# Unsupervised Deep Anomaly Detection for Industrial Multivariate Time Series Data
## 3 Materials and Methods
### Inference
As shown in Table 6, for the MSDS and SMAP datasets, the \(F1\) score and _AUC_ achieved the best performance when the window size was 8, while for the MBA, WADI, and SMD datasets, the best \(F1\) score and _AUC_ were obtained with a window size of 4. It is noteworthy that the SWaT dataset achieved the best \(F1\) score with a window size of 4, but the _AUC_ was better with a window size of 8. Choosing a larger window size may enhance anomaly detection

Figure 8: Sensitivity analysis of training set size. Figure 7: Average time cost (minutes) and average \(F1\) score analysis. performance but could also increase computational costs. Conversely, smaller windows can detect behavioral changes more quickly but may miss longer-term anomalies. Therefore, when selecting the window size, a balance between performance and computational costs is crucial. In real-world production environments, the choice of the most suitable window size should be based on specific needs and the context of the problem to achieve optimal anomaly detection performance. ## 6 Conclusions and Future Works

In this paper, we proposed the AT-DCAEP, a deep spatiotemporal network-based unsupervised anomaly detection method for multivariate time series data. The AT-DCAEP captures the spatiotemporal information of multivariate time series data through a convolutional autoencoder and extracts crucial information from the low-dimensional space using multi-head attention. This significantly improves the model's reconstruction ability, particularly in reconstructing normal data, resulting in a substantial gain in reconstructing normal data. This characteristic enhances the model's sensitivity to anomaly data, allowing for more accurate identification of anomalies. The prediction network based on external attention is then used to capture the temporal dependence of the reconstruction error. Finally, by simultaneously optimizing both subnetworks, the model's anomaly detection performance is improved. We validated the effectiveness of this method on six different public datasets. Based on \(F1\) score performance, the AT-DCAEP surpassed the current state-of-the-art techniques in five out of six datasets, achieving a significant improvement in average \(F1\) score across all six datasets compared to the best baseline. The experimental results demonstrate that our proposed model is competitively robust in the field of anomaly detection and has broad application prospects. However, despite these advancements, the proposed model exhibits limitations in coupling spatiotemporal features, as the predictive network solely analyzes reconstruction errors, overlooking global trend analysis. If the performance of the reconstruction network is subpar, it may significantly impact the accuracy of the predictive network, and its independence needs enhancement. In the future, we will focus on researching more effective multivariate time series anomaly detection methods to address these limitations, exploring approaches for spatiotemporal feature coupling to enhance the model's adaptability and robustness. Additionally, we plan to investigate anomaly detection methods suitable for edge devices with limited computational capabilities. By deploying the model on edge intelligent devices, we aim to achieve real-time online monitoring of anomalies, which holds significant implications for advancing Industry 4.0. Conceptualization, P.L. and R.T.; methodology, W.L. and N.M.; resources, R.T. and P.L. ; data curation, G.W. and L.Y. ; investigation, X.M. ; validation, G.W., L.Y. and X.M. ; writing--original draft preparation, W.L. ; writing--review and editing, P.L., W.L. and N.M.; and supervision, P.L. All authors have read and agreed to the published version of the manuscript.