Stacked Residuals of Dynamic Layers for Time Series Anomaly Detection

TL;DR

This paper introduces STRIC, a neural network architecture that combines dynamical systems, convolutional networks, and a novel CUMSUM-based anomaly detector to effectively identify anomalies in multivariate time series without supervision.

Contribution

It presents a new end-to-end differentiable model that automatically adapts to signal time scales and outperforms existing methods in time series anomaly detection.

Findings

STRIC outperforms state-of-the-art methods on multiple benchmarks.

The model automatically adapts to different time scales.

It effectively detects both point anomalies and set-point changes.

Abstract

We present an end-to-end differentiable neural network architecture to perform anomaly detection in multivariate time series by incorporating a Sequential Probability Ratio Test on the prediction residual. The architecture is a cascade of dynamical systems designed to separate linearly predictable components of the signal such as trends and seasonality, from the non-linear ones. The former are modeled by local Linear Dynamic Layers, and their residual is fed to a generic Temporal Convolutional Network that also aggregates global statistics from different time series as context for the local predictions of each one. The last layer implements the anomaly detector, which exploits the temporal structure of the prediction residuals to detect both isolated point anomalies and set-point changes. It is based on a novel application of the classic CUMSUM algorithm, adapted through the use of a variational approximation of f-divergences. The model automatically adapts to the time scales of the observed signals. It approximates a SARIMA model at the get-go, and auto-tunes to the statistics of the signal and its covariates, without the need for supervision, as more data is observed. The resulting system, which we call STRIC, outperforms both state-of-the-art robust statistical methods and deep neural network architectures on multiple anomaly detection benchmarks.