Semantic Embedding-Driven Topology Extraction with Correlation Lag Awareness

Feiyi Chen, Yifei Wang, Leilei Zhang, Guanjie Cheng, zhihao zhuang, Roger Zimmermann, Shuiguang Deng

Keywords: Time series anomaly detection, Topology Extraction, LLM

TL;DR: propose a method construct topology from LLM word embeddings automatically and model the cross-dimensional correlation lag

Abstract: Many application scenarios involve anomaly detection of multivariate time series, which exhibit complicated dependencies across different dimensions governed by physical laws or system design. Though such cross-dimensional dependencies usually serve as important references for human experts to detect anomalies from monitoring data, the algorithms in this domain have not explored and leveraged them thoroughly. On the one hand, many algorithms incorporating graph networks to model the cross-dimensional dependencies require establishing the topology manually. However, in many real-world application scenarios, there are usually thousands of indicators, such as complex IoT systems, aircraft control systems, and so on. Constructing such topologies manually is laborious, as the complexity of defining them grows quadratically with the number of dimensions. On the other hand, graph networks usually assume fixed and instantaneous dependencies, but we observe pronounced cross-dimensional correlation lag in complex system monitoring data, indicating that dependencies across dimensions are not static but dynamically shift with time intervals. To address these issues, we propose an Anomaly Detection Method Capturing Semantic Topology and Correlation lag (ADSec), which extracts topology from expert documents and monitoring data automatically and successfully models the cross-dimensional correlation lag. Specifically, ADSec extracts a semantic topology from expert documents and refines it with monitoring data. Besides, it leverages a novel Neural Hawkes process to model the cross-dimensional correlation lag and adjust the topology dynamically. Extensive experiments on four real-world datasets demonstrate that ADSec improves F1 Score by 5.8% averagely on multivariate time series with complex inter-dimension dependencies, compared with SOTA anomaly detection methods.

Primary Area: learning on time series and dynamical systems

Submission Number: 5760