## 1 Introduction  
Recently, anomaly detection based on time-series metrics has been an active topic in the literature. Time series data is a sequence of data points collected over a particular time interval, and the data points are measurements indicating the health and performance of entities (devices and applications) in IT systems. With accurate and timely alerts based on time-series data, system operators can react and prevent severe consequences in advance. A wide variety of business domains have applied anomaly detection in time series data such as KPIs (key performance indicators) of Web applications [1], server machine monitoring (CPU load, network usage, and memory usage) [2], the power plant system [3], the wastewater treatment plant [4], and spacecraft telemetry [5]. The time series input data can be classified into two categories: univariate for only a single time-dependent metric and multivariate for more than one time-dependent metric [6]. We focus on studying anomaly detection in multivariate time series data in this paper. Whether the correlation or the dependencies among multiple metrics exists, detection methods may perform the analysis on each metric independently [7; 8; 9] or consider all metrics at once [2; 10; 11; 12]. However, as systems evolve over time, the number of metrics may significantly increase, then, it is impractical to train and maintain an individual model for each variable, as proposed in [7]. Moreover, in practice, it takes system operators much more effort to observe system statuses at the metric level than at the entity level [2]. Therefore, in following studies [10; 11; 12], we combine all metrics to detect anomalies in this paper. During operation, target systems will become more complex and continue to generate massive amounts of data, leading to the infeasibility of using supervised learning in the training process for several reasons. First, it is labor-intensive for domain experts to label anomalous data. Second, anomalies occur rarely and the rest of the data is dominated by normal data points. Thus, it causes an imbalanced dataset, in which normal data greatly outnumbers abnormal data, making classifiers prone to miss anomalies [13; 14]. For the abovementioned reasons, anomaly detection based on unsupervised learning is more desirable and has been sought in the past decades. Unsupervised detection methods can be roughly categorized into prediction-based and reconstruction-based. Prediction-based [5; 15] methods try to train the model with historical data to predict the value at the next timestamp. Then, the trained model classifies whether an observation at a timestamp is abnormal according to prediction error. However, it is infeasible to predict the normal values of some metrics because external factors such as manual controls or unmonitored environmental conditions may not be captured in the data [16]. Meanwhile, reconstruction-based methods [1; 2; 10; 11] only need to extract normal patterns that are available in the data, and compress them into low-dimensional representations (latent variables). Then, the model is trained to reconstruct the original input from the compressed representations and detect anomalies using the reconstruction error. A typical reconstruction-based method is the autoencoder. The autoencoder is an unsupervised neural network with three main components: encoder, latent variable, and decoder. The encoder part takes the input and compresses hidden patterns of the input into the latent variable, while the decoder part tries to reconstruct the output as close as possible to the original input, given the latent variable. Then, the difference between the reconstruction and the original input, called the reconstruction error, is compared to a predefined threshold to determine anomalies. As autoencoder-based methods [11; 17; 18; 19] are deterministic manners that do not consider the stochastic nature of the time series data, the method performance might be degraded if the training data contains much noise and anomalies [20].