A data attribution approach for unsupervised anomaly detection on multivariate time series

• Innovative unsupervised approach for discovering anomalies in multivariate time series. • Data attribution by using explainability and data-driven learning. • Initial training on a self-supervised task to capture normal data behavior. • Data attribution to identify potential anomalies at the time step. • Experiments on several synthetic and real-world datasets. Anomaly detection is a challenging task that manifests in several forms depending on its context (e.g., fraud detection, network security, fault monitoring): given a collection of data, the goal is discovering the anomalous patterns diverging from the majority. The time dimension adds complexity to defining an anomaly, especially with multivariate time series, where each channel represents possibly distinct quantities. Classical unsupervised anomaly detection approaches have been based on differences in data, sequences of data, distributions, or also by inspecting the prediction deviation errors. In this work, we propose an innovative unsupervised approach for discovering anomalies in multivariate time series by leveraging the concept of data attribution from the explainability literature. Our proposed method is flexible and data-driven, and it can be used across multiple scenarios without the necessity of domain experts. By training initially on a self-supervised task (e.g., forecasting), a model captures normal data behavior; then, by using a data attribution technique we identify potential anomalies at the time step level. We conduct experiments on several synthetic and real-world datasets, comparing the results with state-of-the-art unsupervised anomaly detection methods, achieving competitive or better performance on most datasets, with notable improvements on synthetic data and promising results on real-world data, despite certain challenges in highly anomalous scenarios. Finally, we show an in-depth investigation of this methodology, along different dimensions, in order to gain a greater understanding of the application of these functions and their characteristics within the anomaly detection landscape.