面向多元时间序列异常检测的基于用户反馈的动态阈值方法

User Feedback-based Dynamic Threshold Method for Multivariate Time Series Anomaly Detection

摘要

时间序列异常检测在金融风控、航天监测等关键领域具有重要应用价值.但是在许多实际应用中,时间序列异常检测依然是一个棘手的问题,这主要是由于数据量庞大、数据模式复杂以及计算资源有限等因素的制约.在动态阈值设置中主要分为峰值超过阈值和非参数动态阈值方法.现有方法通常基于稳态分布假设,对非平稳数据漂移的适应性不足.同时,缺乏有效的用户反馈机制,难以利用专家知识优化阈值决策.本文提出一种基于用户反馈的多元时间序列非参数动态阈值方法,该方法通过异常段聚类、融合主动学习和贝叶斯阈值优化实现自适应优化.本文在SMAP、MSL、SMD 3个基准数据集上的实验表明,所提方法F1分数较当前最优自动阈值方法提升0.6%~2.4%.

Abstract

Time series anomaly detection is vital in domains such as financial risk control and aerospace monitoring.Yet,it remains challenging in many real-world settings due to massive data volumes,complex temporal patterns,and constrained computational resources.Dynamic thresholding methods are typically categorized into peak-over-threshold approaches and nonparametric dynamic thresholding.Existing techniques often rely on steady-state distribution assumptions and thus adapt poorly to nonstationary data drift.Moreover,the lack of effective user-feedback mechanisms hinders the incorporation of expert knowledge into threshold decisions.This paper proposes a user-feedback-driven nonparametric dynamic thresholding method for multivariate time series.The approach achieves adaptive optimization by clustering anomalous segments and integrating active learning with Bayesian threshold optimization.Experiments on three benchmark datasets—SMAP,MSL,and SMD—demonstrate that our method improves F1 scores by 0.6%~2.4% over state-of-the-art automatic thresholding baselines.

关键词

异常检测 / 多元时间序列 / 自适应阈值 / 主动学习

Key words

anomaly detection / multivariate time series / adaptive threshold / active learning

[1] Zhang Yongshan,Jiang Zhiyun,Peng Cong,et al.Management analysis method of multivariate time series anomaly detection in financial risk assessment[J].Journal of Organizational and End User Computing,2024,36(1):1-19.
[2] Rashid Nadia,Mehmood Rashid,Alqurashi Fahad,et al.ASAD:a meta learning-based auto-selective approach and tool for anomaly detection[J].IEEE Access,2025:134341-4367,doi:10.1109/ACCESS.2024.3524908.
[3] Darban Z Z,GI Webb,Pan S,et al.Deep learning for time series anomaly detection:a survey[J].ACM Computing Surveys,2025,57(1):1-42,doi:10.1145/3691338.
[4] Xu Zhaoping,Cheng Zhijun,Guo Bo.A multivariate anomaly detector for satellite telemetry data usingtemporal attention-based LSTM autoencoder[J].IEEE Transactions on Instrumentation and Measurement,2023,72(1):1-13,doi:10.1109/TIM.2023.3296125.
[5] Zeng Zefan,Jin Guang,Xu Chi,et al.Satellite telemetry data anomaly detection using causal network and feature-attention-based LSTM[J].IEEE Transactions on Instrumentation and Measurement,2022,71(1):1-21,doi:10.1109/TIM.2022.3151930.
[6] Goumidi Hadjer,Pierre Samuel.Real-time anomaly detection in IoMT networks using stacking model and a healthcare-specific dataset[J].IEEE ACCESS,2025,13:70352-70365,doi:10.1109/ACCESS.2025.3563158.
[7] Zachos Georgios,Mantas Georgios,Porfyrakis Kyriakos,et al.Implementing anomaly-based intrusion detection for resource-constrained devices in iomt networks[J].Sensors,2025,25(4):1216,doi:10.3390/s25041216.
[8] Listou Ellefsen,Andre Han,Peihua Cheng,et al.Online fault detection in autonomous ferries:using fault-type independent spectral anomaly detection[J].IEEE Transactions on Instrumentation and Measurement,2020,69(10):8216-8225.
[9] Nassif Ali Bou,Talib Manar Abu,Nasir Qassim,et al.Machine learning for anomaly detection:a systematic review[J].IEEE Access,2021,9:78658-78700,doi:10.1109/ACCESS.2021.3083060.
[10] Siffer A,Fouque P A,Termier A,et al.Anomaly detection in streams with extreme value theory[C]//Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining,2017:1067-1075.
[11] Lundstrom Adam,O′Nils Mattias,Qureshi Faisal Z.An interactive threshold-setting procedure for improved multivariate anomaly detection in time series[J].IEEE Access,2023,11:93898-93907,doi:10.1109/ACCESS.2023.3310653.
[12] Lin Chunming,Du Bowen,Sun Leilei,et al.Hierarchical context representation and self-adaptive thresholding for multivariate anomaly detection[J].IEEE Transactions on Knowledge and Data Engineering,2024,36(7):3139-3150.
[13] Hundman K,Constantinou V,Laporte C,et al.Detecting spacecraft anomalies using LSTMs and nonparametric dynamic thresholding[C]//24th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining,2018:387-395.
[14] Cynthia Freeman,Jonathan Merriman,Ian Beaver,et al.Experimental comparison and survey of twelve time series anomaly detection algorithms[J].Journal of Artificial Intelligence Research,2022,72:849-899,doi:10.1613/jair.1.12698.
[15] Wetzig R,Gulenko A,Schmidt F.Unsupervised anomaly alerting for iot-gateway monitoring using adaptive thresholds and half-space trees[C]//6th International Conference on Internet of Things:Systems,Management and Security,IEEE,2019:161-168.
[16] Nixon Christopher,Sedky Mohamed,Champion Justin,et al.SALAD:a split active learning based unsupervised network data stream anomaly detection method using autoencoders[J].Expert Systems with Applications,2024,248:123439,doi:10.1016/j.eswa.2024.123439.
[17] Lee M C,Lin J C,Gan E G.ReRe:a lightweight real-time ready-to-go anomaly detection approach for time series[C]//IEEE 44th Annual Computers,Software,and Applications Conference,2020:322-327,doi:10.1109/COMPSAC48688.2020.0-226.
[18] Lochner M,Bassett B A.Astronomaly:personalised active anomaly detection in astronomical data[J].Astronomy and Computing,2021,36:100481,doi:10.1016/j.ascom.2021.100481.
[19] Marcelli Elisa,Barbariol Tommaso,Sartor Davide,et al.Active learning-based isolation forest(ALIF):enhancing anomaly detection with expert feedback[J].Information Sciences,2024,doi:10.1016/j.ins.2024.121012.
[20] Kopljar Damir,Drvar Vjekoslav,Babic Jurica,et al.xAAD-post-feedback explainability for active anomaly discovery[J].IEEE ACCESS,2024,12:181914-181924,doi:10.1109/ACCESS.2024.3510233.
[21] Lin Chunming,Du Bowen,Sun Leilei,et al.Hierarchical context representation and self-adaptive thresholding for multivariate anomaly detection[J].IEEE Transactions on Knowledge and Data Engineering,2024,36(7):3139-3150,doi:10.1109/TKDE.2024.3360640.
[22] Li J,Di S,Shen Y,et al.FluxEV:a fast and effective unsupervised framework for time-series anomaly detection[C]//Proceedings of the 14th ACM International Conference on Web Search and Data Mining,2021:824-832.
[23] Su Y,Zhao Y,Niu C,et al.Robust anomaly detection for multivariate time series through stochastic recurrent neural network[C]//Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining,2019:2828-2837,doi:10.1145/3292500.3330672.
[24] Zhao H,Wang Y,Duan J,et al.Multivariate time-series anomaly detection via graph attention network[C]//IEEE International Conference on Data Mining,2020:841-850.
[25] Bubeck S.Convex optimization:algorithms and complexity[J].Foundations and Trends in Machine Learning,2015,8(3-4):231-357,doi:10.1561/2200000050.
[26] Wang W,Chen P,Xu Y,et al.Active-MTSAD:multivariate time series anomaly detection with active learning[C]//52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks,2022:263-274,doi:10.1109/DSN53405.2022.00036.
[27] Hu Shengdan,Miao Duoqian,Pedrycz Witold.Multi granularity based label propagation with active learning for semi-supervised classification[J].Expert Systems with Applications,2022,192:116276,doi:10.1016/j.eswa.2021.116276.
[28] Wang Y,Chen H,Heng Q,et al.Freematch:self-adaptive thresholding for semi-supervised learning[C]//11th International Conference on Learning Representations,2023,doi:10.48550/arXiv.2205.07246.
[29] Nakano M,Takahashi A,Takahashi S.Generalized exponential moving average (EMA) model with particle filtering and anomaly detection[J].Expert Systems with Applications,2017,73:187-200,doi:10.1016/j.eswa.2016.12.034.
[30] Injadat M N,Salo F,Nassif A B,et al.Bayesian optimization with machine learning algorithms towards anomaly detection[C]//IEEE Global Communications Conference,2018:1-6,doi:10.1109/GLOCOM.2018.8647714.
[31] Liu F T,Ting K M,Zhou Z H.Isolation forest[C]//8th IEEE International Conference on Data Mining,2008:413-422.
[32] Xu H,Chen W,Zhao N,et al.Unsupervised anomaly detection via variational auto-encoder for seasonal kpis in web applications[C]//Proceedings of the World Wide Web Conference,2018:187-196,doi:10.1145/3178876.3185996.
[33] Kim S,Choi K,Choi H S,et al.Towards a rigorous evaluation of time-series anomaly detection[C]//Proceedings of the AAAI Conference on Artificial Intelligence,2022:7194-7201.
[34] Ren H,Xu B,Wang Y,et al.Time-series anomaly detection service at microsoft[C]//Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining,2019:3009-3017.

基金资助

上海市科委创新计划项目(22DZ1100103)资助.