PaperlayerView exact revision on arXiv

Source-linked AI summary

Deep Learning for Time Series Anomaly Detection: A Survey

Zahra Zamanzadeh Darban, Geoffrey I. Webb, Shirui Pan, Charu C. Aggarwal, Mahsa Salehi

arXiv:2211.05244v3cs.LGcs.AI

TL;DR

Time series anomaly detection must address anomalies in complex data used across applications such as urban management, intrusion detection, and medical risk. This survey organises deep-learning TSAD models into a taxonomy, reviews their techniques and applications, and discusses open challenges. It identifies the need for timely and accurate detection while noting vulnerability to noisy inputs and limited interpretability emphasis.

  • Problem

    Time series anomaly detection faces challenges from complex data and the need to detect anomalies accurately and promptly across varied application settings.

  • Method

    The survey provides a structured review and taxonomy of deep-learning TSAD models, covering forecasting, reconstruction, representation, and hybrid approaches.

  • Results

    The survey identifies state-of-the-art deep-learning models for TSAD and synthesises methods, applications, datasets, metrics, interpretability, and challenges.

  • Takeaways & Limitations

    The taxonomy and accompanying synthesis help identify future TSAD research directions and methods suitable for different application settings.

  • Takeaways & Limitations

    TSAD models are vulnerable to noise in input data, while research has primarily focused on detection precision rather than interpretability.

Abstract

from arXiv · show

Time series anomaly detection has applications in a wide range of research fields and applications, including manufacturing and healthcare. The presence of anomalies can indicate novel or unexpected events, such as production faults, system defects, or heart fluttering, and is therefore of particular interest. The large size and complex patterns of time series have led researchers to develop specialised deep learning models for detecting anomalous patterns. This survey focuses on providing structured and comprehensive state-of-the-art time series anomaly detection models through the use of deep learning. It providing a taxonomy based on the factors that divide anomaly detection models into different categories. Aside from describing the basic anomaly detection technique for each category, the advantages and limitations are also discussed. Furthermore, this study includes examples of deep anomaly detection in time series across various application domains in recent years. It finally summarises open issues in research and challenges faced while adopting deep anomaly detection models.

1 INTRODUCTION

Time series anomaly detection is increasingly important across diverse applications, while complex multidimensional and temporal patterns motivate specialised deep learning models. This survey addresses gaps in existing coverage by organising TSAD methods, resources, evaluation, interpretability, and practical guidance.

  • Time series anomaly detection supports applications including urban management, intrusion detection, medical risk, and natural disasters.
  • Deep anomaly detection models learn feature representations or anomaly scores for complex time series with spatial and temporal characteristics.
  • Existing surveys had not covered the broad range of recent TSAD methods or addressed representation learning within a TSAD taxonomy.
  • The survey presents a taxonomy classifying models into forecasting-based, reconstruction-based, representation-based, and hybrid categories according to neural-network architectures.
  • The review covers TSAD state of the art up to 2024, including prevailing directions, emerging trends, benchmarks, and datasets.
  • The survey offers practitioner guidelines for selecting architectures, datasets, and models, and discusses anomaly principles, evaluation metrics, and interpretability.

2 BACKGROUND

Time series are sequential observations that may be univariate or multivariate, with multivariate series additionally capturing intermetric dependencies. The survey decomposes series into components and classifies anomalies by temporal behavior and cross-metric relationships.

  • Time series consist of observations indexed sequentially over time and are commonly divided into univariate and multivariate forms.
  • Univariate time series track one changing variable, whereas multivariate series contain time-dependent variables related through temporal and intermetric dependencies.
  • Time Series Decomposition: A time series can be decomposed into secular trend, seasonal variation, cyclical fluctuation, and irregular variation, each of which may deviate from normal behavior.
  • Anomalies in Time Series: Anomalies are rare points or subsequences that deviate substantially from the general data distribution, while noise may remain irrelevant to analysis.
  • Types of Anomalies: Temporal anomalies include global, contextual, seasonal, trend, and other subsequence patterns, while multivariate anomalies may involve intermetric or temporal-intermetric relationships.
  • Anomaly Detection: Detection can compare model outputs with actual values and flag a point when their difference exceeds a threshold; contextual thresholds account for neighboring values.

3 TIME SERIES ANOMALY DETECTION METHODS

Time series anomaly detection methods span traditional statistical, clustering, distance, and density approaches alongside deep models organized by learning approach and architecture. Deep models address temporal and spatial dependencies, with forecasting and reconstruction as the two main approaches.

  • Traditional methods: Traditional methods learn normal statistical, cluster, distance, or density patterns and assign anomaly scores to deviations or sparse regions.Clustering methods use distances to normal centroids; distance-based methods use nearest-neighbour distances; density-based methods flag low-density windows.
  • Deep learning motivation: Deep neural networks are suited to complex time series because they model temporal and spatial dependencies, including intermetric anomalies in multivariate data.With MTS input, models can learn normality from both dependency types and detect abnormal relationships between metrics.
  • Taxonomy: The literature organizes deep time series anomaly detection around forecasting-based and reconstruction-based approaches, with architectures further categorized in the survey taxonomy.Forecasting models predict the next timestamp, whereas reconstruction models capture time-series embeddings.
  • Learning schemes: Learning schemes are unsupervised, supervised, semi-supervised, or self-supervised, determined by the availability of labelled data.Supervised methods learn normal–anomalous boundaries and thresholds, while unsupervised methods use no labels; semi-supervised methods use labelled normal data.
  • Learning schemes: Unsupervised methods avoid training labels and suit streaming applications, but their evaluation is difficult and supervised methods are often unsuitable when anomalies are unknown or mislabelled.Historical time-series data are often unlabelled, and anomalies can be unpredictable or improperly labelled.
  • Input and architectures: Models may process individual points or ordered windows, with window representations and sliding histories used to capture subsequence structure and temporal context.RNN-based models use prior windows to predict current values, while fixed window size limits very long-sequence processing.
  • Input and architectures: LSTM-based models are reported as more effective than RNN-based models when normal behaviour may involve long-term dependencies, while RNNs face fixed-window limits.The survey also describes CNN, TCN, GNN, HTM, autoencoder, and GAN-based methods for different time-series structures and detection settings.
  • Representative models: Examples include DeepAnt for small deviations and multiple anomaly types, GNNs for intermetric relationships, and autoencoders for nonlinear anomalies missed by linear PCA.DeepAnt handles UTS and MTS with under-5% contamination in an unsupervised setup; autoencoders avoid kernel PCA’s complex computations.

4 DATASETS

This section surveys 48 time-series anomaly-detection datasets and benchmarks, characterising them by data type, scale, domain, generation process, and entity structure. It also identifies datasets commonly used to benchmark TSAD models.

  • The survey compiles 48 well-known or highly cited datasets examined by classic and state-of-the-art deep TSAD models.
  • Datasets are characterised by whether they are univariate, multivariate, or both; their dimensions, sample counts, application domains, generation nature, and number of entities.
  • The dataset resource covers real, synthetic, and combined data-generation settings and multiple independent time-series entities.
  • The survey reports the latest available dataset updates and attributes, with Table 3 linking to primary sources for current versions.
  • Common MTS benchmarks include MSL, SMAP, SMD, SWaT, PSM, and WADI, while common UTS benchmarks include Yahoo, KPI, NAB, and UCR.

5 DISCUSSION AND CONCLUSION

The survey discusses major challenges in deep TSAD, including complex multivariate structure, scarce labels, noise, interpretability, periodic anomalies, and non-stationarity. It categorises 64 recent deep models, reviews applications and datasets, and calls for continued research.

  • Real-world non-stationarity and changing distributions motivate online or incremental training so models can adapt continuously to evolving patterns and sudden shifts.
  • High-dimensional multivariate TSAD must handle sparse data while modelling temporal dependencies and relationships between dimensions simultaneously.
  • Unlabelled anomalies require unsupervised, semi-supervised, or self-supervised approaches, while false positives remain a challenge for recall.
  • Noise can be irregularly distributed across time-series datasets, compromising model performance.
  • Interpretability remains under-addressed despite its importance for diagnostic applications, while periodic subsequence anomalies are also rarely studied and difficult to detect.
  • The survey comprehensively discusses and categorises 64 recent deep models for time-series anomaly detection.
  • The survey reviews TSAD applications across multiple domains and datasets, and identifies future research as necessary to overcome these challenges.

A EVALUATION METRICS FOR TIME SERIES ANOMALY DETECTION

This section presents evaluation metrics for TSAD, particularly for rare and sequential anomalies. It lists detection, timing, ranking, and interpretability measures and provides guidance for their use.

  • TSAD evaluation is important because anomalies are often rare and occur in sequences.
  • The listed measures collectively assess detection performance, timing, and related properties of anomaly-detection systems.
  • Table 4 includes Precision, Recall, F1 Score, F1_PA Score, AU-PR, AU-ROC, MTTD, Affliation, and VUS.
  • Table 5 provides guidelines for when to use each metric and how to interpret its values.

B INTERPRETABILITY METRICS

This section introduces metrics for evaluating how well TSAD systems identify and rank the dimensions or causes contributing to anomalies. The measures distinguish finding at least one cause from recovering all relevant causes and assess ranking quality.

  • Interpretability metrics quantify a model’s ability to identify and prioritise relevant factors or dimensions contributing to each anomaly.
  • HitRate@P% evaluates whether all true causes are included within the top P% of identified causes.
  • RC-top-k measures the fraction of events with at least one true cause among the model’s top-k identified causes.
  • RC-top-k rewards identifying at least one cause, whereas HitRate@P% rewards identifying all true causes.
  • RDCG@P% adapts NDCG to measure ranking effectiveness for relevant anomaly dimensions, using reconstruction error to rank likely contributing factors.

C EXPERIMENTAL RESULTS

Figure 12 compares 15 state-of-the-art TSAD models on four multivariate time-series datasets using F1 and F1PA scores. DACAD generally performs best on MSL, SMAP, and SMD, while newer models tend to outperform older ones.

  • C EXPERIMENTAL RESULTS: Figure 12 evaluates 15 TSAD models on MSL, SMAP, SMD, and SWaT using F1 and F1PA scores.The comparison covers four commonly used multivariate time-series datasets.
  • C EXPERIMENTAL RESULTS: DACAD (2024) generally outperforms other models, especially on the MSL, SMAP, and SMD datasets.DACAD has no SWaT results because it cannot produce results on that dataset.
  • C EXPERIMENTAL RESULTS: Older models including DAGMM (2018), LSTM-VAE (2018), and OmniAnomaly (2018) generally achieve lower scores than more recent models.
  • C EXPERIMENTAL RESULTS: The results show a performance-improvement trend in which newer models tend to achieve higher F1 and F1PA scores.The survey describes this pattern as indicating advances in anomaly detection techniques over time.

D.1 Computer Networks

Deep learning anomaly detection is applied across computer-network security and healthcare time series. The surveyed approaches use representation learning, sequential models, and specialised architectures to identify intrusions, abnormal heartbeats, and neurological or physiological anomalies.

  • Computer-network security: Network anomaly detection distinguishes malicious events from normal network behaviour, addressing unknown intrusion types that misuse detection cannot detect.
  • Computer-network security: Network intrusion detection systems are essential for identifying security breaches, but contemporary networks face increasing human-interaction demands and declining detection accuracy.
  • Computer-network security: Deep learning approaches learn features from unlabelled network traffic or use RBMs, deep belief networks, and unsupervised NDAEs for attack detection.
  • Healthcare: Healthcare applications include abnormal-heartbeat detection, where RNNs model temporal sequences and can produce promising results in noisy environments.
  • Healthcare: ECG anomaly detection is motivated by the prevalence of arrhythmias and the value of detecting abnormal heart rates for helping doctors identify cardiovascular disease.
  • Healthcare: Other healthcare approaches use echo state networks for imbalanced heart-rate data, TCN-GMM with Bayesian inference for epilepsy, and CNN ensembles for early Alzheimer’s detection.

D.3 Internet Of Things (IoT)

IoT anomaly detection supports monitoring of equipment, sensor data, and smart-home communications. Surveyed methods include predictive LSTMs, hierarchical TCNs, and an edge-deployed squeezed convolutional variational autoencoder, but offline learning limits adaptation to distribution changes.

  • Internet Of Things (IoT): IoT anomaly analysis can identify circumstances requiring human attention, uncover sensor-data outliers, and prefilter undesirable data to save computing resources.
  • Internet Of Things (IoT): Greenhouse applies a multi-step-ahead predictive LSTM to high volumes of IoT time series.
  • Internet Of Things (IoT): A semi-supervised hierarchical stacking TCN detects anomalies in smart-home communication.
  • Internet Of Things (IoT): Offline learning makes these IoT approaches not resistant to changes in input distribution.
  • Internet Of Things (IoT): Massive IIoT data support monitoring equipment status and improving operational performance.
  • Internet Of Things (IoT): Kim et al. use an unsupervised SCVAE in an edge-computing environment for real industrial IIoT time series from manufacturing CNC and UCI datasets.

D.4 Server Machines Monitoring and Maintenance

The survey covers anomaly detection for cloud services, wireless sensor networks, traffic systems, and astronomical time series. These applications use online, local, uncertainty-aware, spatiotemporal, and recurrent deep-learning methods to address operational and domain-specific anomalies.

  • Server Machines Monitoring and Maintenance: Cloud-service failures can trigger cascading failures that harm customer experience and company revenue, making continuous online anomaly monitoring essential.
  • Server Machines Monitoring and Maintenance: SLA-VAE uses a semi-supervised VAE for robust anomaly identification in multivariate server data, while active learning updates models from small samples of uncertain data.
  • Server Machines Monitoring and Maintenance: The cloud-server experiments use data from two game-business types and 11 monitored metrics, including CPU, disk, and memory usage.
  • Server Machines Monitoring and Maintenance: Wireless-sensor-network anomaly detection can use an autoencoder to detect sensor anomalies locally without communication with other sensors or the cloud.
  • Server Machines Monitoring and Maintenance: Traffic anomaly detection must model complex spatiotemporal dynamics while accommodating criteria that vary across locations and times.
  • Server Machines Monitoring and Maintenance: Surveyed traffic methods derive spatial and temporal features, capture spatiotemporal dependencies, or use hierarchical attention and graph-attention architectures.

D.7 Aerospace

Aerospace anomaly detection addresses severe safety risks in spacecraft and launch systems, where missed hazards or engine failures can cause catastrophic losses. Surveyed approaches include transformer-based, multimodal unsupervised, and missing-source methods for telemetry and multisource equipment data.

  • Missed spacecraft hazards during flight can lead to serious or catastrophic destruction.
  • A transformer-based model detects anomalies in advance using concurrent timestamp updates and a masking strategy.Testing was conducted on NASA telemetry datasets.
  • Liquid rocket engine health monitoring is critical for vehicle safety, particularly for human launches.Engine failure directly causes space-launch failure and irreparable losses.
  • A multimodal unsupervised method addresses anomaly detection in large equipment such as liquid rocket engines with missing sources.

D.8 Natural Disaster Detection

Natural-disaster anomaly detection covers earthquake precursors, wave arrival times, abnormal sensors, and real-time detection using diverse deep learning models. The surveyed methods include LSTMs, CNNs, convolutional RNNs, and post-hoc database analysis.

  • Earthquake detection relies on precursor data, while real-time detection requires high-density networks using inexpensive sensors.Low-cost acceleration sensors have become widely used for accurate earthquake detection.
  • Earthquake anomalies include changing tendencies that depart from normal periodic evolution and high-frequency mutations with large, irregular amplitudes.
  • LSTM-based predictive modeling can detect earthquake precursor data without extensive direct preprocessing.
  • Deep CNNs can determine earthquake-wave arrival times in archived data, while CNNs can detect and locate earthquakes from two local stations.
  • CrowdQuake uses a convolutional RNN as its core earthquake-detection algorithm.
  • Stored acceleration data support post-hoc identification of earthquakes missed by real-time detection and regular identification of abnormal sensors.

D.9 Energy

Energy and infrastructure applications use deep learning to detect faults, cyberattacks, abnormal consumption, process anomalies, and equipment failures across utility, industrial, robotic, ocean, and wastewater systems. The surveyed methods span CNNs, LSTMs, autoencoders, transfer learning, variational autoencoders, and wavelet neural networks.

  • CNN transfer learning is used to detect time-series anomalies in sparse-data settings, with results demonstrated on a gasoil-plant heating-loop dataset.The dataset contains data on cyberattacks against utility systems.
  • Power-system monitoring with phasor measurement units increases exposure to cyberattacks, motivating anomaly detection in multivariate PMU data.Detected events include line faults, trips, generation, and load changes before state estimation.
  • Anomaly detection in PMU data can help identify events before each state-estimation cycle and support grid reliability.The surveyed events include line faults, trips, generation, and load.
  • Autoencoder-based ensemble methods analyze building-energy time series to detect unexpected consumption patterns and excessive waste.Building energy management can improve efficiency, increase equipment life, and reduce consumption and operating costs.
  • System-call anomaly detection is difficult because processes may be time-driven, event-driven, or both.Kernel-level detection extracts features from system calls to cover a broad scope of anomalies and complex machine-to-machine interactions.
  • LSTM autoencoders encode and decode production-equipment values and evaluate deviations between reconstructed and actual values.CNNs are also used for multivariate semiconductor-production data, including anomalous-wafer detection and root-cause information.
  • Robot monitoring uses sliding-window convolutional variational autoencoders to detect multivariate anomalies spatially and temporally without supervision.The method targets incipient failures requiring continuous real-time tracking.
  • Ocean and wastewater applications use CNN, wavelet-neural-network, and LSTM methods for leak detection, unlabelled ocean anomaly detection, and collective-fault monitoring.OceanWNN detects anomalies in ocean observing time series without labelled training data, while an LSTM method detects collective faults in wastewater treatment plants.
Loading 2211.05244v3…