Source-linked AI summary
RobustTAD: Robust Time Series Anomaly Detection via Decomposition and Convolutional Neural Networks
Jingkun Gao, Xiaomin Song, Qingsong Wen, Pichao Wang, Liang Sun, Huan Xu
TL;DR
RobustTAD addresses scalable anomaly detection for numerous, diverse time series with complex patterns and limited labels. It combines robust seasonal-trend decomposition, convolutional multi-scale modeling, augmentation, and weighted loss design, and reports stronger benchmark performance with practical deployment in Alibaba scenarios.
Problem
Large-scale time series anomaly detection must handle diverse temporal patterns and limited labeled anomaly data.
Method
RobustTAD combines periodicity-aware robust decomposition with a U-Net-style convolutional encoder-decoder, data augmentation, and label- and value-based loss weights.
Results
RobustTAD performs significantly better than forecasting-based, decomposition-based, statistical, and neural-network methods on public benchmark datasets.
Takeaways & Limitations
The framework is presented as practical for cloud and IoT monitoring and is deployed as an online service at Alibaba Group.
Takeaways & Limitations
The authors identify extending the framework to richer architectures, multi-channel inputs, and joint decomposition-label learning as future work.
Abstract
from arXiv · showhide
The monitoring and management of numerous and diverse time series data at Alibaba Group calls for an effective and scalable time series anomaly detection service. In this paper, we propose RobustTAD, a Robust Time series Anomaly Detection framework by integrating robust seasonal-trend decomposition and convolutional neural network for time series data. The seasonal-trend decomposition can effectively handle complicated patterns in time series, and meanwhile significantly simplifies the architecture of the neural network, which is an encoder-decoder architecture with skip connections. This architecture can effectively capture the multi-scale information from time series, which is very useful in anomaly detection. Due to the limited labeled data in time series anomaly detection, we systematically investigate data augmentation methods in both time and frequency domains. We also introduce label-based weight and value-based weight in the loss function by utilizing the unbalanced nature of the time series anomaly detection problem. Compared with the widely used forecasting-based anomaly detection algorithms, decomposition-based algorithms, traditional statistical algorithms, as well as recent neural network based algorithms, RobustTAD performs significantly better on public benchmark datasets. It is deployed as a public online service and widely adopted in different business scenarios at Alibaba Group.
1 INTRODUCTION
RobustTAD addresses scalable real-time anomaly detection for diverse time series, where complex temporal patterns, limited labels, and the need for multi-scale context challenge existing methods. It combines robust decomposition with a convolutional encoder-decoder network to simplify modeling and detect anomalies.
- Real-time anomaly detection is needed across applications including predictive maintenance, intrusion detection, fraud prevention, and cloud monitoring.
- Real-world time series may contain abrupt trend changes, seasonality shifts, and fluctuations beyond ordinary temporal dependence.
- Limited anomaly labels constrain deep-learning training, making data augmentation particularly important for time series.
- RobustTAD combines periodicity-aware decomposition with a U-Net-based convolutional encoder-decoder and skip connections for multi-scale anomaly features.RobustPeriod selects RobustSTL for periodic series or RobustTrend for non-periodic series before neural prediction.
- Decomposition explicitly extracts seasonality, reducing the need for complex network structures to model it.
2 RELATED WORK
Prior anomaly-detection methods commonly learn representations from forecasting errors or decomposed signals and then apply thresholds or statistical tests. Their robustness is limited when training data contain anomalies or when time series have complex, shifting seasonal and trend structure.
- Representation learning transforms complex raw series into feature spaces where anomalous points stand out more clearly.
- Forecasting-error methods include ARIMA, Bayesian models, hierarchical temporal memory, and LSTM-based networks.
- Many forecasting models are not robust to noise or outliers because they are trained on both normal and abnormal data.
- Decomposition-based methods use residuals or trends as detection representations, but seasonality detection and removal remain major challenges.
- Detection commonly applies empirical thresholds or statistical tests, including the widely known 3-sigma rule, to learned representations.
3 METHODOLOGIES
The proposed framework combines time-series decomposition with a deep convolutional neural network for anomaly detection.
- RobustTAD takes advantage of both decomposition and a deep convolutional neural network.
3.1 Decomposition
RobustTAD assumes each time series is the sum of trend, seasonality, and remainder components, then uses robust, periodicity-aware procedures to estimate them. The decomposition targets abrupt changes, shifting seasonality, noise, outliers, and long seasonal periods that challenge standard methods.
- The decomposition represents each series as the sum of trend, seasonality, and remainder components.
- Standard decomposition methods may miss abrupt trend or remainder changes, seasonality shifts, noise, outliers, and long seasonal periods.
- RobustPeriod detects periodicity and estimates period length before selecting a decomposition procedure.
- RobustSTL alternates noise removal, trend extraction, seasonality extraction, and final adjustment for periodic series.
- LAD loss and first- and second-difference l1 regularization support robust estimation under outliers and both slow and abrupt trend changes.
3.2 Encoder-Decoder Network
RobustTAD frames anomaly detection as point-wise dense prediction and uses a U-Net-style encoder-decoder with skip connections to capture local and global time-series information. It further adjusts the loss to emphasize rare anomalies and unusual values.
- Architecture: Time series anomaly detection produces a binary label for every input point, making it a point-wise dense prediction problem.
- Architecture: The encoder-decoder network uses skip connections to preserve local information while extracting multi-scale features.
- Architecture: RobustTAD adopts a U-Net structure but reports that an unmodified U-Net is sub-optimal for time-series anomaly detection.
- Weight Adjusted Loss: The loss assigns greater importance to anomalous samples and to points differing from their neighbours.
- Weight Adjusted Loss: Weight adjustment helps the network learn anomaly patterns and converge faster under severe class imbalance.
3.3 Data Augmentation
RobustTAD expands limited labeled data with time- and frequency-domain augmentations. These transformations preserve or modify temporal, magnitude, and phase structure under explicitly described sampling and perturbation policies.
- Time Domain: The time-domain augmentation toolkit includes flipping, downsampling, cropping, and label expansion.
- Time Domain: Flipping preserves anomaly labels but is applicable only when anomalies matter in both signal directions.
- Time Domain: Downsampling shortens values and labels by the same rate, whereas concatenating shortened series fails because joins create large jumps.
- Time Domain: Cropping selects shorter value and label sequences with matching timestamps, while label expansion marks points near labeled anomalies as anomalous.
- Frequency Domain: Frequency-domain augmentation perturbs selected magnitude or phase-spectrum segments after computing the discrete Fourier representation.
- Frequency Domain: Magnitude augmentation replaces selected spectral magnitudes with Gaussian perturbations, while phase augmentation adds Gaussian perturbations to selected phase values.
3.4 Online Inference for Streaming Time Series
Online RobustTAD inference combines streaming decomposition with neural-network inference. The implementation reduces repeated trend estimation and supports periodic model updates as new patterns appear.
- Online inference performs both time-series decomposition and deep-network inference.
- The online decomposition version estimates trend only every q data points because trend changes are assumed slow most of the time.
- Neural-network inference is efficient because it requires only matrix multiplications, although augmented-sample training is time-consuming.
- The trained model can be updated regularly to encode newly emerging streaming patterns.
4 SYSTEM ARCHITECTURE
RobustTAD is deployed as a four-component Alibaba system supporting data ingestion, offline training, online inference, visualization, and alarms. Training is relatively costly, but online anomaly prediction remains efficient.
- System components: The deployed system combines data ingestion, offline training, online service, and visualization and alarms.Users can provide metric and telemetry data, while feedback labels can also be imported.
- Data flow: The system uses an application programming interface to transmit data to a coordinator for offline model training.
- Deployment costs: About two hours were required to train Yahoo data on a V100 GPU with large-scale augmentation.
- Deployment costs: Less than 10 ms is required for online anomaly prediction, while robust decomposition adds about 100 ms of overhead.The paper reports that streaming inference can therefore be performed efficiently.
5 EMPIRICAL RESULTS
RobustTAD is evaluated on diverse Yahoo time series using standard and relaxed F1-based measures against statistical, forecasting, and neural baselines. Decomposition, loss adjustment, and augmentation substantially improve detection performance and anomaly identification.
- Dataset: The Yahoo benchmark contains 367 hourly sampled time series from real production traffic, covering seasonality, level changes, variance changes, and combinations of anomalies.
- Evaluation: Evaluation uses precision, recall, F1, and a relaxed F1 measure designed for consecutive pattern anomalies.The relaxed measure allows a lag up to window size m rather than requiring exact pointwise matching.
- Baselines: The comparison includes ARIMA, SHESD, Donut, and U-Net variants with decomposition, weight adjustment, and augmentation.
- Aggregate results: 0.22 F1 increase follows decomposition, while the full adjusted and augmented model reaches 0.693 F1 and 0.812 relaxed F1.These results are reported as far better than the previous state of the art.
- Case study: On a Yahoo A1 series with seasonality, level changes, and spikes, the adjusted framework identifies anomalies that raw U-Net misses.The adjusted network can use a fixed 0.5 probability threshold, whereas ARIMA and Donut require an appropriate threshold.
6 DISCUSSION AND CONCLUSION
RobustTAD combines decomposition with an encoder-decoder deep network to achieve effective anomaly detection and broader practical applicability. The discussion also identifies several directions for extending the framework.
- The encoder-decoder structure effectively extracts multi-scale features for time series anomaly detection on Yahoo datasets.
- The framework may also apply to other time series tasks, such as forecasting, with suitable modifications.
- RobustTAD integrates time series decomposition with a convolutional neural network for anomaly detection.
- The combined framework is described as practical for cloud and IoT monitoring because it handles complicated patterns and limited labels.
- Future work includes exploring additional network architectures to improve multi-scale feature learning.