A Graph-based Framework for Online Time Series Anomaly Detection Using Model Ensemble

TL;DR

This paper introduces GDME, a graph-based ensemble framework for online time series anomaly detection that adapts to evolving data and outperforms existing methods.

Contribution

It presents a novel unsupervised ensemble approach using dynamic graphs and community detection for effective online anomaly detection in streaming data.

Findings

GDME outperforms existing online anomaly detection methods by up to 24%.

The ensemble strategy improves detection performance over individual models.

GDME maintains computational efficiency while adapting to concept drift.

Abstract

With the increasing volume of streaming data in industrial systems, online anomaly detection has become a critical task. The diverse and rapidly evolving data patterns pose significant challenges for online anomaly detection. Many existing anomaly detection methods are designed for offline settings or have difficulty in handling heterogeneous streaming data effectively. This paper proposes GDME, an unsupervised graph-based framework for online time series anomaly detection using model ensemble. GDME maintains a dynamic model pool that is continuously updated by pruning underperforming models and introducing new ones. It utilizes a dynamic graph structure to represent relationships among models and employs community detection on the graph to select an appropriate subset for ensemble. The graph structure is also used to detect concept drift by monitoring structural changes, allowing the framework to adapt to evolving streaming data. Experiments on seven heterogeneous time series demonstrate that GDME outperforms existing online anomaly detection methods, achieving improvements of up to 24%. In addition, its ensemble strategy provides superior detection performance compared with both individual models and average ensembles, with competitive computational efficiency.