Time Series Anomaly Detection

Point/contextual/collective anomalies, CUSUM, STL residuals, LSTM autoencoders, adaptive thresholds

Time series anomaly detection fails in production for one specific reason more than any other: teams apply a threshold to the raw series instead of the residuals of a properly specified seasonal and trend model. An API error rate of 10,000 per minute is normal during peak traffic and anomalous at 3am — but a static threshold treats both identically. The raw series conflates seasonality, trend, and anomaly signal into a single number; a threshold on raw values fires whenever any component is high, including seasonality that's entirely expected. Decompose first, threshold on the residuals, and nearly all seasonality-driven false positives disappear. The quality ceiling for any anomaly detector is the quality of its baseline model — the residuals are only as clean as the decomposition.

Key points

• Applying a static threshold to a seasonal series produces false positives every time the seasonal component peaks — not because anything unusual happened, but because the underlying cycle reached its expected high. Decompose Y_t = T_t + S_t + R_t, then threshold R_t. Point anomaly: |R_t| > k·σ_R where σ_R is an IQR-based robust standard deviation and k=3-4. The decomposition removes expected variation; the threshold detects unexpected deviation. This single change eliminates the majority of seasonality-driven false positives in most production monitoring systems.
• Three anomaly types require different detection strategies. Point anomalies: a single observation far from expected (latency spike, sensor error). Contextual anomalies: a value normal in one context but anomalous in another — 500 sales on a random Tuesday versus 500 sales on Black Friday (should be 50,000). Collective anomalies: a sequence of individually normal observations that are jointly anomalous — 5 days of conversion rate 1% below normal, each individually within tolerance but collectively a significant degradation. Each type requires a different detection approach.
• CUSUM (Cumulative Sum Control Chart): C_t = max(0, C_{t-1} + (Y_t − μ₀ − k)). Alert when C_t > h. Directional — it accumulates evidence of sustained shift rather than reacting to single spikes. This makes CUSUM naturally suited for detecting collective anomalies (sustained shifts) and resistant to false positives from individual noisy observations. Requires specifying μ₀ and k — doesn't adapt to non-stationary baselines or seasonality without preprocessing (decompose first, then apply CUSUM to residuals).
• Isolation Forest for time series requires careful feature engineering. Applied to raw values, it ignores temporal structure entirely — it doesn't know that observation 100 follows observation 99. The correct input is a feature matrix: lag values [Y_{t-1}, Y_{t-2}, ...], rolling mean, rolling std, time-of-day, day-of-week. Without lag features, Isolation Forest is a point anomaly detector with no temporal awareness. It also cannot detect collective anomalies without explicit sliding window features encoding the joint distribution of a sequence.
• LSTM Autoencoders encode a time window and decode it back, using reconstruction error as the anomaly score. Trained on normal data only. High reconstruction error = the window is unusual relative to training distribution. The production problem is threshold calibration: the reconstruction error distribution shifts as the system drifts (concept drift), so a static threshold set at training time produces increasing false positives over time. Use a rolling calibration window — 99th percentile of reconstruction error over the past 7-14 days as the threshold, updated daily.
• Adaptive thresholds are necessary when variance is non-constant, when the series has multiple operating modes, or when you need to directly control the alert rate. Static 3-sigma fails on all three counts. EWMA control charts adapt to recent variance. Quantile regression estimates conditional quantiles as functions of time features (capturing time-varying variance). Conformal prediction provides coverage-guaranteed anomaly scores without distributional assumptions — the alert fires when the score falls in the top α fraction of calibration set scores, guaranteeing at most α false positive rate by construction.
• Root cause vs symptom: a single upstream failure propagates through a dependency graph and produces correlated anomalies across dozens of downstream metrics simultaneously, flooding the alert queue. A DB failure causes API latency, cache miss rate, and error rate to all spike within seconds. Alert flooding without root cause identification means incident responders chase symptoms while the root cause persists. Multi-variate anomaly detection finds correlated joint anomalies; causal graph traversal identifies whether the anomaly originated upstream or is local. Alert correlation groups alerts firing within the same time window into a single incident.
• Evaluation when labels are scarce: PR-AUC (precision-recall) beats ROC-AUC for imbalanced anomaly detection — imbalance is extreme (1 anomaly per 1000 normal observations), so ROC-AUC is dominated by the large number of true negatives. NAB (Numenta Anomaly Benchmark) score rewards early detection within a window before impact — detection two hours late is still valuable, just less so than detection immediately. Precision@k (fraction of top-k flagged events that are true anomalies) is practical when operators review top-ranked alerts. When labels cover only a small subset of a much larger population (50 of 10,000 sensors), evaluation can't stop there: check that the labeled subset is representative of the rest (similar sensor types, deployment conditions, failure modes) before trusting it to generalize; inject synthetic anomalies into the unlabeled sensors to get a proxy precision/recall reading where no real labels exist; monitor alert-rate drift over time as an unsupervised health check — a sudden change in firing rate with no matching real-world event usually means the model or data distribution moved, not that anomalies increased; and route a sample of unlabeled-sensor alerts to human reviewers to estimate live precision directly.

Recap

• #1 production failure: thresholding the raw series instead of decomposition residuals → seasonal false positives.
• Decompose `Y=T+S+R`, threshold R_t (|R|>k·σ, IQR-based, k=3-4) — kills seasonality-driven alerts.
• Three types: point (single spike), contextual (500 sales normal Tue vs Black Friday), collective (sustained drift).
• CUSUM accumulates evidence of sustained shift — good for collective anomalies, resistant to single spikes.
• LSTM autoencoder: reconstruction error as score, trained on normal data; needs rolling threshold recalibration (concept drift).
• Adaptive thresholds (EWMA, quantile regression, conformal) beat static 3-sigma; conformal guarantees ≤α FPR.
• Root cause vs symptom: one upstream failure floods alerts across metrics — trace causal graph, don't chase symptoms.
• Imbalanced eval: PR-AUC beats ROC-AUC; NAB rewards early detection.

Check your understanding