estimation: it estimates the full distribution of the (possibly contaminated) training set and identifies test samples as anomalous if they occupy low-density regions. This approach is premised on the assumption—supported in the literature—that anomalous instances occur in sparser regions of the data distribution.

Key problem dimensions:

• The presence of complex and evolving dependencies among entities (dimensions in MTS).
• The inherent statistical diversity among entities, which can render a unified (global) normal model ineffective.
• The necessity to model without relying on labeled or pre-filtered data.

2. Dynamic Graph Structure Learning

In MTGFlow, the temporal and spatial (inter-entity) relationships are encoded by a dynamically learned, fully connected graph. Each entity is represented as a node, and edges model interdependencies that may evolve over time.

Mechanism

• Self-attention-based Graph Construction: For each sliding window $x^{(c)} \in \mathbb{R}^{K \times M}$ (with $K$ entities, $M$ observations), queries and keys are learned for each entity:

$\text{Query}_i = x_i^{(c)} W^{(\text{Query})}$

$\text{Key}_j = x_j^{(c)} W^{(\text{Key})}$

• Pairwise Relationships:

$$e_{ij}^{(c)} = \frac{(\text{Query}_i)(\text{Key}_j)^\top}{\sqrt{M}}$$

• Attention-based Adjacency:

$$a_{ij}^{(c)} = \frac{\exp(e_{ij}^{(c)})}{\sum_j \exp(e_{ij}^{(c)})}$$

The resulting attention matrix $\mathbf{A}^{(c)}$ forms the dynamic adjacency matrix for the graph at window $c$.

• Integration with Temporal Encoding: An RNN is applied to obtain temporal representations, which are then fused via a graph convolution using the learned attention matrix, capturing both temporal and evolving structural correlations.

Context and Significance

This dynamic graph enables MTGFlow to accurately reflect the true dependency structure among entities, accommodating changes in system behavior over time. It is a crucial factor in distinguishing between genuine anomalous dependencies and normal regime changes, thereby supporting precise density estimation in the downstream stages.

3. Entity-Aware Normalizing Flows

MTGFlow adopts a normalizing flow framework, but departs from conventional approaches by associating each entity with a separate, learned latent distribution.

Formulation

• Normalizing Flow for Each Entity $k$:

$$P_{\mathcal{X}_k}(x_k) = P_{\mathcal{Z}_k}(f_\theta(x_k|C)) \cdot \left| \det \left( \frac{\partial f_\theta}{\partial x_k^\top} \right) \right|$$

where $P_{\mathcal{Z}_k}$ is a parameterized Gaussian $\mathcal{N}(\mu_k, I)$, $f_\theta(\cdot)$ is the invertible transformation (normalizing flow), and $C$ is the spatio-temporal context from dynamic graph-augmented representations.

Benefits

• Preserves Diverse Entity Behavior: Each entity’s normal operating mode, captured via its own $\mu_k$, enables the model to represent multimodal or entity-specific normality in the data.
• Fine-Grained Density Estimation: This construction facilitates detection of subtle or entity-specific anomalies that would be missed by a unified model.

This suggests that entity-aware modeling directly addresses over-smoothing and loss of distinctiveness observed in global density models.

• Conditional Modeling: The spatio-temporal context $C$ conditions the normalizing flow, further enhancing modeling precision.

4. Cluster-Aware Density Estimation (MTGFlow_cluster)

To further improve modeling when multiple entities share similar operational characteristics, MTGFlow introduces a cluster-aware extension, MTGFlow_cluster.

Method

• Clustering Entities: Entities are grouped using a time series clustering algorithm (e.g., KShape) based on similarity in their normal-operation patterns.
• Shared Latent Distributions: All entities within cluster $m$ share a latent parameter $\mu_m$:

$$P_{\mathcal{X}_k}(x_k) = P_{\mathcal{Z}_k}(f_\theta(x_k|C)), \quad \mathcal{Z}_k = \mathcal{N}(\mu_m, I), \quad \text{for } k \in \text{cluster } m$$

Context

The cluster-aware approach exploits the shared structure among similar entities, enabling the model to avoid redundancy in parameterization while still capturing inter-cluster diversity. MTGFlow_cluster has been shown to deliver modest AUROC improvements over the base model in settings like SWaT and WADI, where entity similarity is pronounced.

5. Density-Based Anomaly Scoring and Optimization

MTGFlow detects anomalies by identifying low-density instances relative to the learned entity-wise (or cluster-wise) models.

Mathematical Framework

• Change-of-Variable (Density Transformation):

$$P_\mathcal{X}(x) = P_\mathcal{Z}(z) \cdot \left| \det \left( \frac{\partial f_\theta}{\partial x^\top} \right) \right|, \quad z = f_\theta(x|C)$$

• Anomaly Score for Window $c$:

$$S_c = -\frac{1}{K}\sum_k \log P_{\mathcal{X}_k} (x^{c}_k)$$

A higher score corresponds to a lower likelihood (higher anomaly probability).

• Maximum Likelihood Objective:

$$W^* = \mathop{\arg\!\max}_W \frac{1}{NK} \sum_c \sum_k \left[ -\frac{1}{2}\| f_\theta(x_k^c|C_k^c) - \mu_k \|^2 + \log\left|\det\left(\frac{\partial f_\theta}{\partial {x_k^c}^{\top}}\right)\right| \right]$$

• Thresholding: An interquartile range (IQR)-based threshold on the negative average log-likelihood determines whether a sample is flagged as anomalous.

6. Empirical Performance and Interpretability

Extensive experiments were performed on six multivariate time series benchmarks, including SWaT, WADI, PSM, MSL, and SMD. Performance evaluation used the Area Under the Receiver Operating Characteristic (AUROC) as the primary metric.

Dataset	MTGFlow AUROC Improvement over SOTA	MTGFlow_cluster (where tested)
SWaT	~4–5%	Further improvement
WADI	Up to 5%	Modest gain
PSM	Consistent improvement	Notable
MSL, SMD	Robust, state-of-the-art	—

• Baselines include DeepSVDD, USAD, and GANF.
• The sliding window approach with RNN-based temporal encoding and dynamic graph learning results in more accurate anomaly detection, particularly in contaminated or real-world conditions.
• A plausible implication is that the emphasis on fine-grained, per-entity and per-cluster density estimation supports not only higher accuracy but also reduces false positives.

MTGFlow also produces decomposed entity-level anomaly scores, supporting root-cause localization and interpretability essential in complex monitoring and industrial scenarios.

7. Practical Considerations and Future Directions

MTGFlow’s unsupervised, density-based methodology is designed for scenarios where collecting clean normal data is infeasible. Its robustness to training set contamination, along with interpretability at the entity level, marks it as suitable for industrial, cyber-physical, and other sensor-rich applications.

Notable directions for further research include:

• Extension to continuous and streaming data environments.
• Investigation of advanced thresholding and mechanisms to minimize false positives.
• Incorporation of richer attention mechanisms or other deep learning components for enhanced spatio-temporal modeling.

MTGFlow represents a convergence of dynamic relational encoding and individualized density modeling, establishing a new paradigm for unsupervised MTS anomaly detection—validated across diverse datasets and robust to real-world data imperfections (Zhou et al., 2022, Zhou et al., 2023).