## 2 Related Works  
Depending on particular characteristics of the detection methods, unsupervised-based anomaly detection in multivariate time series can be categorized into classical unsupervised learning, prediction-based, and reconstruction-based.  
Classical unsupervised learning has been widely studied and contains various types such as density estimation, tree-based, clustering-based, proximity-based, probability-based, and dimension reduction based. In this section, we only introduce the first two types because we use these types for the performance comparison. As a density estimation method, LOF [22] identifies an anomaly based on local reachability density, which calculates the ratio between the average local density of the sample's neighbors to the local density of the sample itself. DAGMM [23] proposed an end-to-end training model, which first reduces the dimensionality of input samples by a deep autoencoder, then feeds the compressed data to a Gaussian Mixture Model to predict the energy of input samples. Based on the concept of decision tree and model ensemble, Isolation Forest [24] builds multiple decision trees so that each leaf of the decision tree isolates a data point from the dataset. Abnormal points will be the points traversing in shorter paths from the root of a tree to a leaf node compared to normal points.  
As a prediction-based method, LSTM-NDT [5] deployed LSTMs to model temporal patterns in time series data. They smoothed the prediction errors to reduce false positives before detecting anomalies.  
In the reconstruction-based methods, MAD-GAN [25] employed LSTMs to capture temporal correlations in measurement sequences and train the model using GAN. The generator is trained to reconstruct normal time sequences, while the discriminator is to classify the time sequences. Focusing on improving the training speed, USAD [11] designed an adversarially trained model using linear layers. The model has one encoder and two decoders. Minimax adversarial game is applied to the two decoders. LSTM-VAE [26] presented a VAE network using LSTM layers as the backbone instead of linear layers. An observation is determined as an anomaly if its negative log-likelihood (anomaly score) is higher than a predefined threshold. Without considering the dependence of stochastic variables in [26], OmniAnomaly [2] proposed a stochastic variable connection technique combined with normalizing the flow to help the GRU-VAE model learn complex distributions of input data and used the reconstruction probabilities for detection. MSCRED [3] encodes the correlations between different pairs of multivariate time series as a signature matrix. Then, Multi-scale signature matrices are fed into a ConvLSTMs autoencoder and compute the difference between original and reconstructed signature matrices to classify anomalies. InterFusion [10] is the first study that employed hierarchical VAE to model inter-metric dependency (dependency among multiple metrics) and temporal dependency (temporal patterns in each metric). It first used Conv1D with a single-scale convolutional kernel (kernel size = 5) to model the temporal embedding. Then, the auxiliary input is reconstructed from the temporal embedding to filter out some temporal anomalies before applying a stochastic recurrent network with normalizing flows to learn complex dependency among multiple metrics. In the InterFusion architecture, we observe that the inter-metric embedding totally depends on the temporal embedding. Therefore, improving the temporal part will enhance the performance of the whole network. Based on this observation, a multi-scale convolutional kernel is proposed to enhance the temporal embedding in MST-VAE compared to the single scale in InterFusion. Unlike InterFusion, MST-VAE uses Conv1D with a multi-scale kernel to jointly model temporal and inter-metric dependencies.