An Evaluation of Anomaly Detection and Diagnosis in Multivariate Time
  Series
  Several techniques for multivariate time series anomaly detection have been
proposed recently, but a systematic comparison on a common set of datasets and
metrics is lacking. This paper presents a systematic and comprehensive
evaluation of unsupervised and semi-supervised deep-learning based methods for
anomaly detection and diagnosis on multivariate time series data from
cyberphysical systems. Unlike previous works, we vary the model and
post-processing of model errors, i.e. the scoring functions independently of
each other, through a grid of 10 models and 4 scoring functions, comparing
these variants to state of the art methods. In time-series anomaly detection,
detecting anomalous events is more important than detecting individual
anomalous time-points. Through experiments, we find that the existing
evaluation metrics either do not take events into account, or cannot
distinguish between a good detector and trivial detectors, such as a random or
an all-positive detector. We propose a new metric to overcome these drawbacks,
namely, the composite F-score ($Fc_1$), for evaluating time-series anomaly
detection.
  Our study highlights that dynamic scoring functions work much better than
static ones for multivariate time series anomaly detection, and the choice of
scoring functions often matters more than the choice of the underlying model.
We also find that a simple, channel-wise model - the Univariate Fully-Connected
Auto-Encoder, with the dynamic Gaussian scoring function emerges as a winning
candidate for both anomaly detection and diagnosis, beating state of the art
algorithms.
