A time series T=⟨s1,…,sC⟩ consists of C observations, with each observation si in RD. If D=1, then T is a univariate time series; if D>1, it represents a multivariate or multidimensional time series.

For a specified time series T=⟨s1,…,sC⟩, we aim to calculate the anomaly score OS(si) for every observation si. Observations with higher anomaly scores are more likely to be classified as anomalies. Anomalies are not specifically categorized as point anomalies or sequence anomalies; rather, a set of consecutive observations is considered a sequence anomaly if they share high anomaly scores.

Traditional anomaly detection methods rely on statistical features, but these approaches are often unsuitable for time series data, leads to the feature information not being correctly represented. With the increase in data dimensionality and volume, deep learning methods have emerged. OC methods can capture complex features that represent “normality.” For instance, methods based on Generative Adversarial Networks (GANs) [16] and autoencoders [17] assume that normal samples can be reconstructed better by the model. Clustering methods, on the other hand, posit that normal samples cluster together as a large group, while outlier data points are classified as anomalies [18]. In contrast, contrastive learning approaches enhance the data by making positive samples closer to each other while causing the negative samples to be far apart from each other [19]. However, these assumptions can often be overly simplistic or effective only for specific types of anomalies. Additionally, another class of deep learning methods, such as Deep SVDD, employs a two-stage OC classifier. This involves feature extraction using a pre-trained encoder model, which is then classified using OC-SVM [12]. Nevertheless, this approach tends to separate the training objective from the downstream task, hindering the effective learning of diverse time series features.

Given a matrix M, Principal Component Analysis (PCA) is capable of discovering a low-rank matrix that serves as an approximation of M. However, as PCA generally employs Singular Value Decomposition (SVD) to determine the low-rank matrix, it exhibits similar sensitivity to outliers as that observed in SVD. To enhance the effectiveness of Principal Component Analysis (PCA) in the presence of outliers, Robust Principal Component Analysis (RPCA) [20] has been introduced. The aim of RPCA is to decompose the matrix M into two components: a low-rank matrix L that represents the underlying clean data and a sparse matrix S that captures the outliers. Specifically, RPCA expresses the original matrix M as follows: (1)M=L+S

In this decomposition, L serves as a low-rank matrix that approximates the clean data within the original matrix M, while S represents a sparse matrix composed of elements identified as outliers, which are not encapsulated by the low-rank matrix L. RPCA accomplishes this decomposition by resolving the optimization problem outlined in the following formula. (2)argminL,Srank(L)+λ‖S‖0s.t.X=L+S

In this context, rank(L) represents the rank of matrix L; ‖S‖0 is the ℓ0 norm of matrix S, which indicates the count of non-zero elements within S; and λ serves as a parameter that adjusts the relative significance of ‖S‖0. Additionally, given that M is expressed as the sum of L and S, the optimization is subject to the constraint M = L + S. To discover a low-rank matrix L that closely approximates the original matrix M and a sparse matrix S capturing the outliers, the loss function is minimized. Although RPCA is efficient in detecting and excluding outliers, it is limited by its lack of support for time series data and its restriction to linear transformations. Time series data, however, frequently involves complex, nonlinear variations that this approach cannot fully address.

In unsupervised learning, training data may already contain anomalies. As the encoder compresses the time series, the hidden representation becomes highly sensitive to these anomalies. This means that the anomalous information in the training data can contaminate the latent representation, causing the model to learn abnormal features. As a result, the model may exhibit low reconstruction errors for anomalous samples, making it difficult to distinguish them from clean samples.

To address this issue, we propose a robust method that ensures the latent representation is not affected by anomalies in the training data. Drawing on the principles of RPCA, our proposed neural network is designed to partition the input data during training into two segments: the clean time series TL and the anomalous component Ts, ensuring that T=TL+Ts. We then input the clean series TL into a deep one-class (OC) method to capture the overall features of the positive samples under multiple hypotheses. The specific approach is illustrated in Fig. 2.

In our proposed deep one-class (OC) method, we combine two assumptions: that normal samples can be better reconstructed and that when mapped to a high-dimensional space, they will form a hypersphere with a smaller radius. This approach allows for a more comprehensive learning of the features of clean samples. The motivation behind this is that under a single assumption, the normality features learned by the model may be one-sided, leading to a situation where certain features of abnormal samples differ from those of normal samples, but those features are not recognized by the model. As a result, specific types of anomalies may go undetected by a model based on a single assumption. The specific objective function is as follows: (3)L=lae(T,T′)+λ1⋅lOC(qi,c)

For a given set of N time series training samples, the objective function consists of two parts: one for learning the features of the time series from the perspective of the autoencoder and the other from the one-class (OC) method. The parameter λ1 controls the weights of these two components. lae(T,T′) represents the reconstruction error of the seq2seq model, defined as follows: (4)lae(T,T′)=‖T−DθAE(EθAE(T))‖22

T′ is the reconstructed time series, defined as DθAE(EθAE(T)). This is primarily calculated by measuring the mean squared error between the original sequence and the reconstructed sequence, ensuring the model’s reconstruction is as close to the original input as possible.

The lOC(qi,c) represents the OC error defined as: (5)loc(qi,c)=‖qi−c‖2

The data point q is obtained by projecting the hidden representations of the training samples from the encoder into a high-dimensional feature space. The distance between q and the center point c is then calculated, with the objective of minimizing the size of the hypersphere centered at c with q as the radius. The center point is determined using a Gaussian mixture model, which can effectively model complex data distributions and handle noise and outliers more effectively. (6)c=∑i=1NG(qi,c)⋅qi∑i=1NG(qi,c)where G(qi,c) is the weight function based on the Gaussian distribution, specifically defined as: (7)G(qi,c)=exp⁡(−‖qi−c‖22σ2)where σ is the standard deviation of the Gaussian distribution, controlling the degree of fuzziness, and in the testing phase, the classification of the time series T as anomalous is based on the calculated anomaly score S. (8)S=lae(T,T′)+λ1⋅loc(qi,c) (9)x={anomaly,S>τnormal,S≤τwhere τ is the predefined classification threshold.

In Principal Component Analysis (PCA), a given matrix M can be approximated by identifying a low-rank matrix. To obtain a low-rank representation, PCA applies Singular Value Decomposition (SVD), which makes it inherently sensitive to outliers. To enhance robustness in the presence of outliers, Robust Principal Component Analysis (RPCA) has been proposed. RPCA aims to break down the original matrix M into two parts: a low-rank matrix L that represents the underlying clean structure of M and a sparse matrix S that contains the elements identified as anomalies.

Inspired by the approach of RPCA, we can separate the anomalous parts from the input time series and focus solely on learning the benign features from the samples. In this context, the clean time series TL encapsulates the trends and periodic patterns present in the time series data, whereas Ts identifies the anomalous characteristics, which largely include random fluctuations that do not conform to established patterns. By eliminating this component’s influence on the hidden representations, we can more accurately learn the information from clean samples and better differentiate them from anomalous samples. The objective function is as follows: (10)arg⁡min‖TL−DθAE(EθAE(TL))‖2+λ1⋅loc(q,c)+λ2⋅‖Ts‖0s.t.T=TL+Ts

EθAE represents the encoder part, while DθAE represents the decoder part. λ2 are parameters used to control the balance between the sparsity of Ts. From our analysis, we observe that λ2 plays a crucial role in separating the anomalous values in the time series. Specifically, when λ2 is small, the objective function encourages more data to be classified as anomalous and separated from the original data. Conversely, when λ2 is large, most of the data is retained, with only a small portion being isolated.

In Eqs. (1) and (9), the loss functions include an l0 norm term to optimize the sparsity of anomalous values while ensuring their semantics. However, the l0 norm is non-convex, making optimization challenging. According to the [21], transforming the l0 norm to the l1 norm can provide a good approximation of the l0 norm. The formula is as follows: (11)arg⁡min‖TL−DθAE(EθAE(TL))‖2+λ1⋅loc(q,c)+λ2⋅‖Ts‖1s.t.T=TL+Ts

The optimization problems of ROC have constraints and thus cannot be solved by gradient descent based back-propagation (BACKPROP). The optimization task may instead be reformulated into two segments and approached using the Alternating Direction Method of Multipliers (ADMM). ADMM fundamentally works by breaking down the main objective into several sub-objectives, enabling the iterative optimization of each sub-objective while holding the remaining ones constant. Upon optimizing a given sub-objective, the method applies constraints to ensure consistency with the overall objective [22]. Furthermore, the Proximal Algorithm [23] is employed to address elements involving the l1 norm.

As shown in Algorithm 1, when optimizing the ROC, the process is as follows: first, optimize the integrated autoencoder part by minimizing L=λ1⋅lae(T,T′)+λ2⋅lOC(qi,c); then minimize ‖Ts‖0; lastly, update TL=T−Ts to maintain the constraint and provide the result as input for the subsequent iteration. The optimization process concludes based on two criteria: first, when T=TL+Ts holds, and second, when both TL and Ts remain constant, indicating that neither Ts nor TL is further changing, signifying that the anomalous values in Ts have stabilized at an optimal state.

In terms of datasets, the AIOps dataset is a collection of 29 sub-datasets designed for detecting anomalies in web services based on business cloud KPIs. It includes 29 KPI time series collected from several large technology companies (such as Alibaba, Sogou, Tencent, Baidu, and eBay). These time series are sampled at 1 or 5-min intervals and divided into training and testing portions.

Another dataset we use the UCR Time Series Anomaly Archive, a recently launched repository containing 250 different time series datasets specifically for time series anomaly detection research. Each dataset contains anomalous events of varying lengths, ranging from 1 to 1700. Furthermore, these datasets cover various fields such as health, industry, and biology, exhibiting different types of anomalies with specific characteristics [24].

We also use the multivariate time series dataset SMAP, which comes from a real-world expert-labeled dataset provided by NASA. Each dataset includes a training set and a testing set, with anomalies labeled in the testing set. It consists of data from 27 entities, each monitored by 55 metrics (variables). In all datasets, both point anomalies and collective anomalies are present, and true anomaly labels are available. Moreover, all methods are trained using time series data that contains anomalies, as the datasets do not provide clean time series without anomalies for training purposes. This configuration enables an investigation into the robustness of various algorithms when confronted with anomalies.

Table 1 provides a systematic comparison of the key characteristics of the three datasets (AIOps, UCR, and SMAP) used in this study. It outlines the configurations of the sliding window parameters (window size and time step), the total number of samples, the data splits across training, validation, and testing sets, as well as the anomaly proportions in the training and testing datasets. Notably, the anomaly proportions vary significantly across datasets, with AIOps containing a small proportion of anomalies in both training and testing sets, UCR having no anomalies in the training set and a low proportion in the testing set, and SMAP featuring no anomalies in the training set but a relatively higher anomaly proportion in the testing set. This highlights the diverse nature of the datasets and their suitability for different anomaly detection tasks.

Regarding baseline methods, we select two shallow machine learning methods, including OC-SVM [25] and Random Cut Forest (RCF) [26]. In deep learning algorithms, we compare our approach with five algorithms, including the deep one-class method SVDD [12], context-based anomaly detection for time series (TS-TCC) [27], and Ensemble Detection Method AOC [28]. Lastly, we chose two variants of the ROC method for ablation experiments: NoOC, which sets λ1 to 0, representing a single hypothesis anomaly detection method; and NoRPCA, which directly uses the raw training data without any processing.

In our experiments, we primarily employed PA, PW, and Affiliation (precision recall and F1-score) [29] as evaluation metrics, as they align well with the unique requirements of time series anomaly detection tasks.

PA measures the ratio of correctly classified points (both normal and anomalous) to the total number of points in the time series, offering a global perspective on the model’s overall performance. Its formula is as follows:PA=Number of Correctly Classified PointsTotal Number of Points

PA is particularly suitable for scenarios where the primary goal is to assess the model’s general classification accuracy across both normal and anomalous data. However, it may have limitations in datasets where normal points significantly outnumber anomalies, as the metric can dilute the model’s anomaly detection performance by emphasizing overall accuracy.

PW on the other hand, is designed to focus specifically on anomaly detection by emphasizing the precision and recall of the model when identifying anomalies. It provides a more refined measure of the model’s effectiveness in distinguishing anomalous data from normal data [30,31]. The formula for PW Precision is:PW Precision=True PositivesTrue Positives+False Negatives

PW is particularly well-suited for time series anomaly detection tasks where the primary focus is on ensuring the accurate identification of anomalous samples. This metric is valuable in applications such as fault detection in industrial systems, where missing an anomaly (false negative) or misclassifying a normal event (false positive) can lead to significant consequences.

The choice of PA and PW as evaluation metrics reflects their ability to complement each other in time series anomaly detection scenarios. PA offers a holistic view of the model’s classification accuracy, while PW ensures the model’s stability and effectiveness in specifically detecting anomalies. This dual perspective allows for a balanced evaluation of the model’s performance in time series tasks, particularly when addressing real-world applications with imbalanced data distributions or critical anomaly detection requirements.

By integrating these metrics, we can better assess the trade-offs between general accuracy and the precision-recall balance in anomaly detection, ensuring the model’s applicability across diverse time series datasets and real-world tasks.

In the ROC framework, we utilize two identical three-layer LSTMs (with a dropout rate of 0.45) as Seq2Seq autoencoders. The Adam optimizer was employed with a learning rate of 3×10−4, weight decay of 5×10−4, β1=0.9, β2=0.99, and ϵ=1×10−8. All methods were implemented using Python 3.9, with PyTorch 1.7 for all neural network-based approaches. Additionally, Sklearn 0.24 was used for OCSVM, while Numpy 1.19 was used for EMA, SSA, and MP. Finally, Statsmodels 0.13 was utilized for STL. All experiments were conducted on a Linux workstation equipped with an Intel 32-core CPU, 256 GB RAM, and a single NVIDIA GeForce RTX 3090 GPU.

In our study, we presented the prediction accuracy of affiliation, along with the corresponding point accuracy (PA) and range prediction (PW) scores. The results indicate that our method performs well across multiple datasets. Although it did not achieve the best results on the UCR dataset, it maintained a strong competitive edge relative to other methods. It is noteworthy that RCF and LSTM exhibited excellent performance on the UCR dataset, but their accuracy significantly declined on the AIOps dataset. This phenomenon can be attributed to the fact that the UCR dataset typically contains only a single anomaly segment and lacks anomalous samples in the training set. In contrast, the AIOps dataset features multiple anomaly segments, and the training set includes some anomalous characteristics, leading to higher false negative rates for methods that lack robustness.

To enhance the robustness of the model, the AOC method employs a soft-boundary strategy, which effectively improves the model’s adaptability to anomalies. In contrast, our approach integrates the RPCA method to successfully filter out a significant portion of anomalous features in the training set. This approach also yielded favorable results on the multivariate time series dataset SMAP, further validating the broad applicability of our method.

As shown in Table 2, in comparisons with various baseline models, we draw the following conclusions: RCF, as a shallow model, demonstrated outstanding performance on the UCR dataset, even surpassing some deep learning models. Meanwhile, two-stage anomaly detection methods, including SVDD and TS-TCC, did not achieve ideal results in time series anomaly detection, revealing the limitations of staged approaches for time series data and thereby constraining the performance of deep models. Additionally, our proposed ROC method performed well across all three datasets, confirming the effectiveness of the ensemble approach and its robustness against contaminated training sets.

On some datasets, although our methods are not the best, they do not fall behind much. The reason why our method does not achieve the best performance on the UCR dataset may lie in the fact that many time series in the UCR dataset exhibit strong contextual dependencies [32,33]. For instance, in motion sensor data, transitions between different actions, or in weather data, long-term trends and seasonal patterns play a significant role. Models like LSTM, which excel at handling strongly time-dependent sequential data, can effectively capture critical patterns through learning temporal transitions between states. This capability allows LSTM to achieve higher accuracy in tasks such as behavior classification and anomaly detection. As a result, methods like LSTM are more suitable for datasets with strong temporal dependencies, such as UCR.

However, for datasets like AIOps, which encompass rich operational data and diverse task scenarios, our method demonstrates superior performance. This is due to its ability to handle large-scale data with highly diverse anomaly samples and to tackle more complex tasks. In such cases, our method significantly outperforms LSTM and other approaches that rely solely on temporal dependencies.

Finally, the results from NoOC and NoRPCA indicate that combining multiple normality assumptions with anomaly filtering models significantly enhances anomaly detection (AD) performance, this further validates the efficacy and importance of the different elements within our model.

In this section, we perform a hyperparameter analysis on the AIOps dataset, with a specific focus on examining two key parameters: λ1 and λ2 in the equations. Fig. 3a illustrates the results of varying λ1 for RPCA, showing that the model performs best when λ1=0.01. We hypothesize that the underlying reason for the observed performance may be that when the score from the one-class method constitutes a larger proportion of the anomaly score and exceeds the threshold value of 0.01, the model’s performance tends to approximate that of shallow methods such as SVM. Fig. 3b demonstrates the impact of λ2 on overall performance, with the model achieving optimal results when λ2=0.5, identifying the best threshold for filtering anomaly features from the training set. The y-axis in the figure represents PA and PW precision metric.

We also conducted detailed experiments to investigate the reasons behind the performance decline associated with varying λ2. As a parameter that adjusts the sparsity in S, λ2 plays a crucial role in our analysis. Specifically, a smaller λ2 encourages a large amount of data to be isolated as noise or anomalies in S, which minimizes the reconstruction error of the autoencoder; however, this can severely distort the original time series, resulting in inadequate anomaly detection due to low anomaly scores. Conversely, a larger λ2 prevents data from being classified as noise or anomalies, leading to increased reconstruction errors. As shown in the Fig. 4, when λ2 is too large, the reconstruction error rises, and since only a few anomalies are isolated, the results resemble those prior to RPCA, thus losing the filtering effect and causing a decline in performance. The y-axis in the figure represents the model’s anomaly scores across different batches.

We employ the gradient descent method as the core optimization algorithm to minimize the objective function. Gradient descent iteratively updates the parameters by computing the gradient of the loss function with respect to the model’s parameters, ensuring a systematic approach to minimizing loss.

In addition, we incorporate a dynamically adjusted learning rate during the optimization process. The dynamic adjustment of the learning rate allows the algorithm to take larger steps when far from the optimal solution to accelerate convergence, while automatically reducing the step size as it approaches the optimal solution. This mechanism helps to avoid overshooting the minimum and improves stability near the global optimum. More importantly, the dynamically adjusted learning rate mitigates the risk of the algorithm getting trapped in local minima, a common issue in non-convex optimization problems.

By comparing the effects of dynamic and fixed learning rates, Fig. 5 provides a visual representation of how the convergence behavior differs under different learning rate strategies. The dynamic learning rate strategy demonstrates faster convergence and better adaptability to the optimization landscape, particularly in complex scenarios.

In addition, we visualized the actual convergence process of the model, demonstrating the step-by-step reduction in the loss function values during optimization. Fig. 6 not only provides an intuitive comparison between the performance of dynamic learning rate adjustment and fixed learning rate strategies but also strongly supports the effectiveness of the dynamic learning rate. Specifically, the dynamic learning rate facilitates a faster reduction in loss values and exhibits greater stability as it approaches the global optimum. This indicates that the dynamic learning rate has significant advantages in optimizing non-convex problems and handling complex objective functions. Furthermore, it validates the applicability of this approach in addressing challenging tasks.