  Accurate detection and diagnosis of abnormal behaviors such as network
attacks from multivariate time series (MTS) are crucial for ensuring the stable
and effective operation of industrial cyber-physical systems (CPS). However,
existing researches pay little attention to the logical dependencies among
system working states, and have difficulties in explaining the evolution
mechanisms of abnormal signals. To reveal the spatio-temporal association
relationships and evolution mechanisms of the working states of industrial CPS,
this paper proposes a fine-grained adaptive anomaly diagnosis method (i.e.
MAD-Transformer) to identify and diagnose anomalies in MTS. MAD-Transformer
first constructs a temporal state matrix to characterize and estimate the
change patterns of the system states in the temporal dimension. Then, to better
locate the anomalies, a spatial state matrix is also constructed to capture the
inter-sensor state correlation relationships within the system. Subsequently,
based on these two types of state matrices, a three-branch structure of
series-temporal-spatial attention module is designed to simultaneously capture
the series, temporal, and space dependencies among MTS. Afterwards, three
associated alignment loss functions and a reconstruction loss are constructed
to jointly optimize the model. Finally, anomalies are determined and diagnosed
by comparing the residual matrices with the original matrices. We conducted
comparative experiments on five publicly datasets spanning three application
domains (service monitoring, spatial and earth exploration, and water
treatment), along with a petroleum refining simulation dataset collected by
ourselves. The results demonstrate that MAD-Transformer can adaptively detect
fine-grained anomalies with short duration, and outperforms the
state-of-the-art baselines in terms of noise robustness and localization
performance.
