MSCENet: A Multi-Scale Correlation Enhanced Network for Anomaly Detection

Anomaly detection in time series has been extensively studied.Traditional statistical and machine learning approaches, such as ARIMA/VAR [15], PCA [16], SVM [17], wavelet analysis, and distance-based methods [18, 19], often fall short in handling the high-dimensional, complex dependencies characteristic of modern multivariate time series.

Recent years have seen substantial progress in deep learning-based approaches, which address the limitations of traditional methods by better capturing non-linear patterns and complex dependencies across multiple variables. Deep One-Class Classification (Deep-SVDD) models, for example, encapsulate normal time series behavior within a hypersphere, with anomalies detected as data points lying outside this boundary [20]. However, this approach assumes a consistent distribution of normal data, making it less effective in cases of concept drift. Encoder-Decoder Anomaly Detection (EncDecAD) employs Long Short-Term Memory (LSTM) networks to learn sequence features through reconstruction tasks, allowing for anomaly detection via reconstruction errors [21]. While EncDecAD handles temporal dependencies well, it may struggle with capturing complex inter-variable relationships. CTAD adopts the one-class contrastive loss to address the issue that traditional contrastive loss misjudges temporally related samples, yet the synthesis of its negative data augmentation still requires optimization[22]. In contrast, adversarial methods such as Unsupervised Anomaly Detection (USAD) [23] enhances reconstruction quality, yet their focus on adversarial training introduces computational complexity, which can be a limitation for real-time applications.

More recent advancements leverage stochastic and attention-based methods to capture long-term dependencies and subtle correlations across variables. OmniAnomaly [24] uses stochastic representations to address the inherent complexity in multivariate time series, particularly for tasks requiring robust handling of temporal dependencies. Transformers, with their self-attention mechanism, offer further improvements by identifying long-term interactions in time series data [25]. Notably, TranAD [26] and the Anomaly Transformer [27] employ self-regulating anomaly attention mechanisms with a min-max strategy to minimize reconstruction errors in normal data while amplifying deviations in anomalous data, leading to strong performance gains. Despite their advancements, current methods are often limited by biases and suboptimal anomaly scores, particularly in scenarios affected by concept drift.

Graph Neural Networks (GNNs) [28, 29, 30] have gained increasing prominence for modeling inter-series correlations, particularly in applications where capturing temporal dependencies is essential. These advancements illustrate GNNs’ capability to model complex relationships within multivariate data, but they also highlight certain limitations in their current configurations. Most existing GNN architectures assume a predefined graph structure based on static inter-node relationships. While this structure is effective for domains where spatial relationships are stable and well-defined, it becomes problematic for broader multivariate forecasting tasks where establishing a universal and static graph structure is often infeasible.

In fields such as finance, industrial monitoring, and environmental analysis, correlations between variables can vary significantly over time due to fluctuating conditions and context-dependent interactions, necessitating a more flexible graph structure to adapt to evolving inter-series relationships. To address these issues, recent research has explored adaptive, learnable graph structures [31, 32, 33] that seek to dynamically adjust inter-node relationships based on data-driven insights. Although these approaches represent a promising shift towards more flexible graph construction, they are often limited by the narrow range of graph structures they consider and by difficulties in adapting to temporal variations within inter-series correlations. Specifically, these adaptive GNNs frequently struggle to capture correlations that shift across different time scales, which can be crucial for accurately modeling complex and dynamic dependencies in multivariate time series data.

Before discussing the detailed aspects of the components previously described, the problem statement for this study is introduced. In a streaming environment, we analyze historical time series data $\mathcal{X}_{T}=\{x_{1},x_{2},\dots,x_{t}\}$, containing $N$ variables and observations with size $T$. For each time point $i$, we have $x_{i}\in\mathbb{R}^{N}$ and $\mathcal{X}_{T}\in\mathbb{R}^{N\times T}$, with $x_{i}=\{x_{i}^{1},x_{i}^{2},\dots,x_{i}^{N}\}$ denoting all observed variables. The aim is to label each point in $L=\{l_{1},l_{2},\dots,l_{t}\}$, where $l_{i}\in\{0,1\}$, with a label of “1” for anomalies and “0” for normal data points.

At a specific time step, a vector $x_{i}$ with size of $N$ is converted into an embedded representation $\hat{x}_{i}$, where the transformation is expressed as $x_{i}^{N}\to\hat{x}_{i}^{d_{\text{model}}}$. As a result, the overall embedding for the entire time series is represented as $\mathcal{X}_{T_{\text{emb}}}\in\mathbb{R}^{d_{\text{model}}\times T}$, with $d_{\text{model}}$ signifying the model’s dimensionality and $T$ denoting the length of the time series. We refer to the standardized input structure presented in the Informer framework [34] to effectively produce the embedding. In particular, $\mathcal{X}_{T_{\text{emb}}}$ is calculated with the following equation:

$$\mathcal{X}_{T_{\text{emb}}}=\alpha\mathrm{Conv}1\mathrm{D}(\mathcal{\hat{X}}_{T})+\mathbf{PE}+\sum_{p=1}^{P}\mathbf{SE}_{p}.$$

(1)

At the beginning, we standardize the input $\mathcal{X}_{T}$ to result in $\mathcal{\hat{X}}_{T}$, because this normalization process is known to enhance stationarity [35]. In the subsequent phase, $\mathcal{\hat{X}}_{T}$ is converted into a matrix of $d_{\text{model}}$ dimensions by applying 1-D convolution filters, which utilize 3 kernel widths and 1 stride length. The parameter $\alpha$ is utilized to align the scalar projection’s magnitude with the embeddings at fine and coarse levels. The positional embedding for input $\mathcal{X}_{T}$ is denoted as $\mathbf{PE}\in\mathbb{R}^{d_{\text{model}}\times T}$, providing each time step with a unique position-based encoding, which aids in capturing sequential dependencies. Additionally, the global timestamp embedding $\mathbf{SE}_{p}\in\mathbb{R}^{d_{\text{model}}\times T}$ is introduced, which is learnable and constrained to a vocabulary of 60, as minutes are recognized as the smallest unit of specificity. Here, the index $p$ represents different periodic or seasonal patterns embedded in the data, and the model sums these embeddings across $P$ distinct periodic features. This summation of multiple timestamp embeddings $\sum_{p=1}^{P}\mathbf{SE}_{p}$ allows the model to capture various temporal characteristics, such as daily, weekly, and monthly patterns, enhancing its ability to model complex time dependencies effectively.

MSCENet utilizes a residual approach for its implementation [36]. At the start, we establish $\mathcal{X}^{0}_{T}=\mathcal{X}_{T_{\text{emb}}}$, where $\mathcal{X}_{T_{\text{emb}}}$ denotes the raw input data enriched into features through the embedding matrix. In the $l$-th layer, the input $\mathcal{X}^{l-1}_{T}\in\mathbf{R}^{d_{\text{model}}\times T}$ is processed as shown below:

$$\mathcal{X}^{l}_{T}=\text{MSCEBlock}\left(\mathcal{X}^{l-1}_{T}\right)+\mathcal{X}^{l-1}_{T},$$

(2)

where MSCEBlock indicates the operations and calculations integral to the primary functions of the MSCENet layer.

This study focuses on enhancing the accuracy of anomaly detection through the exploration of correlations among multiple time series at different temporal scales. The choice of suitable time scales is a vital component of this methodology. We argue that periodicity, a specific kind of time scale, is a significantly useful resource for selecting scales. Our interest in periodicity arises from its critical significance in analyzing time series data. By recognizing repeated patterns, periodicity offers crucial insights into the anomaly detection process. For instance, during the peak summer and winter months, a significant positive correlation is frequently found between electricity demand and temperature, which weakens during the milder periods of spring and fall. Selecting the appropriate time scale can significantly influence how this correlation is quantitatively assessed. Variations in periodicity, whether daily or monthly, may lead to different values for the correlation coefficients.

To identify the optimal time scale for analyzing time series anomalies, we consider this step crucial in our detection approach. This is accomplished through the use of the Fast Fourier Transform ($\mathrm{FFT}$), a method influenced by the research presented in TimesNet [37]:

	$\displaystyle\mathbf{F}=\mathrm{Avg}\left(\mathrm{Amp}\left(\mathrm{FFT}(\mathcal{X}_{T}^{l-1})\right)\right),$		(3)
	$\displaystyle f_{1},\cdots,f_{k}=\underset{f_{*}\in\{1,\cdots,\frac{T}{2}\}}{\operatorname*{argTopk}}(\mathbf{F}),s_{i}=\frac{T}{f_{i}},$

where $\mathrm{Amp}(\cdot)$ calculates the magnitude or strength of each resulting frequency component, representing their relative contributions. The vector $\mathbf{F}\in\mathbb{R}^{L}$ captures the amplitude values for each frequency, which are averaged across the $d_{\text{model}}$ dimensions using the $\mathrm{Avg}(\cdot)$ function to obtain a stable representation of the dominant frequency characteristics. In this context, $f_{1},\cdots,f_{k}$ are the indices of the top $k$ frequencies with the highest amplitudes in $\mathbf{F}$, determined by the $\operatorname*{argTopk}$ function, and each corresponding scale $s_{i}$ is calculated as $s_{i}=\frac{T}{f_{i}}$, providing interpretable periodic intervals relevant to the anomaly detection task.

This study emphasizes the importance of recognizing that temporally varying inputs may reveal identifiable periodic behaviors, which allows our model to detect changing scales. We suggest that the critical correlations within this evolving periodicity are stable over time. Such a viewpoint calls for an examination of the dynamic attributes found in the inter-series and intra-series correlations articulated by our model.

By utilizing the specified time scales ${s_{1},\ldots,s_{k}}$, we generate diverse representations for different temporal scales through the transformation of the input data into 3D tensors, as demonstrated by the subsequent equation:

$$\mathcal{X}^{i}_{\mathrm{2D}}=\mathrm{Reshape}_{s_{i},f_{i}}(\mathrm{Padding}(\mathcal{X}_{T}^{l-1})),\quad i\in\{1,\ldots,k\},$$

(4)

in this context, employing $\mathrm{Padding}(\cdot)$ allows the time series to be extended with zeros through the temporal axis, which ensures it aligns with $\mathrm{Reshape}_{s_{i},f_{i}}(\cdot)$. For the time scale $i$, $\mathcal{X}^{i}_{\mathrm{2D}}\in\mathbb{R}^{d_{\text{model}}\times s_{i}\times f_{i}}$ denotes the restructured $\mathrm{2D}$ tensor for the $i$-th scale.

Recently, there has been growing interest in the use of image processing techniques to analyze time series data [38, 39]. The key idea of this approach is to transform standard time series patterns into visual images, which can then be analyzed to reveal significant spatial features. This transformation simplifies the complexities associated with time series data and makes it possible to apply advanced image analysis techniques, including convolutional neural networks (CNNs) and other deep learning strategies [37, 1]. The process begins with normalizing the time series data to ensure that variations due to scale or noise do not obscure the underlying patterns. Transforming time series data into images allows for the extraction of strong spatial features that are not immediately apparent in the raw data. This process improves predictive modeling, anomaly detection, and classification, providing researchers and practitioners with clear insights into data dynamics.

Many previous methods rely on standard convolution layers for feature extraction and learning, exploring a vast solution space without constraints. These approaches often start with random initial conditions, which limit their modeling capabilities and expressiveness [40, 41]. In contrast to these traditional techniques that directly obtain spatio-temporal features from raw data, our method adopts a different strategy. By addressing the limitations of standard convolutional networks, we introduce a fine-grained temporal convolution (FGTConv) specifically designed to capture intricate temporal relationships. This innovation enables a more effective balance between local and global characteristics over extended timeframes, enhancing the overall effectiveness of modeling for spatio-temporal data.

Our architecture, as illustrated in Fig. 2, comprises four convolutional layers, which include three dilated convolutions and one standard convolution, all operating concurrently to extract features. Atrous convolution, commonly known as dilated convolution, is a sophisticated technique that enables a model to expand its receptive field without increasing the number of parameters or the computational burden [42, 43]. By introducing ”gaps” (or zeros) between the elements of the kernel, dilated convolutions effectively capture a broader contextual representation from the input data, allowing the network to analyze a more extensive segment of the input signal. This methodology is particularly advantageous in time series analysis, where understanding dependencies across varying temporal scales is essential. The flexibility of adjustable dilation rates empowers the model to learn features at multiple scales, facilitating the detection of patterns that standard convolutions may overlook. Consequently, dilated convolutions enhance the model’s ability to identify both local and global temporal dependencies, thereby leading to more effective feature extraction [44, 45]. In the formulation of our FGTConv, we apply several types of difference convolutions, including central difference convolution (CDC), horizontal difference convolution (HDC), and vertical difference convolution (VDC), to incorporate traditional local descriptors. CDC enhances the model’s capacity by rearranging learned kernel weights to save computational cost and memory consumption [46]. HDC computes horizontal gradients by evaluating differences among selected pixel pairs, and the convolution kernel weights are rearranged after training for direct application to input features. Both HDC and VDC are designed to enhance gradient information, thus improving the model’s representational and generalization capabilities. The standard convolution is used to extract intensity-level data, while the difference convolutions emphasize gradient-level insights. Let $\mathcal{X}^{l,i}_{\mathrm{2D}}$ the represent the input feature map, the formulation can be expressed as follows:

$$\begin{gathered}\mathcal{X}^{i}_{\mathrm{FGTConv}}=\mathrm{FGTConv}(\mathcal{X}^{i}_{\mathrm{2D}})=\mathcal{X}^{i}_{\mathrm{2D}}*(\sum_{j=1}^{4}{w_{j}}{K_{i}})\\ =\mathcal{X}^{i}_{\mathrm{2D}}*K_{\text{combined}},\end{gathered}$$

(5)

where $\mathcal{X}^{i}_{\mathrm{FGTConv}}$ denotes the output of the FGTConv operation, $\mathrm{FGTConv(\cdot)}$ represents our proposed FGTConv function. The parameters $w_{j}$ are the learnable weights corresponding to each convolution type. $K_{j}$ for $j=1,\cdots,4$ signifies the kernels associated with standard convolution, CDC, HDC, and VDC, respectively. Notably, all convolutional layers utilize kernels with a size of $3\times 3$ and a stride of $1$, ensuring consistent spatial resolution across feature maps. The symbol $*$ indicates the convolution operation, while $K_{\text{combined}}$ represents the combined kernel that integrates the outputs of the parallel convolutions.

Time series analysis often neglects the diverse inter-series relationships across multiple time scales, which current deep learning models fail to capture effectively. This oversight is critical for anomaly detection. Spatial correlations among physiological signals, such as heart rate, blood pressure, and respiratory rate, can vary significantly, strengthening during emergencies to indicate heightened alertness and weakening under stable conditions. Similarly, in industrial systems, sensor readings reveal spatial dependencies among sensors that intensify during anomalies and diminish during normal operations. Fig. 3 illustrates that at one time scale, two time series may show a positive spatial relationship, while at a more granular scale, a negative correlation might emerge. These variations in spatial correlations across different time scales serve as crucial indicators of anomalies, providing valuable insights for detection. To effectively model these spatial correlations, we employ a graph-based approach that constructs distinct graph representations of inter-series relationships across time scales. This methodology enhances our ability to detect anomalies, offering a more nuanced analysis than traditional models. By learning spatial correlations through graph structures, we gain a deeper understanding of the intricate dynamics among time series.

Time series data frequently exhibit intricate dependencies due to varying intra-series and inter-series correlations, which have been the focus of various studies [47, 48]. To account for the influence of one instance’s state on others, we propose a module that utilizes the Mixhop graph convolution method. This approach is designed to effectively capture the intricate inter-series relationships within time series data, thereby enhancing the accuracy of its representation.

To accomplish this objective, we initially revert the tensor linked to the $i$-th scale into a tensor encompassing $N$ variables. The operation is implemented by means of a linear transformation, specified as follows:

$$\mathrm{H}^{i}=\mathbf{P}^{i}\mathcal{X}^{i}_{\mathrm{2D}},$$

(6)

where $\mathcal{H}^{i}\in\mathbb{R}^{N\times s_{i}\times f_{i}}$ represents the output tensor, while $\mathbf{P}^{i}$ is a learnable weight matrix specifically designed for the $i$-th scale tensor. This transformation allows for effective adaptation of the input data to the desired representation. As part of the graph learning process, we introduce two trainable parameter matrices $W_{i}^{1}$ and $W_{i}^{2}\in\mathbb{R}^{N\times h}$, which are used to compute an adaptive adjacency matrix as follows:

$$M^{i}=\text{SoftMax}(\text{ReLU}(W_{i}^{1}(W_{i}^{2})^{T})),$$

(7)

where $M^{i}$ represents the adjacency matrix for the $i$-th scale. To ensure a balanced representation of inter-series relationships, the $\text{SoftMax}(\cdot)$ function normalizes the weights between nodes. Inter-series correlations are then detected using the Mixhop graph convolution technique, employing the adjacency matrix $M^{i}$ as a foundational component. We present the definition of graph convolution in the following:

$$\mathrm{H}_{\text{out}}^{i}=\sigma\left(\bigg\|_{j\in\beta}(M^{i})^{j}\mathrm{H}^{i}\right),$$

(8)

where $\mathrm{H}_{\text{out}}^{i}$ denotes the output resulting from combination at scale $i$, the hyper-parameter $\beta$ comprises a collection of integer adjacency powers, $(M^{i})^{j}$ represents the learned adjacency matrix $M^{i}$ raised to the $j$-th power, $\parallel$ signifies a column-wise concatenation, which concatenates intermediate variables produced within each iteration, and $\sigma$ serving as the activation function. Following this procedure, we transform $\mathrm{H}_{\text{out}}^{i}$ back into a 3D tensor $\mathcal{X}_{\mathrm{GCN}}^{i}\in\mathbb{R}^{d_{\text{model}}\times s_{i}\times f_{i}}$ leveraging a multi-layer perceptron.

In contrast to the TSSRGCN approach [49], which employs a cycle-based dilated deformable convolution to effectively capture both long-term and short-term temporal dynamics in traffic data, we present a novel approach utilizing multi-scale gated convolution to effectively fuse spatial and temporal features in time series analysis. In Fig. 4, the specific architecture of the module is presented, composed of three Gated Tanh Unit (GTU) [50] modules that have differing receptive fields [51]. Before extracting multi-scale features, we first combine the outputs from Section. III-D and Section. III-E. This integration can be mathematically represented as:

$$\mathcal{X}^{i}_{\text{combined}}=\mathcal{X}^{i}_{\mathrm{FGTConv}}+\mathcal{X}_{\mathrm{GCN}}^{i},$$

(9)

the summation effectively merges the spatial information captured through Mixhop graph convolutions with the temporal features extracted by FGTConv.

Subsequently, we apply a series of 1D causal convolutions with different kernel sizes $S_{1}$, $S_{2}$, $S_{3}$ on $\mathcal{X}^{i}_{\text{combined}}$ to extract multi-scale features from the time series data. This methodology enables the model to capture dependencies at various temporal scales, thereby offering an integrated portrayal of the temporal dynamics. Simultaneously, the channel dimension is projected to $2d_{\text{model}}$ to enhance feature capacity. The resulting feature maps are computed as follows:

$\displaystyle\mathcal{X}_{S_{j}}^{i}=\mathrm{Conv}_{1\times S_{j}}(\mathcal{X}^{i}_{\text{combined}}),\quad j\in\{1,2,3\}$

(10)

where $\mathcal{X}_{S_{j}}^{i}\in\mathbb{R}^{2d_{\text{model}}\times s_{i}\times(f_{i}-S_{j}+1)}$, and $S_{j}$ corresponds to the kernel sizes of $1\times 3$, $1\times 5$, and $1\times 7$ for $j\in\{1,2,3\}$ respectively, in our implementation. By leveraging multiple receptive fields through these different kernel sizes, the model gains the flexibility to identify patterns that may be otherwise overlooked with a single fixed-scale convolution. This hierarchical, multi-scale approach enhances the model’s representation of temporal dynamics, supporting more robust and nuanced time series analysis. To regulate the flow of information and introduce nonlinearity, we implement a gate mechanism through the use of GTUs. Specifically, we partition the input tensor along the channel dimension into two equal parts, allowing for selective modulation of information as below:

$$\mathcal{E},\mathcal{F}=\mathrm{Split}(\mathcal{X}_{S_{j}}^{i}),$$

(11)

where $\mathcal{E}$, $\mathcal{F}\in\mathbb{R}^{d_{\text{model}}\times s_{i}\times(f_{i}-S_{j}+1)}$ represent the two halves of the feature map $\mathcal{X}_{S_{j}}$ after it has been split along the channel dimension. We then define the output of the GTU using a gating mechanism as follows:

$$\mathcal{\hat{X}}_{S_{j}}^{i}=\tanh(\mathcal{E})\odot\sigma(\mathcal{F}),$$

(12)

where $\mathcal{\hat{X}}_{S_{j}}^{i}\in\mathbb{R}^{d_{\text{model}}\times s_{i}\times(f_{i}-S_{j}+1)}$ contains the gated multi-scale features, while $\tanh(\cdot)$ is the activation function applied to $\mathcal{E}$ and $\sigma(\cdot)$ generates gating weights from $\mathcal{F}$. The symbol $\odot$ denotes element-wise multiplication , which combines $\tanh(\mathcal{E})$ and $\sigma(\mathcal{F})$ to selectively allow information to pass based on the gating values. After obtaining the gated multi-scale features $\mathcal{\hat{X}}_{S_{j}}$ for each receptive field size, we concatenate these feature maps along the temporal dimension to integrate information across different scales. This operation can be expressed as:

$$\mathcal{H}^{i}=\mathrm{CONCAT}(\mathcal{\hat{X}}_{S_{1}}^{i},\mathcal{\hat{X}}_{S_{2}}^{i},\mathcal{\hat{X}}_{S_{3}}^{i}),$$

(13)

where $\mathcal{H}^{i}\in\mathbb{R}^{d_{\text{model}}\times s_{i}\times(3f_{i}-{S_{1}}-{S_{2}}-{S_{3}}+3)}$ contains the combined multi-scale features across all three receptive fields. This concatenation along the temporal dimension provides a comprehensive representation that captures both short-term and long-term dependencies within the time series data. Following the concatenation, we apply a max pooling layer with a kernel size $W=2$ along the temporal dimension to further reduce the dimensionality and focus on the most relevant temporal information:

$$\mathcal{H}_{\text{pooled}}^{i}=\mathrm{Pooling}(\mathcal{H}^{i}),$$

(14)

where $\mathcal{H}_{\text{pooled}}^{i}\in\mathbb{R}^{d_{\text{model}}\times s_{i}\times\frac{(3T-(S_{1}+S_{2}+S_{3}-3))}{W}}$. This pooling operation helps compress the temporal dimension while retaining essential patterns from the concatenated features. To maintain consistency with the original time dimension, a linear transformation could be applied to $\mathcal{H}_{\text{pooled}}^{i}$ to directly project it back to the original time dimension $T$. This step ensures compatibility with downstream layers and helps retain the temporal resolution needed for effective analysis.

Finally, we add a residual connection by combining $\mathcal{H}_{\text{pooled}}^{i}$ with the original input $\mathcal{X}^{i}_{\text{combined}}$, and a ReLU activation is applied to obtain the output from the multi-scale gated convolution module:

$$\mathcal{Z}^{i}=\mathrm{ReLU}(\mathcal{H}_{\text{pooled}}^{i}+\mathcal{X}^{i}_{\text{combined}}),$$

(15)

where $\mathcal{Z}^{i}\in\mathbb{R}^{d_{\text{model}}\times s_{i}\times f_{i}}$. To move to the next layer, we aggregate the $k$ scale tensors, $\mathcal{Z}^{1},\cdots,\mathcal{Z}^{k}$. First, each tensor is reshaped into a 2-way matrix $\hat{\mathcal{Z}}^{i}\in\mathbb{R}^{d_{\text{model}}\times T}$, then the scales are combined according to their amplitudes:

	$\displaystyle\hat{a}_{1},\cdots,\hat{a}_{k}=$	$\displaystyle\mathrm{SoftMax}(\mathbf{F}_{f_{1}},\cdots,\mathbf{F}_{f_{k}}),$		(16)
	$\displaystyle\mathcal{\hat{Z}}=$	$\displaystyle\sum_{i=1}^{k}\hat{a}_{i}\mathcal{\hat{Z}}^{i}.$

For each scale $i$, the FFT is applied to compute the amplitudes $\mathbf{F}_{f{1}},\cdots,\mathbf{F}_{f{k}}$, and the $\text{SoftMax}(\cdot)$ function is then used to compute the final amplitudes $\hat{a}_{1},\cdots,\hat{a}_{k}$.

By measuring the reconstruction error, which compares the original data with the model’s output, we can detect anomalies in time series data. Larger errors highlight abnormal behaviors, enhancing the detection process. To begin the process, a feed-forward network is applied to each reshaped tensor to map it into the reconstruction space $\hat{\mathcal{Y}}_{t}\in\mathbb{R}^{N}$, as follows:

$$\hat{\mathcal{Y}}_{t}=\text{FeedForward}(\mathcal{\hat{Z}}).$$

(17)

During training, the sensor embeddings and other neural network weights are updated based on the mean squared error between $\mathcal{Y}_{t}$ and $\hat{\mathcal{Y}}_{t}$, without the computation of anomaly scores. In the testing phase, the L2 loss between the predicted is computed.

$$\mathrm{AnomalyScore}_{t}=\frac{1}{N}\sum_{n=1}^{N}\left(\left(\|\hat{\mathcal{Y}}_{t}-\mathcal{Y}_{t}\|_{2}\right)\right).$$

(18)

Ultimately, when the anomaly score exceeds the preset threshold, we classify the time step $t$ as an anomaly. The threshold is determined by the mean anomaly score on the validation set in our approach. The proportion of training data to validation data reflects the degree to which anomalies are spread throughout the dataset.

The data for experimentation is drawn from three unique sources, each with specific dimensional characteristics and properties.

• •

  SMD (Server Machine Dataset) [24]: Collected over a period of five weeks, the resource utilization of different machines in a large-scale computing cluster at an online company is recorded in this dataset.

• •

  PSM (Pooled Server Metrics) [52]: This dataset, with 26 different dimensions, is sourced from various eBay application server nodes within the internal network.

• •

  SWaT (Secure Water Treatment) [53]: This dataset originates from 51 sensors situated in a vital facility system, which operates continuously without any interruptions.

The performance of time series anomaly detection is commonly evaluated using three key metrics: precision, recall, and F1-score (F1). For detecting anomalies, we follow the established point adjustment method, marking the entire segment as anomalous when any data point in it is flagged. Consequently, our focus is on detecting anomalies in time series without supervision. Unsupervised anomaly detection in time series encounters substantial challenges in practical scenarios. The system needs to extract meaningful representations from intricate temporal patterns using unsupervised methods and formulate a unique criterion that can identify infrequent anomalies amidst numerous normal data points.

• •

  Isolation Forest [54]: In unsupervised anomaly detection, Isolation Forest isolates anomalies by building random decision trees, where anomalies are identified due to their shorter path lengths. For time series data, it uses sliding windows to compute anomaly scores, making it effective for high-dimensional datasets, though sensitive to hyper parameters.

• •

  Deep-SVDD [20]: Deep-SVDD earns latent representations through a deep neural network and applies a spherical boundary for anomaly detection. However, Deep-SVDD optimizes the latent representations and the anomaly detection boundary separately, which may limit the alignment between the representations and the anomaly detection task.

• •

  OmniAnomaly [24]: OmniAnomaly is a probabilistic recurrent neural network that captures standard patterns in multivariate time series by creating strong representations, utilizing methods such as stochastic variable connections and planar normalizing flow. Anomalies are identified based on reconstruction probabilities, and OmniAnomaly also provides interpretability by analyzing the reconstruction probabilities of each univariate component.

• •

  GDN [9]: GDN learns feature dependencies via graph structure learning and uses GAT to derive temporal features, functioning as a traditional prediction-oriented anomaly detection technique.

• •

  InterFusion [55]: By utilizing a hierarchical Variational AutoEncoder with two stochastic latent variables, InterFusion is an unsupervised method that models inter-metric and temporal dependencies in multivariate time series, capturing low-dimensional embeddings for each of these dependencies. It also employs an MCMC-based method for anomaly interpretation by localizing the most anomalous metrics.

• •

  TranAD [26]: TranAD combines Transformer architecture for efficient sequence encoding, adversarial training for minimizing reconstruction errors, and model-agnostic meta-learning to enhance the speed of inference, offering an integrated solution to anomaly detection.

• •

  TimesNet [37]: By using a 2D mapping of 1D time series, TimesNet captures detailed time-based changes over several periods. By embedding intraperiod and interperiod variations into 2D tensors, TimesNet leverages 2D kernels for effective temporal modeling, making it suitable for forecasting, classification, and anomaly detection.

According to the pre-processing strategy in Anomaly Transformer [27], using a sliding window, we divide the dataset into consecutive, non-overlapping sections. We set a sliding window size of 100 to capture sequential patterns effectively. For all datasets, embedding vectors of length 64, a batch size of 128, and hidden layers with 64 neurons are employed to ensure a balanced model complexity. The Adam optimizer with a learning rate of $1\times 10^{-3}$ is used to ensure stable convergence, while training is limited to 20 epochs, and early stopping is implemented with a patience of 5 epochs. For enhanced accuracy, the top-K is set to 5, the Mixhop order is set to 2, and the output layers are configured to 2. Baseline data and code are sourced from relevant papers and official repositories.

Experiments are performed using an Ubuntu 20.04 operating system, powered by a 15 vCPU Intel(R) Xeon(R) Platinum 8474C @ 2.1 GHz CPU, 80 GB RAM, and a GeForce RTX 4090D (24GB) graphics card.

Table III summarizes the experimental results, providing a comparison of the performance of different anomaly detection methods on the SMD, PSM, and SWaT datasets. Our proposed method consistently outperforms existing approaches across all metrics, showcasing the effectiveness of the multi-scale correlation enhanced framework. To further explain these findings, we offer a detailed comparison and explore the specific contributions of our model, providing insights into each dataset and contrasting it with baseline methods.

For the SMD dataset, traditional methods like Isolation Forest struggle with these dependencies, achieving a relatively low F1-score of 53.64%, with a precision of 42.31% and recall of 73.29%. This disparity indicates that Isolation Forest struggles to balance between detecting true anomalies and minimizing false positives, reflecting its limited capability for handling multivariate time series data. More advanced models like Deep-SVDD and GDN achieve improved performance, with F1-scores of 79.10% and 83.42%, respectively. Deep-SVDD, with a precision of 78.54% and recall of 79.67%, demonstrates a balanced approach but still lacks depth in capturing complex inter-series relationships. Although GDN achieves a recall rate of 99.74%, its precision of 71.70% indicates that it suffers from a high number of false positives, likely because of its limited ability to capture the complex interdependencies between variables. In contrast, models like OmniAnomaly, InterFusion, and TimesNet benefit from temporal modeling capabilities, achieving F1-scores above 84%. Specifically, OmniAnomaly reaches a precision of 83.68% and recall of 86.82%, showing a balanced performance. However, these models lack multi-scale analysis and dynamic spatial learning, limiting their ability to adapt to varying inter-series correlations over time. MSCENet, with its innovative integration of multi-scale analysis and graph-based spatial learning, efficiently captures both transient and sustained dependencies. This design enables MSCENet to achieve a significantly higher F1-score of 86.68%, with a precision of 88.24% and recall of 85.71%.

For the PSM dataset, traditional approaches like Isolation Forest demonstrate limited capability, with an F1-score of 83.48%, a precision of 76.09%, and a high recall of 92.45%. While Isolation Forest manages to detect a large portion of anomalies, its relatively low precision suggests that it generates numerous false positives, limiting its reliability. Advanced models such as Deep-SVDD and TranAD exhibit differing recall rates, with Deep-SVDD achieving a relatively strong recall of 86.49%, indicating its capacity to identify anomalies, while TranAD’s more moderate recall of 76.74% suggests it may miss some anomalies in the dataset. Although Deep-SVDD and TranAD achieve F1-scores of 90.73% and 85.17%, respectively, along with corresponding precisions of 95.41% and 95.67%, their overall performance remains limited in handling the complex temporal structures of the dataset, which may lead to either missed anomalies or false positives in certain cases. TimesNet significantly outperforms InterFusion on the PSM dataset, with an F1-score of 94.45% compared to InterFusion’s 83.52%. TimesNet achieves a high precision of 98.56% and recall of 90.66%, demonstrating its strength in temporal modeling, though it lacks flexibility for dynamic inter-series relationships. InterFusion, with a precision of 83.61% and recall of 83.45%, offers a more balanced but less optimal performance due to its lack of a multi-scale or graph-based approach. MSCENet, by contrast, achieves a superior F1-score of 97.29%, with a precision of 98.44% and recall of 96.17%. This strong balance between precision and recall underscores MSCENet’s ability to leverage multi-scale temporal feature extraction and dynamic spatial learning, allowing it to adapt to evolving dependencies across time and features.

For the SWaT dataset, advanced methods such as GDN and OmniAnomaly achieve reasonable F1-scores of 81.01% and 82.83%, respectively. Notably, GDN has a high precision of 96.97%, indicating effectiveness in minimizing false positives. However, its low recall of 69.57% suggests that it misses a significant number of true anomalies, reflecting its limitations in capturing all anomalous patterns within the dataset. OmniAnomaly, on the other hand, achieves a more balanced performance with a precision of 81.42% and a recall of 84.30%, but its F1-score remains lower due to difficulties in adapting to SWaT’s complex dependencies and varying temporal scales. More advanced models like InterFusion, TranAD, and TimesNet demonstrate an improved balance between precision and recall. InterFusion achieves an F1-score of 83.01%, with a precision of 80.59% and recall of 85.58%, while TranAD attains an F1-score of 88.28%, with precision and recall of 87.99% and 88.58%, respectively. TimesNet, with its strong temporal modeling capabilities, achieves a high F1-score of 88.90%, precision of 86.32%, and recall of 91.64%. While these models perform well overall, they still lack the robustness required to consistently handle dynamic inter-series relationships across diverse time scales, leading to either missed anomalies or false positives. In contrast, MSCENet achieves a superior F1-score of 90.09%, with a precision of 97.53% and recall of 83.70%, significantly outperforming existing methods. This careful balance of high precision and recall demonstrates MSCENet’s remarkable ability to accurately detect anomalies, significantly reducing both false positives and instances of missed detections. Its multi-scale gated convolution mechanism allows it to effectively adapt to different temporal scales, capturing both short-term and long-term dependencies, making it highly effective for detecting anomalies.

As illustrated in Fig. 5 MSCENet consistently surpasses competing methods on the SMD, PSM, and SWaT datasets, achieving the highest average F1-score (91.35%), precision (94.73%), and recall (88.52%), showcasing its robustness and adaptability for multivariate time series anomaly detection. In contrast to conventional approaches such as Isolation Forest, which struggle with complex temporal and spatial dependencies, MSCENet balances precision and recall effectively, reducing false positives while maintaining high accuracy. Advanced models such as Deep-SVDD, OmniAnomaly, GDN, InterFusion, TranAD and TimesNet capture some temporal dependencies but lack the flexibility for dynamic inter-series relationships and multi-scale adaptation, often resulting in missed anomalies or false positives. By integrating multi-scale temporal features and leveraging graph-based spatial learning, MSCENet captures dependencies at different scales. This flexibility allows it to handle complex datasets that feature continuously evolving dependencies, thereby achieving highly precise anomaly detection.

To understand the impact of individual components on the MSCENet framework, a series of ablation experiments are performed. In these experiments, we systematically removed or modified key components of the model, including the fine-grained temporal convolution module, the spatial correlation learning module, and the multi-scale gated convolution mechanism, to evaluate their influence on anomaly detection effectiveness across all datasets.

• •

  w/o FGTConv: The FGTConv layer in MSCENet is crucial for modeling complex time dependencies in time series data through dilated convolutions, which extend the receptive field without additional computational cost. This allows the model to capture both immediate and extended patterns, which are key for detecting anomalies with high accuracy. Removing FGTConv leads to notable performance declines across datasets. For instance, on the SMD dataset, precision drops from 88.24% to 88.09% and recall from 85.71% to 83.02%, indicating reduced sensitivity to true anomalies. Similarly, on the PSM dataset, F1-score decreases from 97.29% to 95.54%, underscoring the module’s importance for detecting multi-scale temporal patterns. Theoretically, FGTConv enhances MSCENet’s ability to capture anomalies manifesting across diverse scales, which is particularly valuable in applications like industrial monitoring and finance, where both transient and gradual trends may signal critical anomalies. The observed drops in recall emphasize FGTConv’s role in strengthening MSCENet’s sensitivity to temporal anomalies, supporting robust detection across complex, multivariate time series.

• •

  w/o GConv: The spatial correlation learning module in MSCENet is essential for capturing inter-series relationships by dynamically constructing a graph of multivariate time series data, allowing the model to detect anomalies driven by complex inter-variable interactions. Removing GConv results in consistent declines across metrics. For instance, on the SMD dataset, F1-score decreases from 86.68% to 84.28%, precision from 88.24% to 87.88%, and recall from 85.71% to 80.97%. Similarly, on the PSM dataset, the F1-score drops from 97.29% to 95.70%, with recall falling from 96.17% to 92.93%, indicating that MSCENet’s sensitivity to true anomalies weakens without GConv. Theoretically, GConv supports spatial dependency modeling, aligning with graph-based approaches that reflect dynamic inter-variable relationships. Practically, its presence is vital for real-world applications, such as industrial monitoring, where anomalies often result from evolving inter-series dependencies. The declines in certain metrics, particularly recall and F1-score, underscore GConv’s critical role in enhancing MSCENet’s robustness and adaptability for multivariate anomaly detection.

• •

  w/o GatedConv: The multi-scale gated convolution in MSCENet is crucial for fusing spatial and temporal features across multiple receptive fields, enabling the model to capture dependencies at various temporal scales and adapt to diverse anomaly patterns. When GatedConv is removed, we observe consistent declines in precision, recall, and F1-score across all datasets. The F1-score on the SMD dataset falls from 86.68% to 85.27%, precision decreases from 88.24% to 87.78%, and recall drops from 85.71% to 82.91%, signaling a reduction in the model’s capacity to detect real anomalies and avoid false positives. Similarly, on the SWaT dataset, the F1-score drops from 90.09% to 88.13%, with notable declines in recall, emphasizing that GatedConv strengthens the model’s balance between sensitivity and specificity. Theoretically, GatedConv’s multi-scale design aligns with hierarchical temporal processing principles, allowing MSCENet to capture short- and long-term patterns essential for nuanced anomaly detection. Practically, it is valuable for real-world applications, such as industrial monitoring, where detecting multi-scale anomalies can prevent costly failures. Declines in recall and F1-score emphasize GatedConv’s role in capturing multi-scale temporal dependencies, critical for MSCENet’s robustness, even as precision remains stable.