An Interpretable Method for Anomaly Detection in Multivariate Time Series Predictions

Anomaly detection methods for industrial control networks using multivariate time series usually adopt deep learning-based prediction models. However, most of the existing anomaly detection research only focuses on evaluating detection performance and rarely explains why data is marked as abnormal and which physical components have been attacked. Yet, in many scenarios, it is necessary to explain the decision-making process of detection. To address this concern, we propose an interpretable method for an anomaly detection model based on gradient optimization, which can perform batch interpretation of data without affecting model performance. Our method transforms the interpretation of anomalous features into solving an optimization problem in a normal “reference” state. In the selection of important features, we adopt the method of multiplying the absolute gradient by the input to measure the independent effects of different dimensions of data. At the same time, we use KSG mutual information estimation and multivariate cross-correlation to evaluate the relationship and mutual influence between different dimensional data within the same sliding window. By accumulating gradient changes, the interpreter can identify the attacked features. Comparative experiments were conducted on the SWAT and WADI datasets, demonstrating that our method can effectively identify the physical components that have experienced anomalies and their changing trends.