  Many real-world IoT systems comprising various internet-connected sensory
devices generate substantial amounts of multivariate time series data.
Meanwhile, those critical IoT infrastructures, such as smart power grids and
water distribution networks, are often targets of cyber-attacks, making anomaly
detection of high research value. However, considering the complex topological
and nonlinear dependencies that are initially unknown among sensors, modeling
such relatedness is inevitable for any efficient and accurate anomaly detection
system. Additionally, due to multivariate time series' temporal dependency and
stochasticity, their anomaly detection remains a big challenge. This work
proposed a novel framework, namely GTA, for multivariate time series anomaly
detection by automatically learning a graph structure followed by the graph
convolution and modeling the temporal dependency through a Transformer-based
architecture. The core idea of learning graph structure is called the
connection learning policy based on the Gumbel-softmax sampling strategy to
learn bi-directed associations among sensors directly. We also devised a novel
graph convolution named Influence Propagation convolution to model the anomaly
information flow between graph nodes. Moreover, we proposed a multi-branch
attention mechanism to substitute for original multi-head self-attention to
overcome the quadratic complexity challenge. The extensive experiments on four
public anomaly detection benchmarks further demonstrate our approach's
superiority over other state-of-the-arts.
