PaperlayerView exact revision on arXiv

Source-linked AI summary

Future of Time Series Anomaly Detection: From Historical Review to Unified Outlook

Zhijie Zhong, Zhiwen Yu, Pengyu Li, Liujian Zhang, Qiaoli Ni, Jiang Jun, Jianming Lv, Kaixiang Yang, C. L. Philip Chen

arXiv:2610.30628v1cs.LGcs.AI

TL;DR

TSAD surveys have limited coverage of emerging architectures and unified treatment of multivariate anomalies and evaluation issues. This survey develops taxonomies, reviews modern designs, and evaluates metrics; it concludes that no single metric captures performance across heterogeneous anomaly densities and sequence horizons.

  • Problem

    Existing surveys incompletely cover emerging architectures, multivariate anomaly definitions, and evaluation reliability, including the limitations of classical univariate anomaly taxonomies for interdependent variables.

    Source: §III · p. 4

  • Method

    The survey refines anomaly and algorithm-paradigm taxonomies, reviews modern architectures, evaluates metrics, and compiles an open benchmark repository.

    Source: §I · p. 2

  • Results

    No individual metric encapsulates performance across heterogeneous anomaly densities and sequence horizons, and F1-PA exhibits inflation bias and unstable score variance.

    Source: 2) Flawed Metrics · p. 9, 3) Analysis of Metrics · p. 9

  • Takeaways & Limitations

    Robust benchmarking calls for multi-metric evaluation, open-source implementations, and pre-trained checkpoints; the survey also offers selection guidance for operational constraints.

    Source: 2) Flawed Metrics · p. 9, B. Discussions on Algorithm… · p. 9

Abstract

from arXiv · show

Time series anomaly detection (TSAD) is a foundational problem in data mining, aiming to identify observations that deviate significantly from nominal temporal patterns. Driven by escalating data volumes and application complexity, recent research has yielded diverse architectures, including diffusion models, state space models, and large language models (LLMs). However, existing surveys provide limited coverage of these emerging designs and lack a unified treatment of multivariate anomalies, cross-domain unified modeling, metric reliability, and contemporary evaluation challenges. To bridge these gaps, this survey delivers three core contributions: (1) We establish a refined anomaly categorization and a structured taxonomy of paradigms reflecting modern advances, comparing detection mechanisms and charting developmental trajectories across paradigms. (2) We provide an extensive analysis of evaluation methodologies and conduct comprehensive experiments to assess metric fidelity, complemented by an open-source benchmark repository encompassing algorithms, datasets, and evaluation tools. (3) We outline key open challenges, offering forward-looking perspectives on dynamic thresholding, model interpretability, zero-shot transfer, multi-modal alignment, and foundational models for time series. By addressing existing theoretical and empirical limitations, this survey establishes a coherent framework to guide future TSAD research and practical deployments.

I. INTRODUCTION

TSAD research has expanded across architectures, while existing surveys leave gaps in emerging methods, multivariate anomaly definitions, and evaluation reliability. This survey responds with refined taxonomies, broader architecture coverage, metric analysis, and a roadmap for future research.

I. INTRODUCTION

  • LLM-based TSAD publications surged from 2024, while traditional forecasting and statistical research decelerated after 2022.Generative, similarity-based, and reconstruction paradigms remained highly active.Source: §I · p. 1
  • Existing surveys incompletely cover newer architectures and lack unified treatment of emerging paradigms, multivariate anomaly classification, and metric reliability.Ambiguous multivariate anomaly definitions are identified as a barrier to reproducible research.Source: §I · pp. 1–2
  • The survey introduces refined anomaly and paradigm taxonomies, reviews emerging architectures, evaluates metrics, releases a benchmark repository, and outlines open challenges.The challenges include dynamic thresholding, interpretability, zero-shot transfer, multimodal alignment, and foundational models.Source: §I · p. 2

A. Related Works

  • The review traces four phases, from classical methods and lightweight deep models to large-parameter architectures and future-oriented unified or LLM-adapted detectors.The phases cover classical machine learning, RNN/TCN/GNN and prototype models, Transformers/diffusion/SSMs, then cross-domain and LLM approaches.Source: A. Related Works · pp. 2–3
  • The review addresses prior coverage gaps by examining prototype, state space, diffusion, and LLM architectures alongside cross-domain unified TSAD models.Existing surveys are described as rarely covering this full range of modern architectures and unified models.Source: A. Related Works · p. 3
  • The related-work taxonomy classifies algorithms by core detection assumptions rather than superficial backbone implementations.It also formalizes channel-correlation anomalies to represent inter-channel relationships in multivariate detection.Source: A. Related Works · p. 3

B. Definitions

This section formalizes time-series inputs and the TSAD task, then defines anomaly labels and duration. It also notes that practical data may violate regular-sampling assumptions.

1) Definition of Problems:

  • A time series is an ordered sequence of observations with N timestamps and C channels; C > 1 is multivariate and C = 1 is univariate.The task estimates anomaly scores and predicts binary labels from the observations, with anomalies typically rare in real-world systems.Source: 1) Definition of Problems · pp. 3–4
  • Practical time series may have non-uniform sampling or missing values, requiring specialized preprocessing or robust architectural accommodations.Source: 1) Definition of Problems · pp. 3–4
  • A point anomaly is an isolated positive label, while a segment anomaly is a contiguous interval of positive labels whose length is j − i + 1.Segment boundaries need not be surrounded by normal timestamps, so distinct anomalies may occur close together; duration can reflect operational severity.Source: 1) Definition of Problems · p. 4

2) Multi-Domain Learning:

The section defines multi-domain learning and unified TSAD modeling for heterogeneous domains, then situates a refined anomaly taxonomy that adds multivariate channel-correlation anomalies to classical univariate types.

2) Multi-Domain Learning:

  • Multi-domain learning extracts shared representations across diverse temporal domains, whose sequence lengths and channel dimensions can differ.A unified detector maps temporal inputs to anomaly scores and domain-aware latent representations.Source: 2) Multi-Domain Learning · p. 4
  • Unified detectors use shared parameters across heterogeneous domains, with optional domain-specific adapters and goals of within-domain robustness and transfer to unseen domains.The domains may differ in sequence length and channel count.Source: 2) Multi-Domain Learning · p. 4

III. REFINED ANOMALY TAXONOMY

  • The classical global, contextual, and structural taxonomy is largely univariate, so the section adds channel-correlation anomalies to represent interdependent variables.The broader anomaly definition includes isolated points and contiguous subsequences departing from nominal behavior.Source: §III · p. 4

A. Global Anomalies

  • A global anomaly is an observation whose absolute deviation from its expected or reconstructed baseline exceeds the detection threshold.The formulation is defined for timestamp i and channel c.Source: A. Global Anomalies · p. 4

B. Contextual Anomalies

This section distinguishes contextual and structural anomalies from channel-correlation anomalies, which arise through coupled behavior across channels rather than extreme marginal values alone.

B. Contextual Anomalies

  • Contextual anomalies remain within a series’ global range but depart from the local temporal neighborhood, assessed using features such as local variance or neighborhood density.The contextual formulation compares localized features of an observed window and its reconstruction.Source: B. Contextual Anomalies · p. 5

C. Structural Anomalies

  • Structural anomalies extend across time: trend anomalies shift or drift, shape anomalies violate local morphology, and seasonal anomalies distort cycle timing or phase.Their generalized evaluation compares decomposed representations, such as trend, seasonal profiles, or shapelet distances, against a threshold.Source: C. Structural Anomalies · p. 5

D. Channel-Correlation Anomalies

  • Channel-correlation anomalies disrupt joint distributions through synchronous or coupled behavior, even when individual channels appear statistically nominal.The taxonomy includes global, contextual, trend, shape, and seasonal channel-correlation types.Source: D. Channel-Correlation Anomalies · p. 5
  • The generalized cross-channel score weights each channel’s contribution, allowing uninformative or decoupled channels to be masked with αc = 0.The formulation identifies observable synchrony empirically rather than serving as an explicit generative model.Source: D. Channel-Correlation Anomalies · p. 6

IV. TAXONOMY OF PARADIGMS

The taxonomy classifies TSAD algorithms by their core operational paradigms and uses ordered rules to assign methods consistently, including hybrids and pretrained models.

IV. TAXONOMY OF PARADIGMS

  • The section organizes TSAD algorithms by their core operational paradigms, describing their methodologies and formal structures.Table II compiles representative literature across paradigms, neural backbones, and unified models.Source: §IV · p. 6, Table II · p. 6
  • Methods fundamentally reliant on pretrained cross-domain representations are assigned to the LLM-based paradigm, regardless of anomaly-score form.This priority reflects the shift from task-specific learning to pretrained knowledge for zero-shot generalization.Source: §IV · p. 6
  • Other methods are classified by their core detection assumption, and hybrids by the paradigm of their primary anomaly score.The taxonomy also provides detailed decision criteria and boundary-disambiguation materials in the supplementary material.Source: §IV · p. 6

A. Reconstruction Paradigm

Reconstruction methods flag departures from faithfully reconstructed normal patterns, while forecasting methods use unexpected prediction discrepancies; recent evaluations report that forecasting architectures can perform TSAD out of the box.

A. Reconstruction Paradigm

  • Reconstruction methods encode a time window into a latent representation, decode it back, and use reconstruction error as the anomaly score.The error is typically MSE, and an anomaly is flagged when the score exceeds a predefined threshold.Source: A. Reconstruction Paradigm · p. 6

B. Forecasting Paradigm

  • Forecasting methods predict the next p time steps from a historical window and flag discrepancies that exceed a designated threshold.Prediction error is typically quantified using MSE.Source: B. Forecasting Paradigm · p. 7
  • Forecasting architectures designed for prediction can perform TSAD out of the box when intermediate layers extract stable, consistent temporal representations.The approach predicts forthcoming values and treats discrepancies between predicted and actual trajectories as anomaly evidence.Source: B. Forecasting Paradigm · pp. 6–7

C. Generative Paradigm

Generative detection scores deviations from samples produced under a learned data distribution, whereas similarity-based methods detect observations that are distant from or sparse within predominant data patterns.

C. Generative Paradigm

  • Generative models learn a data distribution and flag observations with unusually low likelihood or substantial deviation from synthetic counterparts.They can sample new data; their core principle is stochastic likelihood or density estimation rather than deterministic point-wise feature mapping.Source: C. Generative Paradigm · p. 7
  • At inference, a latent representation produces a synthetic observation, and a discrepancy metric determines the anomaly score.Common discrepancy choices include MSE or KL divergence; GANs may instead use a discriminator to assess authenticity.Source: C. Generative Paradigm · p. 7
  • Generative models use probabilistic objectives such as ELBO, adversarial losses, or score matching, unlike reconstruction models’ deterministic point-wise residuals.Their distribution is implicitly encoded in neural-network parameters rather than specified in closed analytical form.Source: C. Generative Paradigm · p. 7

D. Similarity-based Paradigm

  • Similarity-based methods compute geometric or statistical proximity, treating anomalies as less similar to the predominant data distribution.Distance, density, boundary-learning, and tree-isolation mechanisms operationalize this principle.Source: D. Similarity-based Paradigm · p. 7
  • Similarity scores can derive from neighborhood geometry or embedding-space distance, even when neural feature extractors are used.This classification follows the source of the anomaly score rather than the backbone architecture.Source: D. Similarity-based Paradigm · p. 8

E. LLM-based Paradigm

The LLM-based paradigm uses pretrained cross-domain context for semantic, context-aware anomaly judgments, while the statistical paradigm fits explicit analytical distributions or summary statistics. The discussion also identifies static thresholds as brittle under changing operational contexts.

E. LLM-based Paradigm

  • LLM-based detection uses pretrained cross-domain context and zero-shot reasoning for semantic, context-aware judgments rather than traditional mathematical error thresholds.Its adaptations include external knowledge, parameter-efficient fine-tuning, and multimodal or agentic extensions.Source: E. LLM-based Paradigm · p. 8
  • External-knowledge methods serialize numerical sequences as text and pair them with prompts that direct anomaly identification and explanation.Few-shot adaptation can freeze core LLM layers and fine-tune positional embeddings and layer normalization; multimodal systems can align sensor, text, and visual streams.Source: E. LLM-based Paradigm · p. 8
  • Methods using prediction-error scores may still belong to the LLM paradigm when their detection capability comes from pretrained cross-domain representations.GPT4TS and Timer are given as examples.Source: E. LLM-based Paradigm · p. 8

F. Statistical Paradigm

  • Statistical methods fit closed-form distributions or descriptive statistics without neural optimization, including Z-scores and multivariate density models.Low log-density can identify anomalies in parametric density-based models.Source: F. Statistical Paradigm · p. 8

V. DISCUSSIONS; A. Discussions on Evaluations

1) Anomaly Threshold:

  • Static thresholds can become brittle when conditional score distributions shift with changing operational contexts, even after input normalization.The discussion calls for continuous dynamic calibration and end-to-end learnable, context-specific decision boundaries.Source: 1) Anomaly Threshold · pp. 8–9

2) Flawed Metrics:

The section argues that point-adjusted F1 can inflate performance and that no single metric captures performance across heterogeneous anomaly densities and sequence horizons. It also relates architecture choice to operational constraints.

2) Flawed Metrics:

  • Point adjustment lets one correctly detected timestamp mark an entire anomalous segment as detected, inflating F1-PA precision and recall and enabling deceptively competitive random scores.The survey advises against relying on F1-PA and reports that no single metric captures performance across heterogeneous anomaly densities and sequence horizons.Source: 2) Flawed Metrics · p. 9

3) Analysis of Metrics:

  • F1-PA shows substantial score variance and unstable baseline bias, while range-based metrics differ markedly in discriminative capacity.Reduced-F1, R-based F1, TaPR, eTaPR, PATE, and AUC-PR can fail to separate detectors of distinct competency; R-based F1 and TaPR remain below theoretical maxima even under perfect detection.Source: 3) Analysis of Metrics · p. 9
  • PATE’s quadratic complexity makes it prohibitive on datasets exceeding 100,000 timestamps or containing over 50 anomalous segments.Evaluation overhead also scales steeply with sequence length and segment density.Source: 3) Analysis of Metrics · p. 9
  • Metric fidelity depends on segment duration: several metrics have low distortion for brief anomalies, while affiliation-based and volume-under-surface measures better fit extended intervals and high-variance regimes.The low-distortion metrics named are F1, PA%K, Reduced-F1, TaPR, and AUC-PR; the alternatives are NAff-F1, UAff-F1, VUS-ROC, and VUS-PR.Source: 3) Analysis of Metrics · p. 9

B. Discussions on Algorithm Architectures

  • Fig. 5 maps detection paradigms to representation architectures, with capacity gradients and directional edges indicating capacity progression and predominant implementations.The taxonomy captures mathematical assumptions and scoring principles, while architecture classes range from closed-form estimators to foundational models.Source: B. Discussions on Algorithm… · p. 9, Figure 5 · p. 9
  • Tables III and IV compare architecture strengths and limitations and translate those trade-offs into practical selection guidance.Candidates are grouped as recommended, secondary, or unsuitable for each criterion.Source: B. Discussions on Algorithm… · pp. 9–10
  • Architecture selection guidelines prioritize unified or LLM-based models for zero-shot and multimodal transfer, specialized deep models for complex dependencies, and statistical or classical methods for transparency or tight resource budgets.Transformer architectures are recommended when peak empirical accuracy dominates; diffusion, state-space, and foundational models are cautioned as minimal baselines due to training overhead and evolving designs.Source: B. Discussions on Algorithm… · p. 10

C. Discussions on General Technologies

The discussion highlights trade-offs in augmentation and channel independence, then outlines interpretability needs beyond correlational explanations. It proposes evaluation and annotation practices to support more rigorous explanatory TSAD.

C. Discussions on General Technologies

  • Augmentation can strengthen representation robustness under self-supervision, but naive mixing risks disrupting temporal causality and phase alignment.The discussion favors graph-guided or adversarially constrained perturbations that preserve physical constraints.Source: C. Discussions on General Technologies · p. 10
  • Channel independence can reduce overfitting and improve parameter sharing, but it blinds detectors to structural faults and channel-correlation anomalies.The proposed direction combines univariate temporal modeling with adaptive cross-channel message passing.Source: C. Discussions on General Technologies · p. 10

A. Interpretability

  • Existing explainable TSAD approaches often use heuristic attributions that do not reveal causal triggers, phase-delay progressions, or physical feedback mechanisms.The discussion frames operational transparency as essential alongside benchmark accuracy in mission-critical deployments.Source: A. Interpretability · p. 10
  • Interpretability evaluation proposals include datasets with verified explanations and annotations linking affected times to anomaly categories and root causes.Synthetic industrial data could encode verifiable cross-channel interactions; annotations should go beyond binary anomaly tags.Source: A. Interpretability · p. 10
  • A formal root-cause description grammar should record anomaly categories, temporal boundaries, causal channels, subsequences, and cascading effects for cross-model benchmarking.The descriptions can be compiled into a unified evaluation repository.Source: A. Interpretability · p. 11
  • Explanatory evaluation needs quantitative measures of fidelity, including explanation sparsity and stability under minor observational noise.Sparsity is the minimal feature subset needed to justify an alarm; stability measures attribution consistency.Source: A. Interpretability · p. 11
  • LLMs may translate attribution maps and multivariate statistical discrepancies into operator-friendly summaries despite their black-box architectures.The stated potential is to bridge complex model outputs and operational human decision-making.Source: A. Interpretability · p. 11

B. Zero-Shot Learning

The section frames reliable zero-shot detection as a goal challenged by data scarcity, domain and structural variation, and the gap between few-shot adaptation and true zero-shot inference. It then describes multimodal TSAD’s current limits and opportunities for deeper integration.

B. Zero-Shot Learning

  • Zero-shot learning aims to detect previously unseen anomaly patterns without target-domain training data, but reliable TSAD faces four primary challenges.The section links zero-shot deployment to avoiding the costs and operational latency of target-specific data collection and retraining.Source: B. Zero-Shot Learning · p. 12
  • Rare anomalies and binary-only benchmark tags constrain training, while domain shifts and heterogeneous sequences challenge generalization and rigid architectures.The section identifies structured domain knowledge and synthetic perturbations as potential ways to enrich training variety; real inputs may vary in length, sampling rate, and channel count.Source: B. Zero-Shot Learning · p. 12
  • Current large-scale time-series models often need fine-tuning on 5% of target data, leaving a gap between few-shot adaptation and true zero-shot inference.Source: B. Zero-Shot Learning · p. 12

C. Multi-Modality Learning

  • Multimodal TSAD approaches align sequential embeddings with language models or convert sequences into visual representations, but the research remains scarce.Directly formatting numerical values as text can degrade their mathematical semantics.Source: C. Multi-Modality Learning · p. 12
  • Current multimodal frameworks largely concatenate auxiliary features rather than perform deep cross-modal reasoning.Proposed opportunities include training with contextual metadata, conversational feedback that updates confidence and future predictions, and interactive prompts combining text and visual annotations.Source: C. Multi-Modality Learning · p. 12

D. Multi-Domain Learning

The section describes unified TSAD models as sharing parameters across domains and tasks while accommodating varied inputs. It contrasts native time-series foundation models with adapted LLMs, and points toward multimodal foundations and a broader roadmap for research and deployment.

D. Multi-Domain Learning

  • A unified TSAD model should share parameters across domains and tasks while processing different sequence lengths and variable counts without architectural changes.Source: D. Multi-Domain Learning · p. 12
  • Future unified models need zero-shot capability, scenario-adaptive thresholds, and interpretability that supports root-cause identification and suggested fixes.Source: D. Multi-Domain Learning · pp. 12–13

E. Foundational Models

  • Native time-series foundation models learn cross-domain temporal dynamics from large time-series collections, but limited high-quality open archives constrain their scale and generalization.Using numerical sequences alone also prevents access to external contextual knowledge across domains.Source: E. Foundational Models · p. 13
  • Adapted LLMs transfer linguistic representations to numerical sequences, but text tokenizers can lose precision in oscillations, magnitudes, and temporal phase relationships.Source: E. Foundational Models · p. 13

VII. CONCLUSION

  • The survey combines taxonomy, paradigm review, and empirical evaluation of benchmark protocols with a roadmap spanning adaptive thresholds, multimodal integration, and foundational models.It presents these challenges and open frontiers as guidance for future research and operational deployment.Source: §VII · p. 13

Related papers

Loading 2610.30628v1…