Graph‐based Bayesian network conditional normalizing flows for multiple time series anomaly detection

Various devices and sensors of cyber‐physical systems interact with each other in time and space, and the generated multiple time series have implicit correlations and highly nonlinear relationships. Determining how to model the multiple time series and capture dependencies through extracting features is the key to anomaly detection. In this paper, we propose a graph‐based Bayesian network conditional normalizing flows model for multiple time series anomaly detection, Bayesian network conditional normalizing flows (BNCNF). It applies a Bayesian network to model the causal relationships of multiple time series and introduces a spectral temporal dependency encoder to obtain the representations of interdependency between multiple time series. The representations are introduced as conditional information into the normalizing flows for density estimation, and the data corresponding to low density is judged as anomalies. The experiment are conducted on SWaT, WADI, and SMD datasets, the F1 score reaches 0.95, 0.92, and 0.97 on the three datasets, respectively. The results show that BNCNF has better performance in anomaly detection compared with the current mainstream methods.