Causality-Based Multivariate Time Series Anomaly Detection
Anomaly detection in multivariate time series plays an important role in
monitoring the behaviors of various real-world systems, e.g., IT system
operations or manufacturing industry. Previous approaches model the joint
distribution without considering the underlying mechanism of multivariate time
series, making them complicated and computationally hungry. In this paper, we
formulate the anomaly detection problem from a causal perspective and view
anomalies as instances that do not follow the regular causal mechanism to
generate the multivariate data. We then propose a causality-based anomaly
detection approach, which first learns the causal structure from data and then
infers whether an instance is an anomaly relative to the local causal mechanism
to generate each variable from its direct causes, whose conditional
distribution can be directly estimated from data. In light of the modularity
property of causal systems, the original problem is divided into a series of
separate low-dimensional anomaly detection problems so that where an anomaly
happens can be directly identified. We evaluate our approach with both
simulated and public datasets as well as a case study on real-world AIOps
applications, showing its efficacy, robustness, and practical feasibility.