Graph based anomaly detection improves multivariate time series analysis
Graph-Spectral Flow Matching for Multivariate Time Series Anomaly Detection
Machine Learning
Summary
Detecting unusual events in multiple related time series is hard because variables affect each other in complex ways. The authors present a method called GRASP that uses graph information linking variables to better model normal behavior and spot anomalies. Their approach creates paths that respect these connections, improving detection accuracy. Tests on real datasets show GRASP works better than current methods.
What this means in practice
- •For industrial monitoring teams: Improve detection of abnormal system behavior in multivariate sensor data by using graph-informed anomaly scores.
- •For financial risk managers: Identify unusual patterns in interconnected financial indicators more reliably by leveraging dependencies in multivariate time series.
Authors
Zepeng Zhang, Jhony H. Giraldo, Wenbin Wang, Olga Fink
Abstract
Multivariate time series anomaly detection typically relies on evaluating discrepancies between observations and outputs produced by models trained on normal data. An alternative perspective is to characterize the distribution of normal data through the generative dynamics, i.e., the velocity field, of flow matching models. However, standard flow matching typically adopts linear probability paths that overlook dependencies among variables, leading to a misalignment with the structured data distribution. To address this issue, we propose GRASP, a flow matching framework with a graph-spectral path for multivariate time series anomaly detection. GRASP incorporates graph structure into the probability path by minimizing a fixed-endpoint action that combines kinetic energy with graph Dirichlet energy. This formulation yields a closed-form path based on graph-frequency-dependent hyperbolic interpolation. A velocity predictor trained on normal data then detects anomalies using weighted velocity discrepancies aggregated across source samples, flow times, and graph frequencies. Theoretically, we establish that GRASP is invariant to the choice of Laplacian eigenbasis and decompose its expected oracle anomaly score into bounded endpoint uncertainty and graph-frequency-weighted Fisher discrepancy. Experiments on four benchmarks demonstrate the superior anomaly detection performance of GRASP and validate the effectiveness of its graph-spectral path and weighting mechanism.