Future of Time Series Anomaly Detection: From Historical Review to Unified Outlook

Abstract

Time series anomaly detection (TSAD), a major topic in data mining, focuses on recognizing patterns that dramatically depart from normal behavior in time series data, a work of crucial practical value. Driven by the rapid expansion in data volume and the rising complexity of application situations, recent years have witnessed the creation of various unique TSAD models, including diffusion models, State Space Models, and Large Language Models. However, existing reviews generally lack thorough coverage of these developing algorithmic designs and give little commentary on multivariate anomalies, cross-domain unified models, metric evaluation, and contemporary issues. To bridge this gap, this survey offers three key contributions: (1) We provide an updated anomaly categorization and algorithmic taxonomy that takes into account current research advances, outlining approaches from diverse paradigms, comparing them, assessing their developmental tendencies, and providing unique insights. (2) We conducted a thorough examination and analysis of existing evaluation methods, as well as an experiment to examine current measures. Furthermore, our open-source project website contains a large variety of datasets and codebases, including algorithms, metrics, and analytical tools. (3) Through an open debate, we carefully explore the present status of algorithm evaluations and generalizable technologies, providing forward-looking talks on model interpretability, zero-shot learning, multi-modality/multi-domain learning, and foundational models. By summarizing current challenges and future opportunities, this review offers fresh perspectives for TSAD research and development.

framework

The organization of the paper.

Query terms based on taxonomy of paradigm

  • All publications

    intitle:(("time series" OR "temporal" OR "time-series" OR "timeseries") AND ("anomaly" OR outlier))
  • Reconstruction

    intitle:(("time series" OR "temporal" OR "time-series" OR "timeseries") AND ("anomaly" OR outlier)) AND ("reconstruction" OR reconstruct)
  • Forecasting

    intitle:(("time series" OR "temporal" OR "time-series" OR "timeseries") AND ("anomaly" OR outlier)) AND ("forecasting" OR prediction OR predict OR preditictive)
  • Generative

    intitle:(("time series" OR "temporal" OR "time-series" OR "timeseries") AND ("anomaly" OR outlier)) AND ("generative" OR "generative adversarial" OR GAN OR "generation model" OR "diffusion")
  • Similarity-based

    intitle:(("time series" OR "temporal" OR "time-series" OR "timeseries") AND ("anomaly" OR outlier)) AND ("similarity" OR "dissimilarity" OR "contrastive learning" OR "one-class" OR "one class")
  • Tree-based

    intitle:(("time series" OR "temporal" OR "time-series" OR "timeseries") AND ("anomaly" OR outlier)) AND "tree"
  • Statistical model

    intitle:(("time series" OR "temporal" OR "time-series" OR "timeseries") AND ("anomaly" OR outlier)) AND "statistical"
  • LLM-based

    intitle:(("time series" OR "temporal" OR "time-series" OR "timeseries") AND ("anomaly" OR outlier)) AND ("large language model" OR LLM)

Query terms based on algorithm architecture

  • Class #1 (Unified TSAD Model, Exploring LLM-Powerd Model, Preditictive LLM-based Model)

    intitle:(("time series" OR "temporal" OR "time-series" OR "timeseries") AND ("anomaly" OR outlier)) AND ("zero-shot" OR "zero shot" OR "foundational model" OR llm OR "large language model")
  • Class #2 (Diffusion-based Model, Transformer-based Model)

    Before 2017: intitle:(("time series" OR "temporal" OR "time-series" OR "timeseries") AND ("anomaly" OR outlier)) AND ("diffusion model" OR "Transformer model" OR "attention model" OR "attention mechanism" OR "attention module" OR "head attention")

    2017 and after 2017: intitle:(("time series" OR "temporal" OR "time-series" OR "timeseries") AND ("anomaly" OR outlier)) AND ("diffusion model" OR "Transformer model" OR "Transformer" OR "attention model" OR "attention mechanism" OR "attention module" OR "head attention")
  • Class #3 (State Space Model)

    intitle:(("time series" OR "temporal" OR "time-series" OR "timeseries") AND ("anomaly" OR outlier)) AND ("State Space Model" OR "mamba" OR SSM)
  • Class #4 (RNN, GNN, TCN, Prot)

    intitle:(("time series" OR "temporal" OR "time-series" OR "timeseries") AND ("anomaly" OR outlier)) AND (RNN OR GNN OR TCN OR CNN OR prototype OR "memory bank" OR "memory network" OR "Recurrent Neural Network" OR "Graph Neural Network" OR "Temporal Convolution Network" OR "Prototypical Network")
  • Class #5 (Classical Machine learning)

    intitle:(("time series" OR "temporal" OR "time-series" OR "timeseries") AND ("anomaly" OR outlier)) AND "machine learning" -intitle:"deep learning"