Time-Series Anomaly Detection

Ask about this topic

Overview

Time-series anomaly detection seeks unusual points, intervals, or changes in relationships among signals, often when labeled failures are scarce and early warnings matter. Common approaches forecast or reconstruct normal behavior and flag large residuals; others use density models, learned representations, graphs, causal structure, or ensembles to capture dependencies and changing operating regimes. Research spans univariate and multivariate benchmarks as well as industrial, medical, network, and edge-device settings, with growing attention to localization, explanations, and compute limits. A central tension is that results depend heavily on evaluation metrics, thresholds, windowing, and anomaly types, while strong benchmark scores may not carry over to distribution shifts or real-time deployment.

Latest papers

CardsList

208 papers35 papers in the last four weeks, up 169% on the four weeks before. 0.2% of all new papers.

Mar 18, 2026

BoundAD: Boundary-Aware Negative Generation for Time Series Anomaly Detection

Contrastive learning methods for time series anomaly detection (TSAD) heavily depend on the quality of negative sample construction. However, existing strategies based on random perturbations or pseudo-anomaly injection often struggle to simultaneously preserve temporal semantic consistency and provide effective decision-boundary supervision. Most existing methods rely on prior anomaly injection, while overlooking the potential of generating hard negatives near the data manifold boundary directly from normal samples themselves. To address this issue, we propose a reconstruction-driven boundary negative generation framework that automatically constructs hard negatives through the reconstruction process of normal samples. Specifically, the method first employs a reconstruction network to capture normal temporal patterns, and then introduces a reinforcement learning strategy to adaptively adjust the optimization update magnitude according to the current reconstruction state. In this way, boundary-shifted samples close to the normal data manifold can be induced along the reconstruction trajectory and further used for subsequent contrastive representation learning. Unlike existing methods that depend on explicit anomaly injection, the proposed framework does not require predefined anomaly patterns, but instead mines more challenging boundary negatives from the model's own learning dynamics. Experimental results show that the proposed method effectively improves anomaly representation learning and achieves competitive detection performance on the current dataset.

Xiancheng Wang, Lin Wang, Zhibo Zhang +2

School of Ocean Engineering, Harbin Institute of Technology, West Wenhua Road, Weihai, 264209, Shandong, China. · Technical Center, Bogie Development Department, CRRC Qingdao Sifang Locomotive and Rolling Stock Co., Ltd., Jinhong East Road, Qingdao, 266111, Shandong, China.

Time-Series Anomaly DetectionUnsupervised Anomaly DetectionHard Negative MiningSynthetic Anomaly GenerationSelf-Supervised Time Series Representation Learning
AskPDF
Mar 17, 2026

When GPUs Fail Quietly: Observability-Aware Early Warning Beyond Numeric Telemetry

GPU nodes are central to modern HPC and AI workloads, yet many failures do not manifest as immediate hard faults. While some instabilities emerge gradually as weak thermal or efficiency drift, a significant class occurs abruptly with little or no numeric precursor. In these detachment-class failures, GPUs become unavailable at the driver or interconnect level and the dominant observable signal is structural, including disappearance of device metrics and degradation of monitoring payload integrity. This paper proposes an observability-aware early-warning framework that jointly models (i) utilization-aware thermal drift signatures in GPU telemetry and (ii) monitoring-pipeline degradation indicators such as scrape latency increase, sample loss, time-series gaps, and device-metric disappearance. The framework is evaluated on production telemetry from GPU nodes at GWDG, where GPU, node, monitoring, and scheduler signals can be correlated. Results show that detachment failures exhibit minimal numeric precursor and are primarily observable through structural telemetry collapse, while joint modeling increases early-warning lead time compared to GPU-only detection. The dataset used in this study is publicly available at https://doi.org/10.5281/zenodo.19052367.

Michael Bidollahkhani, Freja Nordsiek, Julian M. Kunkel

Gesellschaft für wissenschaftliche Datenverarbeitung mbH Göttingen (GWDG) Georg-August-Universität Göttingen Göttingen, Germany

Fault DetectionPredictive MaintenanceTime-Series Anomaly DetectionHigh-Performance Computing
AskPDF
Mar 13, 2026

Surprised by Attention: Predictable Query Dynamics for Time Series Anomaly Detection

Multivariate time series anomalies often manifest as shifts in cross-channel dependencies rather than simple amplitude excursions. In autonomous driving, for instance, a steering command might be internally consistent but decouple from the resulting lateral acceleration. Residual-based detectors can miss such anomalies when flexible sequence models still reconstruct signals plausibly despite altered coordination. We introduce AxonAD, an unsupervised detector that treats multi-head attention query evolution as a short horizon predictable process. A gradient-updated reconstruction pathway is coupled with a history-only predictor that forecasts future query vectors from past context. This is trained via a masked predictor-target objective against an exponential moving average (EMA) target encoder. At inference, reconstruction error is combined with a tail-aggregated query mismatch score, which measures cosine deviation between predicted and target queries on recent timesteps. This dual approach provides sensitivity to structural dependency shifts while retaining amplitude-level detection. On proprietary in-vehicle telemetry with interval annotations and on the TSB-AD multi-variate suite (17 datasets, 180 series) with threshold-free and range-aware metrics, AxonAD improves ranking quality and temporal localization over strong baselines. Ablations confirm that query prediction and combined scoring are the primary drivers of the observed gains. Code is available at the URL https://github.com/iis-esslingen/AxonAD.

Kadir-Kaan Özer, René Ebeling, Markus Enzweiler

Mercedes-Benz AG, Germany · Institute for Intelligent Systems, Esslingen University of Applied Sciences, Germany

LLM-Based Time Series Anomaly DetectionTime-Series Anomaly DetectionUnsupervised Anomaly DetectionReconstruction-Based Anomaly Detection
AskPDF
Mar 13, 2026

On Using Machine Learning to Early Detect Catastrophic Failures in Marine Diesel Engines

Catastrophic failures of marine engines imply severe loss of functionality and destroy or damage the systems irreversibly. Being sudden and often unpredictable events, they pose a severe threat to navigation, crew, and passengers. The abrupt nature makes early detection the only effective countermeasure. However, research has concentrated on modeling the gradual degradation of components, with limited attention to sudden and anomalous phenomena. This work proposes a new method for early detection of catastrophic failures. Based on real data from a failed engine, the approach evaluates the derivatives of the deviation between actual sensor readings and expected values of engine variables. Predictions are obtained by a Random Forest, which is the most suitable Machine Learning algorithm among the tested ones. Traditional methods focus on deviations of monitored signals, whereas the proposed approach employs the derivatives of the deviations to provide earlier indications of abnormal dynamics, and to alert that a rapid and dangerous event is breaking out within the system. The method allows the detection of anomalies before measurements reach critical thresholds and alarms are triggered, which is the common method in industry. Consequently, operators can be warned in advance and shut down the engine, then prevent damage and unexpected power loss. Moreover, they have the time to safely change the ship route and avoid potential obstacles. Simulation results conf irm the effectiveness of the proposed approach in anticipating occurrence of catastrophic failures. Validation on real-world data further reinforces the robustness and practical applicability of the method. It is worth noting that data acquisition to train the predictive algorithm is not a problem, since a Deep Learning-based data augmentation procedure is used.

Francesco Maione, Paolo Lino, Giuseppe Giannino +1

Fault DetectionTime-Series Anomaly Detection
AskPDF
Mar 12, 2026

Anomaly detection in time-series via inductive biases in the latent space of conditional normalizing flows

Deep generative models for anomaly detection in multivariate time-series are typically trained by maximizing observed data likelihood. However, likelihood in observation space measures marginal density rather than conformity to structured temporal dynamics, and therefore can assign high probability to anomalous or out-of-distribution samples. We address this structural limitation by relocating the notion of anomaly to a prescribed latent space. We introduce explicit inductive biases in conditional normalizing flows, modeling time-series observations within a discrete-time state-space framework that constrains latent representations to evolve according to prescribed temporal dynamics. Under this formulation, expected behavior corresponds to compliance with a specified distribution over latent trajectories, while anomalies are defined as violations of these dynamics. Anomaly detection is consequently reformulated as a statistically grounded compliance test, such that observations are mapped to latent space and evaluated via goodness-of-fit tests against the prescribed latent evolution. This yields a principled decision rule that remains effective even in regions of high observation likelihood. Experiments on synthetic and real-world time-series demonstrate reliable detection of anomalies in frequency, amplitude, and observation noise, while providing interpretable diagnostics of model compliance.

David Baumgartner, Eliezer de Souza da Silva, Iñigo Urteaga

Department of Computer Science, Norwegian University of Science and Technology, Norway · BCAM — Basque Center for Applied Mathematics, Spain · Department of Informatics Engineering, University of Coimbra, Portugal +2

Normalizing FlowsLatent Dynamics ModelingTime-Series Anomaly Detection
AskPDF
Mar 12, 2026

CINDI: Conditional Imputation and Noisy Data Integrity with Flows in Power Grid Data

Real-world multivariate time series, particularly in critical infrastructure such as electrical power grids, are often corrupted by noise and anomalies that degrade the performance of downstream tasks. Standard data cleaning approaches often rely on disjoint strategies, which involve detecting errors with one model and imputing them with another. Such approaches can fail to capture the full joint distribution of the data and ignore prediction uncertainty. This work introduces Conditional Imputation and Noisy Data Integrity (CINDI), an unsupervised probabilistic framework designed to restore data integrity in complex time series. Unlike fragmented approaches, CINDI unifies anomaly detection and imputation into a single end-to-end system built on conditional normalizing flows. By modeling the exact conditional likelihood of the data, the framework identifies low-probability segments and iteratively samples statistically consistent replacements. This allows CINDI to efficiently reuse learned information while preserving the underlying physical and statistical properties of the system. We evaluate the framework using real-world grid loss data from a Norwegian power distribution operator, though the methodology is designed to generalize to any multivariate time series domain. The results demonstrate that CINDI yields robust performance compared to competitive baselines, offering a scalable solution for maintaining reliability in noisy environments.

David Baumgartner, Helge Langseth, Heri Ramampiaro

Department of Computer Science, Norwegian University of Science and Technology, Trondheim, Norway

Time Series ImputationTime-Series Anomaly DetectionUnsupervised Anomaly Detection
AskPDF
Mar 11, 2026

ECoLAD: Selecting Anomaly Detectors for Automotive Deployment via Compute-Reduction Evaluation

Automotive anomaly detectors are often selected from accuracy only benchmarks on workstation class hardware, whereas in-vehicle monitoring requires predictable scoring latency under limited CPU parallelism. This mismatch can make methods that appear competitive offline infeasible for deployment. We present ECoLAD (Efficiency Compute Ladder for Anomaly Detection), a deployment-oriented evaluation protocol for automotive time-series anomaly detection (TSAD). ECoLAD defines a monotone compute reduction ladder with explicit CPU thread caps, mechanical integer only hyperparameter scaling, inference/full run timing separation, and auditable run logs. Applied to proprietary in-vehicle telemetry and two public benchmarks, it shows that accuracy stability and deployment feasibility can diverge: some deep detectors retain AUC-PR while losing feasible throughput, whereas lightweight classical detectors sustain high scoring rates with positive lift above the random baseline, providing a practical screening procedure for detector selection under deployment relevant constraints.

Kadir-Kaan Özer, René Ebeling, Markus Enzweiler

Mercedes-Benz AG, Germany. · Esslingen University of Applied Sciences, Germany.

Efficient Neural Network InferenceAutomated EvaluationTime-Series Anomaly DetectionAnomaly Detection
AskPDF
Mar 11, 2026

Detecting Abnormal User Feedback Patterns through Temporal Sentiment Aggregation

In many real-world applications, such as customer feedback monitoring, brand reputation management, and product health tracking, understanding the temporal dynamics of user sentiment is crucial for early detection of anomalous events such as malicious review campaigns or sudden declines in user satisfaction. Traditional sentiment analysis methods focus on individual text classification, which is insufficient to capture collective behavioral shifts over time due to inherent noise and class imbalance in short user comments. In this work, we propose a temporal sentiment aggregation framework that leverages pretrained transformer-based language models to extract per-comment sentiment signals and aggregates them into time-window-level scores. Significant downward shifts in these aggregated scores are interpreted as potential anomalies in user feedback patterns. We adopt RoBERTa as our core semantic feature extractor and demonstrate, through empirical evaluation on real social media data, that the aggregated sentiment scores reveal meaningful trends and support effective anomaly detection. Experiments on real-world social media data demonstrate that our method successfully identifies statistically significant sentiment drops that correspond to coherent complaint patterns, providing an effective and interpretable solution for feedback anomaly monitoring.

Yalun Qi, Sichen Zhao, Zhiming Xue +2

Khoury College of Computer Science Northeastern University Boston United States · College of Engineering Northeastern University Boston United States · College of Professional Studies Northeastern University Boston United States

Anomaly DetectionTime-Series Anomaly DetectionSentiment AnalysisSocial Media Analysis
AskPDF
Mar 10, 2026

GNNs for Time Series Anomaly Detection: An Open-Source Framework and a Critical Evaluation

There is growing interest in applying graph-based methods to Time Series Anomaly Detection (TSAD), particularly Graph Neural Networks (GNNs), as they naturally model dependencies among multivariate signals. GNNs are typically used as backbones in score-based TSAD pipelines, where anomalies are identified through reconstruction or prediction errors followed by thresholding. However, and despite promising results, the field still lacks standardized frameworks for evaluation and suffers from persistent issues with metric design and interpretation. We thus present an open-source framework for TSAD using GNNs, designed to support reproducible experimentation across datasets, graph structures, and evaluation strategies. Built with flexibility and extensibility in mind, the framework facilitates systematic comparisons between TSAD models and enables in-depth analysis of performance and interpretability. Using this tool, we evaluate several GNN-based architectures alongside baseline models across two real-world datasets with contrasting structural characteristics. Our results show that GNNs not only improve detection performance but also offer significant gains in interpretability, an especially valuable feature for practical diagnosis. We also find that attention-based GNNs offer robustness when graph structure is uncertain or inferred. In addition, we reflect on common evaluation practices in TSAD, showing how certain metrics and thresholding strategies can obscure meaningful comparisons. Overall, this work contributes both practical tools and critical insights to advance the development and evaluation of graph-based TSAD systems.

Federico Bello, Gonzalo Chiarlone, Marcelo Fiori +2

Facultad de Ingeniería, Universidad de la República, Montevideo, Uruguay · Pento, Montevideo, Uruguay · Centro Interdisciplinario en Ciencia de Datos y Aprendizaje Automático (CICADA), Universidad de la República, Uruguay

Graph-Based Anomaly DetectionTime-Series Anomaly DetectionGraph Neural NetworksInterpretable Anomaly Detection
AskPDF
Mar 10, 2026

Temporal-Conditioned Normalizing Flows for Multivariate Time Series Anomaly Detection

This paper introduces temporal-conditioned normalizing flows (tcNF), a novel framework that addresses anomaly detection in time series data with accurate modeling of temporal dependencies and uncertainty. By conditioning normalizing flows on previous observations, tcNF effectively captures complex temporal dynamics and generates accurate probability distributions of expected behavior. This autoregressive approach enables robust anomaly detection by identifying low-probability events within the learned distribution. We evaluate tcNF on diverse datasets, demonstrating good accuracy and robustness compared to existing methods. A comprehensive analysis of strengths and limitations and open-source code is provided to facilitate reproducibility and future research.

David Baumgartner, Helge Langseth, Kenth Engø-Monsen +1

Department of Computer Science, Norwegian University of Science and Technology.

Time-Series Anomaly DetectionNormalizing Flows
AskPDF
Mar 9, 2026

An Interpretable Generative Framework for Anomaly Detection in High-Dimensional Financial Time Series

Detecting structural instability and anomalies in high-dimensional financial time series is challenging due to complex temporal dependence and evolving cross-sectional structure. We propose ReGEN-TAD, an interpretable generative framework that integrates modern machine learning with econometric diagnostics for anomaly detection. The model combines joint forecasting and reconstruction within a refined convolutional--transformer architecture and aggregates complementary signals capturing predictive inconsistency, reconstruction degradation, latent distortion, and volatility shifts. Robust calibration yields a unified anomaly score without labeled data. Experiments on synthetic and financial panels demonstrate improved robustness to structured deviations while enabling economically coherent factor-level attribution.

Waldyn G Martinez

Department of Information Systems & Analytics Farmer School of Business Miami University Oxford, OH 45056

Time-Series Anomaly DetectionInterpretable Anomaly DetectionUnsupervised Anomaly DetectionFinancial Time SeriesReconstruction-Based Anomaly Detection
AskPDF
Mar 6, 2026

DQE: A Semantic-Aware Evaluation Metric for Time Series Anomaly Detection

Time series anomaly detection has achieved remarkable progress in recent years. However, evaluation practices have received comparatively less attention, despite their critical importance. Existing metrics exhibit several limitations: (1) bias toward point-level coverage, (2) insensitivity or inconsistency in near-miss detections, (3) inadequate penalization of false alarms, and (4) inconsistency caused by threshold or threshold-interval selection. These limitations can produce unreliable or counterintuitive results, hindering objective progress. In this work, we revisit the evaluation of time series anomaly detection from the perspective of detection semantics and propose a novel metric for more comprehensive assessment. We first introduce a partitioning strategy grounded in detection semantics, which decomposes the local temporal region of each anomaly into three functionally distinct subregions. Using this partitioning, we evaluate overall detection behavior across events and design finer-grained scoring mechanisms for each subregion, enabling more reliable and interpretable assessment. Through a systematic study of existing metrics, we identify an evaluation bias associated with threshold-interval selection and adopt an approach that aggregates detection qualities across the full threshold spectrum, thereby eliminating evaluation inconsistency. Extensive experiments on synthetic and real-world data demonstrate that our metric provides stable, discriminative, and interpretable evaluation, while achieving robust assessment compared with ten widely used metrics.

Yuewei Li, Dalin Zhang, Huan Li +3

Hangzhou Dianzi University, Hangzhou, China · Zhejiang University, Hangzhou, China

Time-Series Anomaly DetectionAnomaly Detection
AskPDF
Feb 27, 2026

Unsupervised Anomaly Detection in Wearable Foot Sensor Data: A Baseline Feasibility Study Towards Diabetic Foot Ulcer Prevention

Diabetic foot ulcers (DFUs) are a severe complication of diabetes associated with significant morbidity, amputation risk, and healthcare burden. Developing effective continuous monitoring frameworks requires first establishing reliable baseline models of normal foot biomechanics. This paper presents a feasibility study of an anomaly detection framework applied to time-series data from wearable foot sensors, specifically NTC thin-film thermocouples for temperature and FlexiForce A401 pressure sensors for plantar load monitoring. Data were collected from healthy adult subjects across 312 capture sessions on an instrumented pathway, generating 93,790 valid multi-sensor readings spanning September 2023 to June 2024. Two unsupervised algorithms, Isolation Forest and K-Nearest Neighbors using Local Outlier Factor (KNN/LOF), were applied to detect statistical deviations in foot temperature and pressure signals. Results show that Isolation Forest is more sensitive to subtle, distributed anomalies, while KNN/LOF identifies concentrated extreme deviations but flags a higher proportion of sessions not corroborated by Isolation Forest. Since no clinical ground truth is available, this difference is interpreted as lower specificity under the shared 5 percent contamination assumption rather than a confirmed false-positive rate. A mild positive correlation (0.41-0.48) between pressure and temperature features supports the case for combined multi-modal monitoring. These findings establish a validated baseline analytical pipeline and provide a methodological foundation for future clinical validation studies involving diabetic patients, where the relationship between detected anomalies and DFU-related pathophysiology can be directly assessed.

Md Tanvir Hasan Turja

Department of Computer Science, Middlesex University London, London, UK

Unsupervised Anomaly DetectionWearable Health MonitoringTime-Series Anomaly Detection
AskPDF
Feb 27, 2026

Selective Denoising Diffusion Model for Time Series Anomaly Detection

Time series anomaly detection (TSAD) has been an important area of research for decades, with reconstruction-based methods, mostly based on generative models, gaining popularity and demonstrating success. Diffusion models have recently attracted attention due to their advanced generative capabilities. Existing diffusion-based methods for TSAD rely on a conditional strategy, which reconstructs input instances from white noise with the aid of the conditioner. However, this poses challenges in accurately reconstructing the normal parts, resulting in suboptimal detection performance. In response, we propose a novel diffusion-based method, named AnomalyFilter, which acts as a selective filter that only denoises anomaly parts in the instance while retaining normal parts. To build such a filter, we mask Gaussian noise during the training phase and conduct the denoising process without adding noise to the instances. The synergy of the two simple components greatly enhances the performance of naive diffusion models. Extensive experiments on five datasets demonstrate that AnomalyFilter achieves notably low reconstruction error on normal parts, providing empirical support for its effectiveness in anomaly detection. AnomalyFilter represents a pioneering approach that focuses on the noise design of diffusion models specifically tailored for TSAD.

Kohei Obata, Zheng Chen, Yasuko Matsubara +2

SANKEN, The University of Osaka, Osaka, Japan · Great Bay University, Dongguan, China

LLM-Based Time Series Anomaly DetectionTime-Series Anomaly DetectionReconstruction-Based Anomaly DetectionDiffusion ModelsMasked Diffusion Models
AskPDF
Feb 25, 2026

RAMSeS: Robust and Adaptive Model Selection for Time-Series Anomaly Detection Algorithms

Time-series data vary widely across domains, making a universal anomaly detector impractical. Methods that perform well on one dataset often fail to transfer because what counts as an anomaly is context dependent. The key challenge is to design a method that performs well in specific contexts while remaining adaptable across domains with varying data complexities. We present the Robust and Adaptive Model Selection for Time-Series Anomaly Detection RAMSeS framework. RAMSeS comprises two branches: (i) a stacking ensemble optimized with a genetic algorithm to leverage complementary detectors. (ii) An adaptive model-selection branch identifies the best single detector using techniques including Thompson sampling, robustness testing with generative adversarial networks, and Monte Carlo simulations. This dual strategy exploits the collective strength of multiple models and adapts to dataset-specific characteristics. We evaluate RAMSeS and show that it outperforms prior methods on F1.

Mohamed Abdelmaksoud, Sheng Ding, Andrey Morozov +1

BIFOLD & TU Berlin Berlin, Germany · University of Stuttgart Stuttgart, Germany

Time-Series Anomaly Detection
AskPDF
Feb 24, 2026

CGSTA: Cross-Scale Graph Contrast with Stability-Aware Alignment for Multivariate Time-Series Anomaly Detection

Multivariate time-series anomaly detection is essential for reliable industrial control, telemetry, and service monitoring. However, the evolving inter-variable dependencies and inevitable noise render it challenging. Existing methods often use single-scale graphs or instance-level contrast. Moreover, learned dynamic graphs can overfit noise without a stable anchor, causing false alarms or misses. To address these challenges, we propose the CGSTA framework with two key innovations. First, Dynamic Layered Graph Construction (DLGC) forms local, regional, and global views of variable relations for each sliding window; rather than contrasting whole windows, Contrastive Discrimination across Scales (CDS) contrasts graph representations within each view and aligns the same window across views to make learning structure-aware. Second, Stability-Aware Alignment (SAA) maintains a per-scale stable reference learned from normal data and guides the current window's fast-changing graphs toward it to suppress noise. We fuse the multi-scale and temporal features and use a conditional density estimator to produce per-time-step anomaly scores. Across four benchmarks, CGSTA delivers optimal performance on PSM and WADI, and is comparable to the baseline methods on SWaT and SMAP.

Zhongpeng Qi, Jun Zhang, Wei Li +1

Dalian Maritime University, Dalian, China · Harbin Engineering University, Harbin, China

Time-Series Anomaly DetectionGraph Contrastive LearningDynamic Graph LearningMultiscale Time-Series Modeling
AskPDF
Feb 22, 2026

TimeRadar: A Domain-Rotatable Foundation Model for Time Series Anomaly Detection

Current time series foundation models (TSFMs) primarily focus on learning prevalent and regular patterns within a predefined time or frequency domain to enable supervised downstream tasks (e.g., forecasting). Consequently, they are often ineffective for inherently unsupervised downstream tasks-such as time series anomaly detection (TSAD), which aims to identify rare, irregular patterns. This limitation arises because such abnormal patterns can closely resemble the regular patterns when presented in the same time/frequency domain. To address this issue, we introduce TimeRadar, an innovative TSFM built in a fractional time-frequency domain to support generalist TSAD across diverse unseen datasets. Our key insight is that rotating a time series into a data-dependent fractional time-frequency representation can adaptively differentiate the normal and abnormal signals across different datasets. To this end, a novel component, namely Fractionally modulated Time-Frequency Reconstruction (FTFRecon), is proposed in TimeRadar to leverage a learnable fractional order to rotate the time series to the most pronounced angle between a continuous time and frequency domain for accurate data reconstruction. This provides adaptive data reconstruction in an optimal time-frequency domain for each data input, enabling effective differentiation of the unbounded abnormal patterns from the regular ones across datasets, including unseen datasets. To allow TimeRadar to model local abnormality that is not captured by the global data reconstruction, we further introduce a Contextual Deviation Learning (CDL) component to model the local deviation of the input relative to its contextual time series data in the rotatable domain.

Hui He, Hezhe Qiao, Yutong Chen +2

School of Computing and Information Systems, Singapore Management University, Singapore · Chongqing Institute of Green and Intelligent Technology, University of Chinese Academy of Sciences, Chongqing, China · State Information Center, Beijing, China

Time-Series Anomaly DetectionUnsupervised Anomaly DetectionTime-Series Foundation ModelsZero-Shot Anomaly DetectionReconstruction-Based Anomaly Detection
AskPDF
Feb 19, 2026

Forecasting Anomaly Precursors via Uncertainty-Aware Time-Series Ensembles

Detecting anomalies in time-series data is critical in domains such as industrial operations, finance, and cybersecurity, where early identification of abnormal patterns is essential for ensuring system reliability and enabling preventive maintenance. However, most existing methods are reactive: they detect anomalies only after they occur and lack the capability to provide proactive early warning signals. In this paper, we propose FATE (Forecasting Anomalies with Time-series Ensembles), a novel unsupervised framework for detecting Precursors-of-Anomaly (PoA) by quantifying predictive uncertainty from a diverse ensemble of time-series forecasting models. Unlike prior approaches that rely on reconstruction errors or require ground-truth labels, FATE anticipates future values and leverages ensemble disagreement to signal early signs of potential anomalies without access to target values at inference time. To rigorously evaluate PoA detection, we introduce Precursor Time-series Aware Precision and Recall (PTaPR), a new metric that extends the traditional Time-series Aware Precision and Recall (TaPR) by jointly assessing segment-level accuracy, within-segment coverage, and temporal promptness of early predictions. This enables a more holistic assessment of early warning capabilities that existing metrics overlook. Experiments on five real-world benchmark datasets show that FATE achieves an average improvement of 19.9 percentage points in PTaPR AUC and 20.02 percentage points in early detection F1 score, outperforming baselines while requiring no anomaly labels. These results demonstrate the effectiveness and practicality of FATE for real-time unsupervised early warning in complex time-series environments.

Hyeongwon Kang, Jinwoo Park, Seunghun Han +1

Department of Industrial & Management Engineering, Korea University, 126-16 Anam-dong 5-ga, Seongbuk-gu, Seoul, Republic of Korea · Department of Industrial Engineering, Seoul National University, Gwanak-ro 1, Gwanak-gu, Seoul, Republic of Korea · LG CNS, 71, Magokjungang 8-ro, Gangseo-gu, Seoul, Republic of Korea

Early Warning DetectionTime-Series Anomaly DetectionUnsupervised Anomaly Detection
AskPDF
Feb 18, 2026

VETime: Vision Enhanced Zero-Shot Time Series Anomaly Detection

Time-series anomaly detection (TSAD) requires identifying both immediate Point Anomalies and long-range Context Anomalies. However, existing foundation models face a fundamental trade-off: 1D temporal models provide fine-grained pointwise localization but lack a global contextual perspective, while 2D vision-based models capture global patterns but suffer from information bottlenecks due to a lack of temporal alignment and coarse-grained pointwise detection. To resolve this dilemma, we propose VETime, the first TSAD framework that unifies temporal and visual modalities through fine-grained visual-temporal alignment and dynamic fusion. VETime introduces a Reversible Image Conversion and a Patch-Level Temporal Alignment module to establish a shared visual-temporal timeline, preserving discriminative details while maintaining temporal sensitivity. Furthermore, we design an Anomaly Window Contrastive Learning mechanism and a Task-Adaptive Multi-Modal Fusion to adaptively integrate the complementary perceptual strengths of both modalities. Extensive experiments demonstrate that VETime significantly outperforms state-of-the-art models in zero-shot scenarios, achieving superior localization precision with lower computational overhead than current vision-based approaches. Code available at: https://github.com/yyyangcoder/VETime .

Yingyuan Yang, Tian Lan, Yifei Gao +6

Department of Industrial Engineering, Tsinghua University, Beijing, China · Lab, Huawei Technologies Ltd, Beijing, China · Datadog AI Research.

Time-Series Anomaly DetectionZero-Shot Anomaly DetectionCross-Modal Alignment
AskPDF
Feb 17, 2026

Benchmarking IoT Time-Series AD with Event-Level Augmentations

Anomaly detection (AD) for safety-critical IoT time series should be judged at the event level: reliability and earliness under realistic perturbations. Yet many studies still emphasize point-level results on curated base datasets, limiting value for model selection in practice. We introduce an evaluation protocol with unified event-level augmentations that simulate real-world issues: calibrated sensor dropout, linear and log drift, additive noise, and window shifts. We also perform sensor-level probing via mask-as-missing zeroing with per-channel influence estimation to support root-cause analysis. We evaluate 14 representative models on five public anomaly datasets (SWaT, WADI, SMD, SKAB, TEP) and two industrial datasets (steam turbine, nuclear turbogenerator) using unified splits and event aggregation. There is no universal winner: graph-structured models transfer best under dropout and long events (e.g., on SWaT under additive noise F1 drops 0.804->0.677 for a graph autoencoder, 0.759->0.680 for a graph-attention variant, and 0.762->0.756 for a hybrid graph attention model); density/flow models work well on clean stationary plants but can be fragile to monotone drift; spectral CNNs lead when periodicity is strong; reconstruction autoencoders become competitive after basic sensor vetting; predictive/hybrid dynamics help when faults break temporal dependencies but remain window-sensitive. The protocol also informs design choices: on SWaT under log drift, replacing normalizing flows with Gaussian density reduces high-stress F1 from ~0.75 to ~0.57, and fixing a learned DAG gives a small clean-set gain (~0.5-1.0 points) but increases drift sensitivity by ~8x.

Dmitry Zhevnenko, Ilya Makarov, Aleksandr Kovalenko +6

AXXX, Moscow, Russia · Research Center of the Artificial Intelligence Institute, Innopolis University, Innopolis, Russia · Trusted AI Center, RAS, Moscow, Russia +1

Time-Series Anomaly DetectionAnomaly DetectionIndustrial Anomaly DetectionTime Series Data Augmentation
AskPDF
Feb 9, 2026

LEFT: Learnable Fusion of Tri-view Tokens for Unsupervised Time Series Anomaly Detection

As a fundamental data mining task, unsupervised time series anomaly detection (TSAD) aims to build a model for identifying abnormal timestamps without assuming the availability of annotations. A key challenge in unsupervised TSAD is that many anomalies are too subtle to exhibit detectable deviation in any single view (e.g., time domain), and instead manifest as inconsistencies across multiple views like time, frequency, and a mixture of resolutions. However, most cross-view methods rely on feature or score fusion and do not enforce analysis-synthesis consistency, meaning the frequency branch is not required to reconstruct the time signal through an inverse transform, and vice versa. In this paper, we present Learnable Fusion of Tri-view Tokens (LEFT), a unified unsupervised TSAD framework that models anomalies as inconsistencies across complementary representations. LEFT learns feature tokens from three views of the same input time series: frequency domain tokens that embed periodicity information, time domain tokens that capture local dynamics, and multi-scale tokens that learn abnormal patterns at varying time series granularities. By learning a set of adaptive Nyquist-constrained spectral filters, the original time series is rescaled into multiple resolutions and then encoded, allowing these multi-scale tokens to complement the extracted frequency and time domain information. When generating the fused representation, we introduce a novel objective that reconstructs fine-grained targets from coarser multi-scale structure, and put forward an innovative time-frequency cycle consistency constraint to explicitly regularize cross-view agreement. As cross-view agreement is explicitly regularized during training, LEFT can adopt lightweight tri-view encoders while maintaining effective coordination among the three views.

Dezheng Wang, Tong Chen, Guansong Pang +3

School of Automation, Southeast University Nanjing, China · School of Electrical Engineering and Computer Science, The University of Queensland Brisbane, Australia · School of Computing and Information Systems, Singapore Management University Singapore

Multi-View LearningUnsupervised Anomaly DetectionTime-Series Anomaly Detection
AskPDF
Feb 1, 2026

PaAno: Patch-Based Representation Learning for Time-Series Anomaly Detection

Although recent studies on time-series anomaly detection have increasingly adopted ever-larger neural network architectures such as transformers and foundation models, they incur high computational costs and memory usage, making them impractical for real-time and resource-constrained scenarios. Moreover, they often fail to demonstrate significant performance gains over simpler methods under rigorous evaluation protocols. In this study, we propose Patch-based representation learning for time-series Anomaly detection (PaAno), a lightweight yet effective method for fast and efficient time-series anomaly detection. PaAno extracts short temporal patches from time-series training data and uses a 1D convolutional neural network to embed each patch into a vector representation. The model is trained using a combination of triplet loss and pretext loss to ensure the embeddings capture informative temporal patterns from input patches. During inference, the anomaly score at each time step is computed by comparing the embeddings of its surrounding patches to those of normal patches extracted from the training time-series. Evaluated on the TSB-AD benchmark, PaAno achieved state-of-the-art performance, significantly outperforming existing methods, including those based on heavy architectures, on both univariate and multivariate time-series anomaly detection across various range-wise and point-wise performance measures.

Jinju Park, Seokho Kang

Department of Industrial Engineering, Sungkyunkwan University

Self-Supervised Time Series Representation LearningTime Series Representation LearningTime-Series Anomaly Detection
AskPDF
Jan 30, 2026

Securing Time Integrity in Energy IoT Against Clock Drift and Y2K38 Failures

Time integrity across distributed Internet of Things (IoT) devices is fundamental to reliable sensing, control, and security in energy cyber-physical systems. However, operational energy IoT systems remain vulnerable to clock-drift escalation, time-synchronization manipulation, and catastrophic timestamp discontinuities, e.g., the Year 2038 (Y2K38) Unix epoch overflow. These failures violate timestamp monotonicity, distort temporal ordering, and introduce structured inconsistencies in system observations. Conventional anomaly detection models, which typically assume reliable and uniformly ordered timestamps, are therefore ill-equipped to capture timing-layer failures. This paper introduces STGAT (Spatio-Temporal Graph Attention Network), a clock-dynamics-aware anomaly detection solution that jointly models temporal distortion and inter-device consistency in energy IoT systems. STGAT integrates drift-aware temporal embeddings and temporal self-attention to capture non-uniform and corrupted time evolution within individual device streams, while graph attention models the spatial propagation of timing inconsistencies across interconnected nodes. A Jacobian-regularized latent representation further promotes geometric separation between nominal clock evolution and anomalous temporal deformation caused by drift escalation, synchronization offsets, jitter accumulation, and epoch-overflow events. Experimental evaluation on energy IoT telemetry augmented with controlled timing-layer perturbations shows that STGAT achieves 95.7% accuracy, 94.0% precision, 92.0% recall, 93.0% F1-score, and 0.97 AUC under the primary test setting. STGAT also reduces detection delay to 2.3 time steps, corresponding to a 26% improvement over the closest baseline, while maintaining stable performance under overflow-induced discontinuities, stealthy drift escalation, and temporally induced physical inconsistencies.

Saeid Jamshidi, Foutse Khomh, Carol Fung +2

SWAT Laboratory, Polytechnique Montréal, Québec, Canada · CIISE, Concordia University, Montréal, QC, Canada · Department of Computer Engineering and Software Engineering, Polytechnique Montréal, Québec, Canada +1

Time-Series Anomaly DetectionSpatiotemporal GNNs
AskPDF
Nov 10, 2025

COGNOS: Universal Enhancement for Time Series Anomaly Detection via Constrained Gaussian-Noise Optimization and Smoothing

Reconstruction-based methods are a dominant paradigm in time series anomaly detection (TSAD), however, their near-universal reliance on Mean Squared Error (MSE) loss results in statistically flawed reconstruction residuals. This fundamental weakness leads to noisy, unstable anomaly scores, hindering reliable detection. To address this, we propose Constrained Gaussian-Noise Optimization and Smoothing (COGNOS), a universal, model-agnostic enhancement framework that tackles this issue at its source. COGNOS introduces a novel Gaussian-White Noise Regularization strategy during training, which directly constrains the model's output residuals to conform to a Gaussian white noise distribution. This engineered statistical property creates the ideal precondition for our second contribution: Adaptive Residual Kalman Smoother that operates as a statistically robust estimator to denoise the raw anomaly scores. Extensive experiments on multiple benchmarks demonstrate that COGNOS consistently enhances the performance of state-of-the-art backbones significantly, validating the efficacy of coupling statistical regularization with adaptive filtering.

Wenlong Shang, Shihao Tian, Xutong Wan +1

School of Information Science and Technology, Beijing University of Technology, China · Beijing Key Laboratory of Computational Intelligence and Intelligent System, Beijing University of Technology, China

Reconstruction-Based Anomaly DetectionTime-Series Anomaly Detection
AskPDF
Oct 18, 2025

Structured Temporal Causality for Interpretable Multivariate Time Series Anomaly Detection

Real-world multivariate time series anomalies are rare and often unlabeled. Additionally, prevailing methods rely on increasingly complex architectures tuned to benchmarks, detecting only fragments of anomalous segments and overstating performance. In this paper, we introduce OracleAD, a simple and interpretable unsupervised framework for multivariate time series anomaly detection. OracleAD encodes each variable's past sequence into a single causal embedding to jointly predict the present time point and reconstruct the input window, effectively modeling temporal dynamics. These embeddings then undergo a self-attention mechanism to project them into a shared latent space and capture spatial relationships. These relationships are not static, since they are modeled by a property that emerges from each variable's temporal dynamics. The projected embeddings are aligned to a Stable Latent Structure (SLS) representing normal-state relationships. Anomalies are identified using a dual scoring mechanism based on prediction error and deviation from the SLS, enabling fine-grained anomaly diagnosis at each time point and across individual variables. Since any noticeable SLS deviation originates from embeddings that violate the learned temporal causality of normal data, OracleAD directly pinpoints the root-cause variables at the embedding level. OracleAD achieves state-of-the-art results across multiple real-world datasets and evaluation protocols, while remaining interpretable through SLS.

Dongchan Cho, Jiho Han, Keumyeong Kang +3

Industrial AI Lab, SimPlatform Co. Ltd. Affiliate Research Institute

Time-Series Anomaly DetectionUnsupervised Anomaly DetectionInterpretable Anomaly DetectionAnomaly LocalizationReconstruction-Based Anomaly Detection
AskPDF
Sep 10, 2025

SPADE: A Large Language Model Framework for Soil Moisture Pattern Recognition and Anomaly Detection in Precision Agriculture

Accurate interpretation of soil moisture patterns is critical for irrigation scheduling and crop management, yet existing approaches for soil moisture time-series analysis either rely on threshold-based rules or data-hungry machine learning or deep learning models that are limited in adaptability and interpretability. In this study, we propose SPADE (Soil moisture Pattern and Anomaly DEtection), which, to the best of our knowledge, is the first LLM-based framework specifically developed for soil moisture time-series analysis. Using GPT-4.1 and domain-informed prompts, SPADE performs zero-shot joint identification of wetting events and anomalies without task-specific annotation, training, or fine-tuning. By converting time-series observations into a textual representation, SPADE identifies wetting-event timing, estimates sensor-level moisture responses, detects and classifies multiple predefined anomaly types, and generates structured, human-readable reports. SPADE was evaluated using real-world soil moisture data collected from commercial and research farms encompassing four crop types across the United States. Compared with the evaluated training-free baselines, SPADE achieved higher anomaly recall and F1-score, strong precision and recall for wetting-event detection, and high accuracy in classifying the observed anomaly types. Its structured reports summarize event timing, anomaly type, concise explanations, and sensor-level moisture responses, supporting practical interpretation of soil moisture patterns. These outputs may support soil moisture review, anomaly screening, and relative comparison of wetting responses rather than direct irrigation prescription.

Yeonju Lee, Rui Qi Chen, Joseph Oboamah +7

H. Milton Stewart School of Industrial and Systems Engineering, Georgia Institute of Technology, Atlanta, GA, USA · Panhandle Research and Extension Center, University of Nebraska-Lincoln, Scottsbluff, NE, USA · Department of Computer Science and Engineering, University of Nebraska-Lincoln, Lincoln, NE, USA +3

Zero-Shot Anomaly DetectionTime-Series Anomaly DetectionPrecision Agriculture
AskPDF
Jul 31, 2025

Signature-Kernel One-Class Learning with Manifold Regularisation for Multivariate Time Series Anomaly Detection

One-class learning is an effective methodology for time series anomaly detection, yet kernel one-class approaches often compare sequences in a pointwise fashion and ignore the geometry of normal data. In this work, we present a manifold-regularised, large-margin ℓp\ell_p-support vector data description (ℓp\ell_p-SVDD) method that analyses sequences as paths via the signature kernel. By incorporating a a graph-Laplacian penalty into the ℓp\ell_p-SVDD objective function and utilising the representer theorem for manifold regularisation, we illustrate that the dual task retains the functional form of the original one with a modified kernel matrix. As such, existing Frank--Wolfe solvers can be applied unchanged. We show that this new modified kernel is a valid kernel matrix and under a generic norm bound on the discriminant, the proposed model yields a smaller Rademacher-complexity bound than the baseline. Furthermore, the signature kernel which is computed through a Goursat partial differential equation and can handle irregularly sampled data and is invariant to reparametrisation has not previously been used for one-class time series anomaly detection to the best of our knowledge. Our experiments on five widely used benchmarks, evaluated without point adjustment, demonstrate that the proposed approach compares very favourably with the state of the art approaches.

Shervin Rahimzadeh Arashloo

Department of Computer Engineering, Faculty of Engineering, Bilkent University, Ankara, Turkey.

Time-Series Anomaly DetectionOne-Class ClassificationKernel Methods
AskPDF
Mar 31, 2025

FANTF: Fuzzy attention network based transformers for time series analysis

This paper introduces Fuzzy Attention Network-Based Transformer (FANTF), an approach for time series forecasting, classification, and anomaly detection. FANTF combines fuzzy logic concepts with transformer architectures through a novel fuzzy attention mechanism. The proposed mechanism is inspired by Type-2 fuzzy set theory. It uses a learnable Gaussian uncertainty perturbation to model uncertainty in attention relevance scores. This makes it possible for the model to accurately capture uncertainty in temporal relationships better than normal deterministic attention. Transformers capacity to record complex temporal patterns and multivariate connections is enhanced by FANTF. The approach is both architecture-agnostic and task-agnostic. The proposed fuzzy attention module can be used as a direct replacement for the standard attention layer. To evaluate its effectiveness, FANTF is integrated into five transformer backbones: Transformer, Informer, PatchTST, Crossformer, and iTransformer. The fuzzy attention mechanism produces softer and more diverse attention distributions. It provides uncertainty-aware interpretations through attention heatmap visualizations. Experimental evaluations on some real-life datasets reveal that FANTF enhances the forecasting performance, classification, and anomaly detection tasks over traditional transformer-based models. FANTF achieves statistically significant and competitive performance improvements over standard transformer-based baselines on most benchmark datasets (p < 0.05, Wilcoxon signed-rank test), observed under noisy and non-stationary time series conditions.

Sanjay Chakraborty, Fredrik Heintz

Department of Computer and Information Science (IDA), REAL, AIICS, Linköping University, Linköping, Sweden

Time Series TransformersTime Series ForecastingTime Series ClassificationFuzzy LogicTime-Series Anomaly Detection
AskPDF