Source-linked AI summary
TFAD: A Decomposition Time Series Anomaly Detection Architecture with Time-Frequency Analysis
Chaoli Zhang, Tian Zhou, Qingsong Wen, Liang Sun
TL;DR
Time-series anomaly detection must handle complex temporal dependencies, limited labeled anomalies, and underused frequency-domain information. TFAD combines time- and frequency-domain branches with decomposition and data augmentation, achieving state-of-the-art performance on univariate and multivariate benchmark tasks.
Problem
Time-series anomaly detection is challenged by complex temporal dependencies, limited labeled anomaly data, and existing methods’ incomplete use of frequency-domain information.
Method
TFAD combines time-domain and frequency-domain branches with time-series decomposition, neural representation learning, and normal, abnormal, time-domain, and frequency-domain data augmentation.
Results
TFAD achieves state-of-the-art performance on four benchmark datasets in both univariate and multivariate time-series anomaly detection, with higher accuracy and lower variance reported in ablations.
Takeaways & Limitations
The time-frequency architecture addresses various time-series anomalies while decomposition supports model simplification and interpretability.
Takeaways & Limitations
Single-domain analysis has asymmetric limitations: point anomalies are harder to detect in the frequency domain, while seasonality anomalies are harder to detect in the time domain.
Abstract
from arXiv · showhide
Time series anomaly detection is a challenging problem due to the complex temporal dependencies and the limited label data. Although some algorithms including both traditional and deep models have been proposed, most of them mainly focus on time-domain modeling, and do not fully utilize the information in the frequency domain of the time series data. In this paper, we propose a Time-Frequency analysis based time series Anomaly Detection model, or TFAD for short, to exploit both time and frequency domains for performance improvement. Besides, we incorporate time series decomposition and data augmentation mechanisms in the designed time-frequency architecture to further boost the abilities of performance and interpretability. Empirical studies on widely used benchmark datasets show that our approach obtains state-of-the-art performance in univariate and multivariate time series anomaly detection tasks. Code is provided at https://github.com/DAMO-DI-ML/CIKM22-TFAD.
1 INTRODUCTION
Time-series anomaly detection must model temporal context and address scarce labels, while existing methods often underuse frequency-domain information. TFAD combines time- and frequency-domain branches with decomposition and multiple augmentation strategies, and the paper evaluates these choices empirically.
- Temporal dependencies make anomaly detection context-sensitive, while limited labeled anomalies motivate data augmentation.The paper identifies modeling temporal context and designing augmentation for anomaly detection as open challenges.
- Frequency-domain information can expose seasonality and some complex group anomalies that are harder to detect in the time domain alone.The paper states that existing methods mainly focus on time-domain modeling and do not fully use frequency information.
- TFAD combines time-domain and frequency-domain analysis to use temporal and frequency information for time-series anomaly detection.The architecture also includes decomposition and representation learning modules.
- TFAD augments normal, abnormal, time-domain, and frequency-domain views to address insufficient anomaly data.The contribution list specifically includes abnormal and frequency-domain augmentation alongside normal and time-domain augmentation.
- The paper evaluates TFAD on univariate and multivariate benchmark datasets and includes an ablation study of its modules.The evaluation plan covers comparisons with state-of-the-art algorithms and module analysis.
2 RELATED WORK
Prior time-series anomaly detection work spans traditional and deep methods, different data dimensionalities, label settings, and online or offline scenarios. TFAD differs from closely related approaches by combining time- and frequency-domain branches, decomposition, and data augmentation.
- Existing anomaly detection methods cover traditional and deep approaches across univariate, multivariate, supervised, semi-supervised, unsupervised, online, and offline settings.The related-work discussion organizes methods by technique, input dimensionality, label access, and deployment setting.
- The closest window-based framework supports multiple settings but operates only in the time domain, making complex pattern anomalies difficult to detect.The paper contrasts this limitation with TFAD’s use of frequency-domain analysis.
- TFAD combines time- and frequency-domain branches with time-series decomposition and several augmentation methods.The design is presented as distinct from existing work and intended to produce richer, reasonable, and reliable training data.
3 PRELIMINARIES
The preliminaries distinguish general anomaly categories from sequential anomaly types and formalize time series through timestamps, structural components, and anomaly criteria. They also introduce point, contextual, group, shapelet, seasonal, and trend concepts used to motivate the paper’s analysis.
- General Anomaly Definitions: General anomalies include point, contextual, and group anomalies, while sequential anomalies are classified into point and pattern anomalies.Sequential pattern anomalies include shapelet, seasonal, and trend anomalies.
- General Anomaly Definitions: The paper presents Figure 1 as an illustration of anomaly types in time series.The supplied figure materials identify the visual as covering anomalies in time series.
- Sequential Anomaly Definitions: Time-series data are sequences of timestamped points that can be structurally modeled with trend, seasonality, and shapelets.The structural formulation represents sinusoidal components and a trend component.
- Sequential Anomaly Definitions: The preliminaries include a Fourier-based representation of sinusoidal components and a trend term for structural time-series modeling.The equation passage defines timestamps, frequencies, coefficients, and the trend component.
- Sequential Anomaly Definitions: Point-wise anomalies compare an observed value with an expected value, whereas shapelet, seasonal, and trend anomalies compare corresponding sequential structures against expected patterns.The formal criteria use thresholded differences or similarity functions.
4.1 Motivation: Time-Frequency Analysis
Time- and frequency-domain analyses have complementary anomaly-detection strengths: time-domain methods detect point anomalies more readily, while frequency-domain analysis can better expose some pattern-wise anomalies. The uncertainty principle therefore motivates combining separate structures for both domains.
- Uncertainty Principle: The uncertainty principle relates the broadness of a signal in time and frequency through their standard deviations.The paper defines σ_t and σ_ω as measures of signal broadness in the two domains and derives a result using Schwarz inequality.
- Uncertainty Principle: Separate time- and frequency-domain structures are motivated because a model sensitive to one domain is less sensitive to the other.The paper frames this trade-off through the uncertainty principle and proposes merging domain-specific detectors.
- Single-Domain Limitations: Seasonality anomalies are harder to detect in the time domain than point anomalies.Time-domain analysis compares each point with its past neighbors, making point anomalies easier to identify than seasonality anomalies.
- Single-Domain Limitations: Frequency-domain differences for point-wise anomalies can be subtle and dispersed across many channels.The supplied passage contrasts this with the frequency-domain behavior of seasonality anomalies, whose continuation is truncated here.
4.2 Motivation: Data Augmentation and Decomposition
TFAD uses data augmentation and time-series decomposition to address limited labeled data and varied temporal patterns. Decomposition also supports component-level analysis and interpretability.
- Integrated Motivation: TFAD combines normal-data and anomaly-data augmentation with decomposition to improve robustness and analyze different components.The supplied architecture passage identifies all three mechanisms as part of the design.
- Data Augmentation: Diverse augmented anomalies generally contribute to model robustness.The paper considers augmentation for both normal and anomalous data because labeled anomaly data are limited.
- Decomposition: Time-series decomposition separates complex signals into main components for anomaly detection and interpretation.The paper states that component-level anomaly results provide insights into where anomalies occur.
4.3 High Level Architecture of TFAD
TFAD is organized around time-domain and frequency-domain analysis branches, supplemented by normal and anomaly data augmentation and time-series decomposition.
- High-Level Architecture: TFAD consists of time-domain and frequency-domain branches, with augmentation modules and decomposition supporting robustness and component-level explanations.The architecture includes both normal-data and anomaly-data augmentation modules and uses decomposition to analyze anomalies in different components.
4.4 Network Design of TFAD
TFAD combines time- and frequency-domain branches with decomposition, windowing, neural representations, and targeted augmentation to detect and interpret diverse anomalies.
- Data Augmentation Module: Normal augmentation removes residual noise with Robust STL and perturbs Fourier real and imaginary parts to create diverse, more normal training data.The procedure preserves innate normal patterns while increasing variation through small frequency-domain changes.
- Data Augmentation Module: TFAD augments anomalies using point scaling, sequence exchange, mix-up, and frequency-domain transformations to cover point, context, seasonal, and complex anomaly types.The augmentation strategy also considers anomalies beyond those originally present in the dataset.
- Decomposition Module: The HP filter decomposes each series into trend and residual components, while the authors note that separate decomposition of multivariate series is not optimal but improves results.The trend is obtained by minimizing a fit-and-smoothness objective, and both components are used because anomalies may occur in different components.
- Window Splitting: The model uses full and context windows so anomaly detection incorporates sequence-wise temporal correlations rather than isolated observations.A full window contains both a context window and a suspect window, with the suspect region evaluated against its context.
- Time and Frequency Branches: TFAD processes decomposed trend and residual components through time- and frequency-domain representation branches, then compares context and full-window representations for anomaly scoring.The architecture applies representation learning separately to each component and domain before measuring their similarity.
- Anomaly Score Module: A TCN provides sequence representations, and the anomaly score combines cosine similarity across trend and residual representations from both domains before sliding-window voting labels points.Higher dissimilarity indicates greater anomalousness, and points are labeled anomalous when more than half of their suspect windows are anomalous.
5 EXPERIMENTS
TFAD is evaluated against state-of-the-art methods on univariate and multivariate benchmark datasets using point-adjusted F1. It matches the best univariate performance on Yahoo, outperforms competing methods on KPI, and achieves the best results on SMAP and MSL.
- The evaluation compares TFAD with established conventional and deep-learning baselines across univariate and multivariate anomaly-detection benchmarks.The study includes SPOT, DSPOT, DONUT, SR variants, NCAD, and multiple multivariate neural models.
- The primary evaluation metric is point-adjusted F1, which counts an anomaly segment as detected when at least one point is identified.The metric is chosen for its fit to real-world events affecting multiple time points; broader metric evaluations are left for future work.
- TFAD significantly outperforms all competing algorithms on KPI while producing comparable performance to NCAD on Yahoo.The authors also report lower variance than NCAD in most univariate cases, indicating greater stability.
- TFAD achieves the best F1 score among competing algorithms on both SMAP and MSL multivariate datasets.
5.3 Ablation Studies
Ablation and case studies show that decomposition, augmentation, and time-frequency modeling each contribute to TFAD’s performance and interpretability. The visual analyses also expose a limitation when nearby anomalies alter the context representation of a later anomaly.
- 5.3 Ablation Studies: Adding decomposition to the base TCN improves KPI F1 by nearly 30%, while combining augmentation directions yields more than additive improvement.Normal and time-domain abnormal augmentation provide further gains, and their combination can enlarge the separation between normality and anomaly.
- 5.3 Ablation Studies: The time-only and frequency-only branches perform poorly in isolation, motivating their integration in the full TFAD architecture.The ablation also evaluates decomposition, augmentation, and frequency-branch modules together.
- 5.4.1 Contribution of time series decomposition module: Decomposition makes anomalies easier to detect by separating trend and residual components, with independent component representations enabling component-level anomaly scores.This supports explanations of which component contains the anomaly.
- 5.4.2 Effect of special anomaly data augmentation: Special slow-slope injection on SMAP’s first dimension produces significant additional performance gains when prior anomaly patterns are available.The augmentation is designed around the observation that this dimension contains slow slopes when anomalies appear.
- 5.4.2 Effect of special anomaly data augmentation: Nearby anomalies can conceal later rightmost anomalies because stronger middle anomalies substantially change the suspect-window and context-window representations.The authors identify adaptive window sizing as a possible future solution.
6 CONCLUSION
TFAD combines time-frequency analysis, decomposition, and data augmentation to address varied time-series anomalies and limited labeled anomaly data. Across four benchmark datasets, it achieves state-of-the-art performance with higher accuracy and lower variance in univariate and multivariate settings.
- TFAD combines time and frequency branches with time-series decomposition and data augmentation to improve performance, interpretability, and use of limited anomaly labels.
- Across four benchmark datasets, TFAD achieves state-of-the-art performance in univariate and multivariate time-series anomaly detection.
- Ablation studies report higher accuracy and lower variance for TFAD in both univariate and multivariate scenarios.