###### Abstract  
Anomaly detection is critical to ensure cloud infrastructures' quality of service. However, due to the complexity of inconspicuous (indistinct) anomalies, high dynamicity, and the lack of anomaly labels in the cloud environment, multivariate time series anomaly detection becomes more difficult. The existing approaches are rarely effective in meeting these challenges. In this paper, we propose a novel convolutional adversarial model, convolutional-adversarial-training-based integrated anomaly detection with explanation framework (CAT-IADEF), for multivariate time series anomaly detection in the cloud. We adopt three convolutional neural networks to learn sequence features and adversarial training to amplify \"slight\" anomalies while enhancing the robustness of the model. The dynamic threshold is determined in real time by the peaks over threshold (POT) method to improve detection accuracy. In addition, anomaly explanation is also conducted efficiently by analyzing anomaly score vectors. Experiments with seven data subsets from various public datasets show that CAT-IADEF outperforms state-of-the-art methods. The average F1 score on the seven datasets is 0.907, which is 6.5% higher than the state-of-the-art model and up to 22.1% higher than the baseline method. Furthermore, the proposed anomaly explanation framework is also integrated into various models to verify its effectiveness on the experimental datasets. cloud platform; multivariate time series; anomaly detection and explanation; adversarial training +
Footnote †: journal:  
user space occupied by the CPU, the CPU idle rate, and the percentage of CPU time waiting for input and output as well as different aspects of data, such as the total percentage used by the CPU. In addition, the traditional methods significantly impact performance due to the increase in sizes, so anomaly detection of multivariate time series has become a research hotspot [3]. Traditional anomaly detection methods, such as setting a static threshold, determined that a certain observed data point exceeded the set threshold to be an outlier point. Collecting data with many labels is complicated by the increase in data scale, which results in a lack of time series data, lack of branding, and other problems. In addition, the detection of the \"slight\" anomalies proposed in unsupervised anomaly detection (USAD) [4] and the stability of training are also current priorities to consider. To facilitate further research, anomaly explanation is defined in this paper as the dimensions of the most likely occurrence of anomalies. We propose an adversarial training method for anomaly explanation. Firstly, we use convolutional neural networks (CNN) to extract the sequence's main features. Next, we build an adversarial training architecture consisting of three CNNs combined with the POT dynamic threshold selection. Then, we also add the anomaly explanation module based on the anomaly attribution matrix calculation for each point. The contributions of this paper include the following:  
1. To solve the problem that \"slight\" anomalies are not easy to identify as well as the detection model's robustness, we adopt adversarial training to amplify the reconstruction errors for anomaly identification while improving the model's accuracy. 2. To improve the computational efficiency of static threshold exploration, we combine the POT dynamic threshold selection technology effectively to improve the detection performance. 3. To effectively support anomaly handling afterward, we propose an anomaly explanation framework. First, based on each point's anomaly score and threshold matrix, we calculate the number of anomalies to perform anomaly dimension attribution, which explains the anomalies to a certain extent. The organization of this paper is as follows: The Section 1 mainly introduces the research background, purpose, and significance and briefly analyzes the anomaly detection problems.