PaperlayerView exact revision on arXiv

Source-linked AI summary

Calibrated One-class Classification for Unsupervised Time Series Anomaly Detection

Hongzuo Xu, Yijie Wang, Songlei Jian, Qing Liao, Yongjun Wang, Guansong Pang

arXiv:2207.12201v2cs.LGcs.AI

TL;DR

Unsupervised one-class anomaly detection can learn biased normality boundaries because training data may contain anomalies and the learning process lacks anomaly knowledge. COUTA addresses both issues with uncertainty-based and native-anomaly calibration, outperforming 15 state-of-the-art methods across 10 real-world datasets with an average improvement above 11%.

  • Problem

    Unsupervised one-class learning is vulnerable to anomaly contamination and lacks anomaly knowledge, which can yield inaccurate normality boundaries.

  • Method

    COUTA calibrates one-class learning with uncertainty modeling that downweights uncertain samples and native-anomaly perturbations that supply simulated abnormal examples.

  • Results

    COUTA substantially outperforms 15 state-of-the-art methods on 10 real-world datasets, averaging over 11% improvement.

  • Takeaways & Limitations

    The calibrated approach provides contamination-tolerant, anomaly-informed normality learning with reported generalization, robustness, and scalability properties.

  • Takeaways & Limitations

    COUTA assumes normal data share similarities and belong to one prototype, and may fail under concept drift.

Abstract

from arXiv · show

Time series anomaly detection is instrumental in maintaining system availability in various domains. Current work in this research line mainly focuses on learning data normality deeply and comprehensively by devising advanced neural network structures and new reconstruction/prediction learning objectives. However, their one-class learning process can be misled by latent anomalies in training data (i.e., anomaly contamination) under the unsupervised paradigm. Their learning process also lacks knowledge about the anomalies. Consequently, they often learn a biased, inaccurate normality boundary. To tackle these problems, this paper proposes calibrated one-class classification for anomaly detection, realizing contamination-tolerant, anomaly-informed learning of data normality via uncertainty modeling-based calibration and native anomaly-based calibration. Specifically, our approach adaptively penalizes uncertain predictions to restrain irregular samples in anomaly contamination during optimization, while simultaneously encouraging confident predictions on regular samples to ensure effective normality learning. This largely alleviates the negative impact of anomaly contamination. Our approach also creates native anomaly examples via perturbation to simulate time series abnormal behaviors. Through discriminating these dummy anomalies, our one-class learning is further calibrated to form a more precise normality boundary. Extensive experiments on ten real-world datasets show that our model achieves substantial improvement over sixteen state-of-the-art contenders.

1 INTRODUCTION

Unsupervised one-class learning can be distorted by anomalous training samples and lack anomaly knowledge, so COUTA calibrates normality using uncertainty and native anomalies.

  • 1 INTRODUCTION: Anomalies in training data can disturb one-class learning and produce inaccurate normality boundaries when anomaly information is absent.Canonical methods commonly assume all training samples are normal, although training sets may contain anomalous observations.
  • 1 INTRODUCTION: COUTA combines uncertainty modeling-based calibration with native anomaly-based calibration to make one-class learning contamination-tolerant and anomaly-informed.UMC and NAC address anomaly contamination and missing anomaly knowledge, respectively.
  • 1 INTRODUCTION: On Omi-4 server data, canonical one-class classification misses two anomalies and forms a biased hypersphere, whereas either calibration improves real-anomaly discrimination.The comparison uses learned feature spaces for canonical classification, NAC, UMC, and their combination.
  • 1 INTRODUCTION: UMC uses prediction uncertainty to restrain irregular contaminated samples while encouraging confident predictions on regular samples.Its calibrated loss imposes a Gaussian prior on one-class distances to model prediction uncertainty.
  • 1 INTRODUCTION: NAC generates native anomaly examples through perturbation and uses them to calibrate representations toward a clearer normality boundary.The method exploits simulated abnormal behaviors as anomaly-related supervisory information.
  • 1 INTRODUCTION: COUTA substantially outperforms 15 state-of-the-art methods on 10 real-world datasets, averaging over 11% improvement.It also shows generalization across anomaly types, robustness to contamination, and scalability with time-series length and dimensionality.

2 RELATED WORK

Related work models time-series normality through reconstruction, prediction, filtering, or self-supervised proxy tasks, while COUTA uses tailored perturbations to represent anomaly behavior directly.

  • 2 RELATED WORK: Traditional time-series anomaly detection includes decomposition, clustering, distance, pattern mining, and prediction-based comparison methods.These approaches predate the deep generative one-class learning line.
  • 2 RELATED WORK: Deep time-series detectors generally use reconstruction or prediction errors from generative one-class models to measure abnormality.These methods implicitly model normal patterns through restoring inputs or forecasting future values.
  • 2 RELATED WORK: Some methods address contamination by filtering possible anomalies or jointly inferring normal and anomalous labels, but auxiliary components can remain affected by contamination.Filtering can also discard informative normal boundary samples.
  • 2 RELATED WORK: Self-supervised anomaly detectors create labels from augmentations or transformations, yet these proxy tasks primarily learn data characteristics rather than anomaly information.Examples include noise addition, reversal, scaling, smoothing, neural transformations, segmentation, and time-resolution changes.
  • 2 RELATED WORK: COUTA creates dummy anomalies by perturbing original time-series data, using tailored methods that reflect point, contextual, and collective anomaly definitions.This differs from anomaly exposure methods that use samples from supplementary natural datasets.

3 THE PROPOSED METHOD: COUTA

COUTA learns time-series normality as a hypersphere and calibrates one-class learning against contaminated training data and missing anomaly knowledge. It combines uncertainty modeling with native anomaly perturbations to produce a more precise normality boundary and scores subsequences by deviation from that model.

  • UMC: Uncertainty Modeling-based Calibration adaptively softens penalties for uncertain predictions while encouraging confident predictions to reduce contamination effects.The method imposes a Gaussian prior on one-class distances and uses uncertainty to mask likely contaminated samples during optimization.
  • Overall Framework: During inference, COUTA preprocesses data into subsequences and measures abnormality from deviation from the learned hypersphere.The anomaly scoring function does not use the classification head’s prediction results.
  • Overall Framework: COUTA models data normality as a minimum-radius hypersphere in feature space, using distance from its center to indicate abnormality.A temporal network models dependencies, while a projection head maps subsequences into the feature space.
  • NAC: Native Anomaly-based Calibration generates dummy anomalies through tailored perturbations and trains a classification branch to discriminate them from original subsequences.The combined objective weights this branch with α, while the classification head supports temporal representation learning rather than inference-time anomaly scoring.
  • NAC: Six perturbation functions provide anomaly-aware transformations that can strengthen one-class learning even when simulated anomalies do not overlap target anomaly types.The perturbations act as a self-supervised calibration signal and can incorporate application-specific anomaly knowledge.
  • Overall Framework: COUTA uses a discriminative hypersphere model instead of reconstruction or prediction, avoiding decoder reconstruction and directly modeling normality.The paper also describes an initialization strategy intended to speed convergence and avoid hypersphere collapse.

4 EXPERIMENTS

The experiments evaluate COUTA’s effectiveness, anomaly-type generalization, robustness to training contamination, scalability, hyperparameter sensitivity, and calibration components.

  • The experiments assess COUTA’s accuracy against current state-of-the-art anomaly detection methods on real-world datasets.
  • They test whether COUTA generalizes across different types of time series anomalies.
  • They examine robustness to varying anomaly contamination levels in the training set.
  • They evaluate time efficiency relative to existing methods and sensitivity to COUTA’s hyperparameters.
  • An ablation study tests whether the proposed calibration methods improve detection performance.

4.1 Experimental Setup

The study uses ten publicly available datasets spanning multivariate and univariate real-world applications, compares COUTA with sixteen diverse methods, and specifies common evaluation and implementation procedures.

  • Ten publicly available datasets comprise six multivariate and four univariate datasets from varied real-world applications.The datasets differ in length, dimensionality, anomaly ratio, and anomaly type.
  • Predefined or stratified training-testing splits are used, with min-max normalization based on training-set extrema and clipped test values for two datasets.Epilepsy and DSADS use 60% training data and 40% testing data while preserving the original anomaly proportion.
  • COUTA is compared with sixteen traditional and deep anomaly detection methods using prediction, reconstruction, and discriminative learning strategies.The competitors include varied architectures such as MLPs, recurrent networks, TCNs, Transformers, convolutional networks, and graph neural networks.
  • Evaluation uses point adjustment for consecutive anomaly segments and reports precision, recall, and F1-based anomaly detection performance.Point adjustment raises scores across an anomaly segment to the highest score when any timestamp can trigger a useful alert.
  • Experiments run on a workstation with an Intel Xeon Silver 4210R CPU, NVIDIA TITAN RTX GPU, and 64 GB RAM, using specified default COUTA settings and public implementations.COUTA uses Adam with learning rate 10^-4, α=0.1, and β=0.2 by default.

4.2 Effectiveness in Real-World Datasets

On ten real-world datasets, COUTA is evaluated against sixteen competitors using testing-set detection performance, with results reported separately for multivariate and univariate data.

  • Testing-set detection performance is reported after models are trained without access to testing-set ground-truth labels.Table 2 covers six multivariate datasets, while Table 3 covers four univariate datasets.
  • ARMA does not produce results within three days on SMD, SWaT, and DSADS, while MSCRED runs out of memory on SWaT.The text links MSCRED’s failure to the high computational cost of its deep convolutional network structure.
  • COUTA achieves state-of-the-art performance on the evaluated real-world datasets.The reported comparison attributes this result to the synergy of uncertainty-based and native-anomaly calibration for contamination-tolerant, anomaly-informed normality learning.
  • TranAD fails to produce effective results on simple datasets such as SMD and SWaT, whereas plain encoder-decoder models such as LSTM-ED perform better there.The passage associates TranAD’s result with possible overfitting from its complicated learning process.

4.3 Generalization Ability to Different Types of Time Series Anomalies

COUTA is tested on synthetic point-wise and pattern-wise anomalies with varying lengths, and its anomaly scores distinguish true anomalies from normal moments across the illustrated cases.

  • The synthetic cases include global and contextual point anomalies, seasonal and shapelet pattern changes, and anomalies with different lengths.Pattern-wise anomalies are generated through basic shapelet and seasonality changes.
  • COUTA successfully identifies all illustrated point-wise, pattern-wise, and varying-length anomaly cases with higher anomaly scores than normal moments.The experiments use three synthetic two-dimensional datasets with 1,000 observations, allocating the first 400 points to training.
  • COUTA uses three fixed perturbation operations to create native anomaly examples for calibrating the normality boundary.
  • The results indicate that COUTA can generalize to different anomaly types, although some anomaly types may not strictly correspond to the generated native examples.

4.4 Robustness w.r.t. Anomaly Contamination

COUTA remains more robust than competing detectors as anomaly contamination increases, particularly at high contamination rates, because uncertainty-based calibration masks noisy training data.

  • COUTA shows better robustness than competing detectors, especially on datasets with large anomaly contamination rates.Performance is evaluated using F1 and AUC-PR across different training-set contamination ratios.
  • All evaluated anomaly detectors experience performance degradation as anomaly contamination increases.
  • Uncertainty modeling-based adaptive penalties mask contaminated samples instead of treating hidden anomalies as normal data.The competing methods may consequently overfit contaminated training data.

4.5 Scalability Test

COUTA scales well across time-series dimensionality and length, supporting its use on large-volume, high-dimensional data while some competitors run out of memory.

  • The scalability evaluation uses fixed-length datasets with dimensions from 8 to 512 and additional datasets ranging from 1,000 to 256,000 time steps.
  • TranAD, USAD, and MSCRED run out of memory when processing highly dimensional time-series data.
  • COUTA has good scalability compared with most existing methods across datasets with varying time-series sizes.Execution time is evaluated with respect to both time-series length and dimensionality.

4.6 Sensitivity Test

COUTA performs best when native anomaly generation uses the full perturbation pool, while its main hyperparameters generally have limited influence on detection performance.

  • The sensitivity analysis varies perturbation types and the key parameters α, β, H, and l across broad ranges.These parameters control anomaly-loss weighting, generated-anomaly size, feature-space dimensionality, and sliding-window length.
  • COUTA performs better with the full perturbation operation pool than with any single perturbation type, especially on ASD.A single perturbation type provides only fragmentary knowledge about the anomaly class.
  • The parameters α, β, and l do not largely influence performance, while smaller H can process high-dimensional datasets effectively.For example, Epilepsy can use H=5 dimensions.

4.7 Ablation Study

Ablation results show that both uncertainty modeling-based and native anomaly-based calibration contribute substantially to COUTA’s performance.

  • COUTA outperforms variants without UMC, without NAC, and without both components by 8%, 2%, and 7%, respectively.
  • UMC improves Epilepsy F1 by 11% and AUC-PR by 14% under severe contamination.
  • NAC improves ASD F1 and AUC-PR by approximately 8% each.

5 CONCLUSIONS

COUTA calibrates one-class learning with uncertainty modeling and native anomaly generation to learn time-series normality more robustly. Its scope assumes one shared normal prototype and excludes settings with concept drift, while future work targets better prior estimation and anomaly generation.

  • 5 CONCLUSIONS: COUTA combines uncertainty modeling-based and native anomaly-based calibration to learn data normality in a noise-tolerant, anomaly-informed manner.UMC restrains high-uncertainty noisy samples and encourages confident predictions, while NAC generates native anomalies through tailored perturbations.
  • 5 CONCLUSIONS: The method assumes normal data share similarities and belong to one prototype, so concept drift remains a failure setting.It is described as effective for seasonal and repetitive time series but potentially unsuccessful when concept drift occurs.
  • 5 CONCLUSIONS: Future work will improve estimation of the prior one-class distance distribution and extend tailored perturbations toward heuristic anomaly generation.The planned extensions concern both prior mean and variance estimation and more flexible native-anomaly production.
Loading 2207.12201v2…