Detecting Multivariate Time Series Anomalies With Cascade Decomposition Consistency

Multivariate time series anomaly detection is crucial in sensitive domains such as cybersecurity and grid monitoring, significantly contributing to the reliability and safety of system operation. However, current methods suffer from inadequate utilization of decomposed time series, insufficient mining of contextual dependencies within the time series, and limited robustness against anomalies during training. To address these limitations, we propose the consistency-enhanced normalizing flow (ConFlow) model, which utilizes the consistency of decomposed time series and contextual temporal embedding to enhance the discriminative ability of the flow model. First, to refine the extraction of time series components, we propose a cascade decomposition and mixing module that iteratively decouples the time series. Second, these components are mapped to Gaussian distributions through the context-aware normalizing flow, incorporating both inter- and intra-series information into the density estimation. Third, the density consistency among decomposed time series is measured to reweight the estimation, while highly inconsistent series are viewed as anomalies and masked during training to improve model robustness. Finally, anomalies are detected using reweight density estimation. Experiments on five widely used datasets in the time series anomaly detection field demonstrate the superiority of our method over state-of-the-art (SOTA) approaches.