Deep learning models have become the dominant approach for multivariate time series anomaly detection (MTSAD), often reporting substantial performance improvements over classical statistical methods. However, these gains are frequently evaluated under heterogeneous thresholding strategies and evaluation protocols, making fair comparisons difficult. This work revisits OmniAnomaly, a widely used stochastic recurrent model for MTSAD, and systematically compares it with a simple linear baseline based on Principal Component Analysis (PCA) on the Server Machine Dataset (SMD). Both methods are evaluated under identical thresholding and evaluation procedures, with experiments repeated across 100 runs for each of the 28 machines in the dataset. Performance is evaluated using Precision, Recall and F1-score at point-level, with and without point-adjustment, and under different aggregation strategies across machines and runs, with the corresponding standard deviations also reported. The results show large variability across machines and show that PCA can achieve performance comparable to OmniAnomaly, and even outperform it when point-adjustment is not applied. These findings question the added value of more complex architectures under current benchmarking practices and highlight the critical role of evaluation methodology in MTSAD research.
Figures & tables
Machine
Time Points
Anomaly Points
Anomaly Segments
All (test)
# (% All)
#
Min–Max
Mean (std)
1-1
56958 (28479)
2694 (4.73)
8
2–721
336.75 (272.45)
1-2
47388 (23694)
542 (1.14)
10
3–156
54.20 (42.12)
1-3
47405 (23703)
817 (1.72)
12
3–225
68.08 (70.76)
1-4
47413 (23707)
720 (1.52)
12
3–205
60.00 (55.55)
1-5
47411 (23706)
100 (0.21)
7
4–31
14.29 (8.83)
Table 1: Summary for the SMD dataset: number of points (total, test, anomaly segments) and number/length of anomaly segments: min–max and mean (std).
Figure 1: Pipeline for anomaly detection via OmniAnomaly. Adapted from [ 12 ] .
OmniAnomaly results (reported in Su et al. 2019 [ 12 ] )
POT threshold
GS threshold
Method
P
R
F1
P
R
F1
LSTM-NDT [ 5 ]
0.568
0.644
0.604
–
–
≈ 0.68
DAGMM [ 16 ]
0.595
0.878
0.709
–
–
≈ 0.74
LSTM-VAE [ 9 ]
0.792
0.708
0.784
–
–
≈ 0.80
OmniAnomaly [ 12 ]
0.833
0.945
0.886
–
–
0.962
Table 2: Performance on the SMD dataset. The upper panel shows previous results [ 12 ] . For GS, only F1-scores are available from Fig. 4 in [ 12 ] and were approximated via pixel-based extraction. The lower panel reports results in this study for 100 independent runs, as mean (std), minimum and maximum.
Machine
POT
GS
F1
P
R
Ed
Ea
Sd
La (%)
F1
P
R
Ed
Ea
Sd
La (%)
mean (std)
max (min)
mean (std)
max (min)
1-1
0.985 (0.008)
0.972 (0.016)
0.999 (0.001)
110.84 (31.86)
67.73 (11.99)
7.12 (0.73)
15.53 (17.68)
50.00 (0.00)
0.999 (0.000)
1.000 (0.000)
0.997 (0.000)
8.81 (2.04)
8.81 (2.04)
5.00 (0.00)
0.37 (0.74)
3.97 (0.00)
1-2
0.870 (0.011)
0.873 (0.021)
0.867 (0.000)
86.31 (9.08)
27.10 (1.89)
9.00 (0.00)
15.08 (15.60)
94.44 (0.00)
0.907 (0.006)
0.951 (0.014)
0.867 (0.002)
41.21 (8.87)
19.40 (2.70)
8.90 (0.30)
8.14 (9.88)
59.32 (0.00)
1-3
0.914 (0.007)
0.963 (0.009)
0.870 (0.012)
81.32 (11.23)
58.17 (7.81)
8.49 (0.58)
18.23 (16.66)
50.52 (0.00)
0.929 (0.010)
0.968 (0.031)
0.895 (0.043)
60.88 (38.62)
42.47 (24.11)
9.01 (1.06)
16.05 (16.70)
50.52 (0.00)
1-4
0.907 (0.036)
0.886 (0.067)
0.933 (0.014)
94.46 (6.46)
57.51 (2.49)
9.69 (0.46)
25.16 (26.39)
100.00 (0.00)
0.950 (0.002)
0.988 (0.010)
0.915 (0.007)
28.26 (15.80)
20.53 (9.64)
9.07 (0.26)
17.18 (26.47)
89.13 (0.00)
Table 3: Performance of OmniAnomaly using the POT and GS thresholding strategies under the point-adjustment (PA) evaluation protocol. Results are reported as mean (standard deviation) over 100 runs. Additional segment-level metrics include the number of detected episodes ( Ed ), anomaly episodes ( Ea ), detected segments ( Sd ) and anomaly length ( La ).
Figure 2: Comparison between OmniAnomaly and PCA across all machines, (a) POT with PA, (b) GS with PA, (c) POT without PA and (d) GS without PA. Aggregated F1-scores { F1A,F1M,F1m } represented by { ×,⧫,+ } symbols.
Anomaly detection is a fundamental task for time-series analytics, with important implications for the downstream performance of many applications. Despite the large number of anomaly detection methods proposed in the literature, recent benchmark studies have shown that no single detector performs best across highly heterogeneous time series. Therefore, a practical and scalable solution is to develop a model-selection method that, for a given time series, selects the anomaly detector most likely to perform well. Nevertheless, the model selection approaches proposed in the literature suffer from a significant drop in accuracy when applied in Out-of-Distribution (OOD) settings. In this paper, we tackle the aforementioned limitation and propose RAMSAD, a retrieval-based framework for model selection in time-series anomaly detection. Given a new time series, our method queries a knowledge base of previously observed instances, retrieves the top-k most similar series, and transfers detector recommendations from their performance profiles. The framework can operate with standard similarity measures as well as embedding-based representations. Our results show that RAMSAD outperforms existing baselines in In-Distribution (ID) settings and is the most robust selector in OOD, where, when selecting a small subset of detectors, it matches or exceeds ensembles that run the entire detector pool, at a fraction of their cost. Overall, we demonstrate that similarity-based retrieval constitutes a strong and efficient foundation for model selection in time-series anomaly detection.
Matrix Profile (MP) methods are an interpretable and scalable family of distance-based methods for time-series anomaly detection, but strong benchmark performance still depends on design choices beyond a vanilla nearest-neighbor profile. This technical report documents an open-source Matrix Profile for Anomaly Detection (MMPAD) submission to TSB-AD, a benchmark that covers both univariate and multivariate time series. The submitted system combines pre-sorted multidimensional aggregation, efficient exclusion-zone-aware k-nearest-neighbor (kNN) retrieval for repeated anomalies, and moving-average post-processing. To serve as a reproducible reference for MP-based anomaly detection on TSB-AD, we detail the released implementation, the hyperparameter settings for the univariate and multivariate tracks, and the corresponding benchmark results. We further analyze how the system performs on the aggregate leaderboard and across specific dataset characteristics.The open-source implementation is available at https://github.com/mcyeh/mmpad_tsb.
Multivariate Time Series Anomaly Detection (MTSAD) is essential for reliability and safety in domains such as industrial process monitoring and financial risk management, yet conventional approaches rely on application-specific models that are costly to train and hard to scale. Foundation Models (FMs), pre-trained on broad data with strong zero-shot generalization, have recently become available for univariate time series forecasting, raising the question of whether they can address MTSAD without task-specific training. We investigate the zero-shot application of a univariate forecasting FM, TimesFM, to industrial MTSAD on the Secure Water Treatment (SWaT) benchmark, evaluating two strategies: treating the FM as a per-feature forecaster with thresholded prediction errors, and as an embedder whose intermediate representations feed standard outlier detectors. Neither of our proposed setups is competitive with established baselines; embeddings reveal only partial separation between normal and anomalous segments, insufficient for reliable detection. The cause is that the FM is too effective at capturing temporal dynamics, yielding low error even within fully anomalous windows, so persistent anomalies become indistinguishable from normal behavior. However, these observations yield valuable insights: the error peaks at anomaly boundaries, indicating FMs reliably detect distribution changes. We conclude that the proposed naive zero-shot FMs are unsuitable for MTSAD but promising for change-point detection.
Martin Uray, Saverio Messineo, Roland Kwitt +1
Josef Ressel Centre for Intelligent and Secure Industrial Automation, Salzburg University of Applied Sciences, Austria · Department of Artificial Intelligence and Human Interfaces, Paris Lodron University of Salzburg, Austria