[Paper Review] RobustTAD: Robust Time Series Anomaly Detection via Decomposition and Convolutional Neural Networks

Jingkun Gao, Xiaomin Song+4 more|arXiv (Cornell University)|Feb 21, 2020

Anomaly Detection Techniques and ApplicationsComputer Science49 references86 citations

TL;DR

RobustTAD combines robust time series decomposition with a U-Net–based encoder-decoder network to detect point-wise anomalies, aided by data augmentation and weight-adjusted loss, and achieves state-of-the-art results on Yahoo benchmarks.

ABSTRACT

The monitoring and management of numerous and diverse time series data at Alibaba Group calls for an effective and scalable time series anomaly detection service. In this paper, we propose RobustTAD, a Robust Time series Anomaly Detection framework by integrating robust seasonal-trend decomposition and convolutional neural network for time series data. The seasonal-trend decomposition can effectively handle complicated patterns in time series, and meanwhile significantly simplifies the architecture of the neural network, which is an encoder-decoder architecture with skip connections. This architecture can effectively capture the multi-scale information from time series, which is very useful in anomaly detection. Due to the limited labeled data in time series anomaly detection, we systematically investigate data augmentation methods in both time and frequency domains. We also introduce label-based weight and value-based weight in the loss function by utilizing the unbalanced nature of the time series anomaly detection problem. Compared with the widely used forecasting-based anomaly detection algorithms, decomposition-based algorithms, traditional statistical algorithms, as well as recent neural network based algorithms, RobustTAD performs significantly better on public benchmark datasets. It is deployed as a public online service and widely adopted in different business scenarios at Alibaba Group.

Motivation & Objective

• Motivate scalable, real-time anomaly detection for diverse time series in large-scale industrial settings.
• Leverage robust decomposition to separate trend/seasonality from anomalies and simplify neural network design.
• Investigate data augmentation in time and frequency domains to compensate for scarce labeled anomalies.
• Introduce label-based and value-based weighting in the loss to address class imbalance.
• Demonstrate a practical online deployment and superior performance against baselines on public datasets.

Proposed method

• Decompose time series into trend, seasonality, and remainder using RobustPeriod and RobustSTL or RobustTrend depending on periodicity.
• Use a U-Net–style encoder-decoder network with skip connections to predict a dense anomaly map from the remainder component.
• Apply weight-adjusted loss to address class imbalance and leverage neighborhood differences for value-based weighting.
• Develop time-domain and frequency-domain data augmentation techniques to enlarge training data.
• Implement online inference with online decomposition and fast neural network prediction for streaming data.
• Provide an end-to-end system architecture including data ingestion, offline training, online service, and visualization.

Experimental results

Research questions

• RQ1 Does combining robust time series decomposition with a CNN improve anomaly detection performance across diverse time series?
• RQ2 How do data augmentation and weighted losses affect learning under label scarcity and class imbalance?
• RQ3 Can online decomposition and inference meet real-time requirements in a production setting?
• RQ4 What is the impact of using decomposed remainder input versus raw time series for CNN-based anomaly detection?

Key findings

• The proposed RobustTAD framework yields higher F1 scores than forecasting-based, decomposition-based, and raw CNN baselines on Yahoo benchmarks.
• Decomposition + U-Net with weight-adjusted loss and data augmentation significantly boosts performance, achieving F1 = 0.693 and Relax F1 = 0.812 (U-Net-DeWA).
• A naive U-Net on raw data performs poorly (F1 0.403), but decomposition plus adjustments yields substantial gains (≈0.22–0.29 in F1).
• Online inference is efficient: under streaming deployment, anomaly labeling costs are low (less than 10 ms per point for prediction; ~100 ms for online decomposition).
• The approach is deployed as a public online service at Alibaba and widely used in production, outperforming several competitive methods on public benchmarks.