  Anomaly detection in multivariate time series (MTS) has been widely studied
in one-class classification (OCC) setting. The training samples in OCC are
assumed to be normal, which is difficult to guarantee in practical situations.
Such a case may degrade the performance of OCC-based anomaly detection methods
which fit the training distribution as the normal distribution. In this paper,
we propose MTGFlow, an unsupervised anomaly detection approach for MTS anomaly
detection via dynamic Graph and entity-aware normalizing Flow. MTGFlow first
estimates the density of the entire training samples and then identifies
anomalous instances based on the density of the test samples within the fitted
distribution. This relies on a widely accepted assumption that anomalous
instances exhibit more sparse densities than normal ones, with no reliance on
the clean training dataset. However, it is intractable to directly estimate the
density due to complex dependencies among entities and their diverse inherent
characteristics. To mitigate this, we utilize the graph structure learning
model to learn interdependent and evolving relations among entities, which
effectively captures complex and accurate distribution patterns of MTS. In
addition, our approach incorporates the unique characteristics of individual
entities by employing an entity-aware normalizing flow. This enables us to
represent each entity as a parameterized normal distribution. Furthermore,
considering that some entities present similar characteristics, we propose a
cluster strategy that capitalizes on the commonalities of entities with similar
characteristics, resulting in more precise and detailed density estimation. We
refer to this cluster-aware extension as MTGFlow_cluster. Extensive experiments
are conducted on six widely used benchmark datasets, in which MTGFlow and
MTGFlow cluster demonstrate their superior detection performance.
