PaperlayerView exact revision on arXiv

Source-linked AI summary

TadGAN: Time Series Anomaly Detection Using Generative Adversarial Networks

Alexander Geiger, Dongyu Liu, Sarah Alnegheimish, Alfredo Cuesta-Infante, Kalyan Veeramachaneni

arXiv:2009.07769v3cs.LGstat.ML

TL;DR

Time-series anomaly detection is challenging because anomalies are vaguely defined, labels are often absent, temporal correlations are complex, and existing unsupervised methods can produce false positives. TadGAN uses LSTM-based Generators and Critics in a cycle-consistent GAN for reconstruction, then combines reconstruction errors and Critic outputs into anomaly scores. Across 11 datasets, it achieved the highest averaged F1 score and outperformed baselines on 6 of 11 datasets, while the authors identify unresolved questions about reconstruction quality and anomaly detection.

  • Problem

    Time-series anomaly detection lacks reliable labels and must handle vague anomalies, complex temporal correlations, scalability and portability issues, and potentially high false positive rates.

  • Method

    TadGAN uses cycle-consistent GAN reconstruction with LSTM-based Generators and Critics, combining reconstruction errors and Critic outputs to compute anomaly scores.

  • Results

    TadGAN achieved the highest averaged F1 score across 11 datasets and outperformed baseline methods on 6 of 11 datasets.

  • Takeaways & Limitations

    The results support TadGAN as an effective unsupervised approach for time-series anomaly detection across the evaluated datasets.

  • Takeaways & Limitations

    Further experiments are needed to understand how reconstruction quality relates to anomaly detection because better reconstruction might overfit anomalies.

Abstract

from arXiv · show

Time series anomalies can offer information relevant to critical situations facing various fields, from finance and aerospace to the IT, security, and medical domains. However, detecting anomalies in time series data is particularly challenging due to the vague definition of anomalies and said data's frequent lack of labels and highly complex temporal correlations. Current state-of-the-art unsupervised machine learning methods for anomaly detection suffer from scalability and portability issues, and may have high false positive rates. In this paper, we propose TadGAN, an unsupervised anomaly detection approach built on Generative Adversarial Networks (GANs). To capture the temporal correlations of time series distributions, we use LSTM Recurrent Neural Networks as base models for Generators and Critics. TadGAN is trained with cycle consistency loss to allow for effective time-series data reconstruction. We further propose several novel methods to compute reconstruction errors, as well as different approaches to combine reconstruction errors and Critic outputs to compute anomaly scores. To demonstrate the performance and generalizability of our approach, we test several anomaly scoring techniques and report the best-suited one. We compare our approach to 8 baseline anomaly detection methods on 11 datasets from multiple reputable sources such as NASA, Yahoo, Numenta, Amazon, and Twitter. The results show that our approach can effectively detect anomalies and outperform baseline methods in most cases (6 out of 11). Notably, our method has the highest averaged F1 score across all the datasets. Our code is open source and is available as a benchmarking tool.

I. INTRODUCTION

Time-series anomaly detection is difficult because anomalies can be contextual, labels are often unavailable, and temporal correlations are complex. TadGAN addresses these challenges with cycle-consistent GAN reconstruction, contextual error measures, and anomaly scores combining Generator and Critic outputs.

  • Motivation: Contextual anomalies may have normal-valued measurements that are unusual only at the time they occur.Such anomalies are harder to identify because the signal’s context is often unclear.
  • Motivation: Deep models can fit anomalous data, while GANs may fail to capture the hidden distribution and produce false alarms.The paper argues that improved post-processing can reduce false positives.
  • Contributions: TadGAN introduces an unsupervised cycle-consistent GAN architecture for time-series-to-time-series mapping and reconstruction.The method is designed specifically for time-series anomaly detection.
  • Contributions: Two time-series similarity measures assess contextual similarity between original and reconstructed sequences, while Generator and Critic outputs support time-step anomaly scores.The scoring design combines reconstruction information with adversarial outputs.
  • Evaluation: Evaluation covers 11 time-series datasets and compares TadGAN with 8 baseline anomaly-detection methods.The study also reports insights into GAN-based anomaly detection and provides an extensible open-source benchmarking system.

II. UNSUPERVISED TIME SERIES ANOMALY DETECTION

Unsupervised time-series anomaly detection seeks anomalous segments without prespecified anomaly labels or normal baselines. The problem is complicated by variable-length segments, unclear anomaly semantics, and signals that cannot be cleanly segmented.

  • Problem Definition: The task is to find continuous anomalous time segments whose values do not follow the signal’s expected temporal behavior.The input can be a multivariate time series, and anomalous segments may have varied lengths.
  • Challenges: Unsupervised detection does not assume prior knowledge of anomalies or previously identified anomalies for training and optimization.The model learns time-series patterns before producing detections for end-user assessment.
  • Challenges: Unsupervised strategies also avoid relying on normal baselines that may be unavailable for real-world systems.Physics-based simulations can provide such baselines in some settings, but they are not generally assumed here.
  • Challenges: Detected anomalies may reflect external phenomena, auxiliary information, or unmodeled regime changes rather than actual problems.Domain experts must assess whether identified anomalies are problematic.
  • Challenges: Signals that cannot be clearly segmented make fixed-length clustering approaches unfeasible, while unknown segment lengths increase difficulty.This contrasts with periodic signals that can be divided into similar segments.

A. Anomaly Detection for Time Series Data.

Prior unsupervised approaches use proximity, prediction, or reconstruction, but each has limitations involving assumptions, parameter choices, or overfitting. TadGAN applies adversarial learning to time-series reconstruction and uses Generator and Critic outputs for anomaly scoring.

  • Existing Approaches: Proximity-based methods identify anomalies by measuring distances between data points or fixed-length sequences.Distance-based variants can use neighbors and a radius to determine anomaly scores.
  • Existing Approaches: Prediction-based methods flag points when predicted values differ from the original beyond a threshold.Statistical predictors can be sensitive to parameter selection and may require strong assumptions and domain knowledge.
  • Existing Approaches: Reconstruction-based methods learn latent structure and treat high reconstruction error as evidence of anomalous behavior.The approach assumes anomalies lose information during mapping to a lower-dimensional space.
  • TadGAN: Adversarial learning is proposed to regularize time-series reconstruction, with Generators reconstructing data and Critics providing anomaly-score information.The paper motivates this design partly by the overfitting risk of reconstruction-based methods.
  • GAN-Based Approaches: Prior time-series GAN work includes Critic-based detection, reconstruction-based BeatGAN, and representation-learning Time-Series GAN.The paper distinguishes its objective from Time-Series GAN, which targets representation learning rather than anomaly detection.
  • TadGAN: TadGAN introduces cycle-consistent GANs for time-series reconstruction and systematically studies Generator and Critic outputs for anomaly scores.The authors present this as a complete GAN-based framework for time-series anomaly detection.

IV. ADVERSARIAL LEARNING FOR TIME SERIES RECONSTRUCTION

TadGAN learns bidirectional mappings between time-series data and a latent space using adversarial Critics. Wasserstein objectives and gradient-penalty regularization support more stable training while Critics evaluate generated sequences and latent mappings.

  • TadGAN learns an Encoder E mapping time-series sequences to latent space Z and a Decoder G mapping latent samples back to reconstructed sequences.The reconstruction pipeline is xi → E(xi) → G(E(xi)) ≈ x̂i.
  • Critic Cx distinguishes real time-series sequences from G(z), while Critic Cz distinguishes random latent samples from encoded samples E(x).
  • Standard GAN losses can suffer from mode collapse, in which the Generator captures only a small fraction of the data variability.
  • Wasserstein-1 losses replace standard adversarial losses for both mappings, with 1-Lipschitz Critics and gradient penalties used to stabilize training.The Lipschitz constraint limits function changes, reducing gradient explosion risk and making training more stable and reliable.

B. Cycle Consistency Loss

TadGAN adds cycle consistency to adversarial training so the learned mappings reconstruct individual input sequences. The resulting architecture supplies both reconstruction differences and Critic scores as anomaly measures.

  • B. Cycle Consistency Loss: Adversarial losses alone do not guarantee that an individual input xi maps to a suitable latent representation that decodes back to its reconstruction.
  • B. Cycle Consistency Loss: Cycle consistency reduces the mapping search space by minimizing the L2 difference between original and reconstructed time-series samples.
  • B. Cycle Consistency Loss: TadGAN uses L2 rather than L1 loss to emphasize anomalous values, while preliminary experiments found no performance improvement from backward consistency loss.
  • B. Cycle Consistency Loss: The final objective jointly minimizes or maximizes the Wasserstein and L2 terms over Generators and Critics.
  • B. Cycle Consistency Loss: Cycle-trained Generators provide reconstruction-based anomaly measures, while Critic Cx provides a complementary real-versus-fake anomaly measure.

V. TIME-SERIES GAN FOR ANOMALY DETECTION (TADGAN)

TadGAN trains on sliding-window time-series samples under the assumption that training points are normal, then produces time-step anomaly scores from reconstruction errors and Critic outputs. The framework also applies to multivariate series.

  • The exposition simplifies to univariate series with M = 1, while the same procedure applies to multivariate series when M > 1.
  • A sliding window of size t and step size s divides the original time series into N subsequences for training.
  • TadGAN assumes anomalous training points are rare and treats all training sample points as normal.
  • The model feeds real sequences X and random latent vectors Z into the GAN and computes anomaly scores at every time step from reconstruction errors and Critic outputs.

A. Estimating Anomaly Scores using Reconstruction Errors

TadGAN reconstructs overlapping windows and aggregates their estimates by the median before computing local or pointwise reconstruction errors. Area difference and DTW capture extended local discrepancies, with DTW also handling time shifts.

  • Each length-t window is encoded and decoded into a reconstructed sequence, yielding multiple reconstructed values for each original time point.
  • The median of overlapping reconstructed values becomes the final reconstructed value x̂j because preliminary experiments found it outperformed the mean.
  • Point-wise difference computes reconstruction error directly between the true and reconstructed values at each time step.
  • Area difference averages the discrepancy between areas under two curves over a window of length l to measure local-region similarity.
  • DTW measures local-region similarity by finding a minimum-distance warp path between the original and reconstructed sequences.Unlike area difference, DTW can also handle time-shift issues.

B. Estimating Anomaly Scores with Critic Outputs

TadGAN uses Critic outputs as anomaly measures because the Wasserstein-trained Critic assigns higher scores to real sequences and lower scores to fake ones. Smoothed Critic scores distinguish anomalous from normal regions and support thresholding.

  • The Wasserstein-trained Critic assigns larger outputs to real sequences and smaller outputs to fake sequences.This makes the Critic output directly usable as an anomaly measure.
  • At each time step, TadGAN collects Critic scores from overlapping sequence windows.
  • Kernel density estimation smooths the collected scores into a Critic score sequence.
  • Critic scores differ between anomalous and normal regions, enabling thresholding to identify anomalous regions.

C. Combining Both Scores

TadGAN normalizes reconstruction errors and Critic outputs before combining them into anomaly scores. It then applies locally adaptive thresholding and pruning to identify anomalous sequences while mitigating false positives.

  • Combining Both Scores: TadGAN converts reconstruction errors and Critic outputs into z-scores because their raw values cannot be directly combined.Larger normalized scores indicate higher anomaly scores.
  • Combining Both Scores: The method tests individual normalized scores and combines them using convex or multiplicative formulations.The convex combination uses α to control relative importance, with α = 0.5 by default; the multiplicative method uses α = 1 by default.
  • Combining Both Scores: Both score-combination methods produce robust anomaly scores.
  • Finding anomalous sequences with locally adaptive thresholding: Sliding windows provide locally adaptive thresholds for identifying contextual anomalies with unknown context.The method uses a static threshold of four standard deviations from each window’s mean.
  • Mitigating false positives: Anomaly pruning reduces false positives by reclassifying subsequent sequences as normal when sorted maximum scores show insufficient decline.The default decline threshold is θ = 0.1.

VI. EXPERIMENTAL RESULTS

The experiments evaluate TadGAN on 11 datasets spanning spacecraft telemetry, Yahoo systems, and other application domains. The benchmark contains signals with known anomaly locations and varied anomaly types.

  • The benchmark comprises 11 datasets and 492 signals from multiple application domains.
  • NASA spacecraft telemetry contributes the MSL and SMAP datasets.
  • Yahoo S5 contains four sub-datasets, including real production traffic in A1 and synthetic data in A2, A3, and A4.
  • The selected NAB datasets are Art, AdEx, AWS, Traf, and Tweets.
  • Anomaly locations are known for each signal, and datasets include both point anomalies and collections of anomalies.
  • The preprocessing normalizes signals to [−1, 1], uses windows of length 100 with step size 1, and detrends Yahoo signals with linear trends.

2) Architecture:

Across the benchmark, TadGAN achieves the strongest average F1 performance, while its results vary by anomaly type and dataset setting. The comparisons also examine baselines, autoencoders, and Mad-GAN.

  • Benchmarking Results: TadGAN achieves the highest averaged F1 score across eleven datasets, with 0.7 versus 0.623 for LSTM and 0.599 for ARIMA.
  • Benchmarking Results: TadGAN improves averaged F1 score over ARIMA by more than 15%, while LSTM improves by slightly more than 4%.
  • Synthetic data v.s. real-world datasets: TadGAN outperforms ARIMA on average but ranks below it on synthetic point anomalies, scoring 0.717 versus 0.784.
  • How well do AutoEncoders perform?: On Yahoo A3 and A4 point anomalies, TadGAN scores 0.643, compared with 0.205 for LSTM AE and 0.082 for Dense AE.
  • TadGAN v.s. MadGAN: TadGAN’s averaged F1 score is 0.7 versus 0.219 for Mad-GAN.The authors attribute this comparison to TadGAN’s forward cycle-consistency loss, absent from Mad-GAN.

D. Ablation Study

The ablation study finds that combining Critic outputs with reconstruction errors generally improves anomaly detection, with Critic×DTW providing the strongest and relatively stable overall performance. It also identifies instability in Critic-only scoring and leaves broader reconstruction strategies for future evaluation.

  • Critic outputs: Critic-only scoring is unstable, with an average F1 score of 0.29 and standard deviation of 0.237.Its performance is strong on some datasets but unexpectedly poor on others.
  • Reconstruction errors: Critic×DTW achieves the best score among the variations, with an F1 score of 0.629 and comparatively small standard deviation.DTW slightly outperforms the other reconstruction-error types.
  • Combined scoring: Combining Critic outputs with reconstruction errors achieves the best performance in all datasets except A4.On MSL, the F1 score rises from 0.514 with DTW alone to 0.623 after adding the Critic score.
  • Combination methods: Multiplication outperforms convex combination for the same reconstruction-error type and produces consistently smaller standard deviations.The authors recommend multiplication because it better amplifies high anomaly scores.
  • Scope and future work: The study compares the proposed approach with one well-known GAN-based anomaly detection method, while other time-series reconstruction architectures remain to be evaluated.The authors plan further experiments on reconstruction strategies and the relationship between reconstruction quality and anomaly detection.
  • Overall findings: Across the paper’s evaluation, TadGAN has the highest averaged F1 score and outperforms baseline methods on 6 of 11 datasets.The conclusion also reports that combining reconstruction errors and Critic outputs yields more robust anomaly scores.
Loading 2009.07769v3…