Time series anomaly detection (TSAD) plays a vital role in various domains
such as healthcare, networks, and industry. Considering labels are crucial for
detection but difficult to obtain, we turn to TSAD with inexact supervision:
only series-level labels are provided during the training phase, while
point-level anomalies are predicted during the testing phase. Previous works
follow a traditional multi-instance learning (MIL) approach, which focuses on
encouraging high anomaly scores at individual time steps. However, time series
anomalies are not only limited to individual point anomalies, they can also be
collective anomalies, typically exhibiting abnormal patterns over subsequences.
To address the challenge of collective anomalies, in this paper, we propose a
tree-based MIL framework (TreeMIL). We first adopt an N-ary tree structure to
divide the entire series into multiple nodes, where nodes at different levels
represent subsequences with different lengths. Then, the subsequence features
are extracted to determine the presence of collective anomalies. Finally, we
calculate point-level anomaly scores by aggregating features from nodes at
different levels. Experiments conducted on seven public datasets and eight
baselines demonstrate that TreeMIL achieves an average 32.3% improvement in F1-
score compared to previous state-of-the-art methods. The code is available at
this https URL

这篇研究提出了一种基于树的多示例学习框架（TreeMIL），用于解决时间序列异常检测中的集体异常问题，并在七个公共数据集和八种基线方法上进行实验证明，相较于先前最先进的方法，TreeMIL 的 F1 得分平均提高了 32.3%。

TreeMIL: 多实例学习框架用于时间序列异常检测与不精确监督

TreeMIL: A Multi-instance Learning Framework for Time Series Anomaly  Detection with Inexact Supervision

In the era of digital transformation, systems monitored by the Industrial
Internet of Things (IIoTs) generate large amounts of Multivariate Time Series
(MTS) data through heterogeneous sensor networks. While this data facilitates
condition monitoring and anomaly detection, the increasing complexity and
interdependencies within the sensor network pose significant challenges for
anomaly detection. Despite progress in this field, much of the focus has been
on point anomalies and contextual anomalies, with lesser attention paid to
collective anomalies. A less addressed but common variant of collective
anomalies is when the abnormal collective behavior is caused by shifts in
interrelationships within the system. This can be due to abnormal environmental
conditions like overheating, improper operational settings resulting from
cyber-physical attacks, or system-level faults. To address these challenges,
this paper proposes DyGATAD (Dynamic Graph Attention for Anomaly Detection), a
graph-based anomaly detection framework that leverages the attention mechanism
to construct a continuous graph representation of multivariate time series by
inferring dynamic edges between time series. DyGATAD incorporates an operating
condition-aware reconstruction combined with a topology-based anomaly score,
thereby enhancing the detection ability of relationship shifts. We evaluate the
performance of DyGATAD using both a synthetic dataset with controlled varying
fault severity levels and an industrial-scale multiphase flow facility
benchmark featuring various fault types with different detection difficulties.
Our proposed approach demonstrated superior performance in collective anomaly
detection for sensor networks, showing particular strength in early-stage fault
detection, even in the case of faults with minimal severity.

本文提出了一种基于图的异常检测框架 DyGATAD，利用注意机制构建多变量时间序列的连续图表示，并推断时间序列之间的动态边。DyGATAD 结合了基于操作条件感知的重构和基于拓扑的异常评分，从而增强了对关系变化的检测能力，在传感器网络中展示了卓越的集体异常检测性能，尤其在最小严重度故障的早期检测方面表现出特殊优势。