Unsupervised Anomaly Detection in Multivariate Time Series across Heterogeneous Domains

2025-03-29

AI Summary

To address domain shift—i.e., drift in normal behavior—under unsupervised anomaly detection for heterogeneous-domain multivariate time series in AIOps, this paper pioneers the introduction of domain generalization to this task, proposing the Domain-Invariant Variational Autoencoder (DIVAD). Methodologically, DIVAD employs a variational autoencoder for robust cross-domain representation learning, integrates adversarial training to disentangle domain-specific features, and constructs a lightweight anomaly scoring mechanism based on reconstruction error. On the Exathlon benchmark, DIVAD achieves peak F1-score improvements of 20% and 15% over state-of-the-art methods; its strong cross-domain generalization capability is further validated on the Application Server dataset. This work establishes the first unsupervised, domain-generalization-oriented framework for time-series anomaly detection, overcoming the conventional reliance on static normal patterns.

Technology Category

• Machine Learning: Transfer, Domain Adaptation, Multi-Task Learning
• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Application Domains: Internet of Things, Sensor Networks & Smart Cities

Application Category

• Search and Retrieval-Augmented AI: Vertical and domain-specific search
• Graph Algorithms and Modeling for the Web: Algorithms and analysis for heterogeneous, signed, attributed, multi-relational, temporal, higher-order, and annotated Web-related graphs
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

The widespread adoption of digital services, along with the scale and complexity at which they operate, has made incidents in IT operations increasingly more likely, diverse, and impactful. This has led to the rapid development of a central aspect of"Artificial Intelligence for IT Operations"(AIOps), focusing on detecting anomalies in vast amounts of multivariate time series data generated by service entities. In this paper, we begin by introducing a unifying framework for benchmarking unsupervised anomaly detection (AD) methods, and highlight the problem of shifts in normal behaviors that can occur in practical AIOps scenarios. To tackle anomaly detection under domain shift, we then cast the problem in the framework of domain generalization and propose a novel approach, Domain-Invariant VAE for Anomaly Detection (DIVAD), to learn domain-invariant representations for unsupervised anomaly detection. Our evaluation results using the Exathlon benchmark show that the two main DIVAD variants significantly outperform the best unsupervised AD method in maximum performance, with 20% and 15% improvements in maximum peak F1-scores, respectively. Evaluation using the Application Server Dataset further demonstrates the broader applicability of our domain generalization methods.

Problem

• Detecting anomalies in multivariate time series data
• Addressing normal behavior shifts in AIOps scenarios
• Learning domain-invariant representations for anomaly detection

Innovation

• Unsupervised anomaly detection in multivariate time series
• Domain-Invariant VAE for Anomaly Detection (DIVAD)
• Domain generalization for invariant representations