Real-Time Decorrelation-Based Anomaly Detection for Multivariate Time Series

TL;DR

This paper introduces DAD, a real-time decorrelation-based anomaly detection method for multivariate time series that learns correlation structures online, offering high efficiency and robustness for high-dimensional streaming data.

Contribution

The paper presents DAD, a novel online decorrelation learning approach for real-time anomaly detection, with a practical hyperparameter tuning strategy and superior performance on benchmark datasets.

Findings

DAD outperforms state-of-the-art methods across diverse datasets.

DAD maintains high detection accuracy in high-dimensional data streams.

DAD operates efficiently with minimal memory usage.

Abstract

Anomaly detection (AD) plays a vital role across a wide range of real-world domains by identifying data instances that deviate from expected patterns, potentially signaling critical events such as system failures, fraudulent activities, or rare medical conditions. The demand for real-time AD has surged with the rise of the (Industrial) Internet of Things, where massive volumes of multivariate sensor data must be processed instantaneously. Real-time AD requires methods that not only handle high-dimensional streaming data but also operate in a single-pass manner, without the burden of storing historical instances, thereby ensuring minimal memory usage and fast decision-making. We propose DAD, a novel real-time decorrelation-based anomaly detection method for multivariate time series, based on an online decorrelation learning approach. Unlike traditional proximity-based or reconstruction-based detectors that process entire data or windowed instances, DAD dynamically learns and monitors the correlation structure of data sample by sample in a single pass, enabling efficient and effective detection. To support more realistic benchmarking practices, we also introduce a practical hyperparameter tuning strategy tailored for real-time anomaly detection scenarios. Extensive experiments on widely used benchmark datasets demonstrate that DAD achieves the most consistent and superior performance across diverse anomaly types compared to state-of-the-art methods. Crucially, its robustness to increasing dimensionality makes it particularly well-suited for real-time, high-dimensional data streams. Ultimately, DAD not only strikes an optimal balance between detection efficacy and computational efficiency but also sets a new standard for real-time, memory-constrained anomaly detection.