VAML‐Net: Unsupervised Anomaly Detection for Multivariate Time Series in Space‐Air‐Ground Integrated Network (SAGIN) Environments Through a Variational Autoencoder and Multiresolution LSTM

ABSTRACT Automatic monitoring of heterogeneous devices across Space‐Air‐Ground Integrated Networks (SAGIN) remains a significant challenge due to the complex temporal dependencies inherent in multivariate time series and the vast amount of data generated across space‐based, aerial, and ground sensors. Hybrid models have proven effective for time series anomaly detection by identifying abnormal segments through high reconstruction errors, a strategy particularly valuable for multi‐source data streams in SAGIN scenarios. However, these methods typically fall short in addressing the non‐stationarity and noise inherent in multivariate time series, as they use fixed thresholds and lack mechanisms to adapt to changing data distributions—an issue exacerbated in SAGIN environments with widely varying network conditions. In contrast, our approach employs a dynamic threshold selection strategy that automatically adjusts based on the statistical properties of the reconstruction error, thus effectively mitigating these issues in SAGIN's dynamic environment. Consequently, these earlier models fail to extract rich differential features from both local and long‐term sequences, thereby limiting detection performance—particularly under the multi‐scale, distributed conditions of SAGIN. This study introduces VAML‐Net, a composite architecture designed for unsupervised detection of anomalies within multivariate time series, and especially tailored to the heterogeneous data and distributed nature of SAGIN environments. The framework incorporates a Variational Autoencoder to derive compact representations from localized temporal segments, which are subsequently utilized for data reconstruction. To model extended and hierarchical temporal dependencies, the architecture integrates a multilevel LSTM configuration, enhanced with a cross‐layer information aggregation mechanism, mirroring the multi‐tier structure of SAGIN. Furthermore, we propose a dynamic threshold selection approach that adapts to the inherent non‐stationarity and noise present in real‐world time series data by continuously recalculating the threshold based on the evolving statistical properties of the reconstruction errors. Extensive experiments conducted on six anomaly detection benchmark datasets demonstrate that the proposed method consistently outperforms other state‐of‐the‐art techniques.