Learn hybrid prototypes for multivariate time series anomaly detection
Authors: Chun-Guo Li
Venue: ICLR 2025 Poster (2025)
Keywords: prototypes;time series;anomaly detection
Primary area: unsupervised, self-supervised, semi-supervised, and supervised representation learning
TL;DR: This paper propose a hybrid prototypes learning model for MTSAD based on reconstruction to fight against over-generalization.

Abstract: In multivariate time series anomaly detection (MTSAD), reconstruction-based models reconstruct testing series with learned knowledge of only normal series and identify anomalies with higher reconstruction errors. In practice, over-generalization often occurs with unexpectedly well reconstruction of anomalies. Although memory banks are employed by reconstruction-based models to fight against over-generalization, these models are only efficient to detect point anomalies since they learn normal prototypes from time points, leaving interval anomalies and periodical anomalies to be discovered. To settle this problem, this paper propose a hybrid prototypes learning model for MTSAD based on reconstruction, named as H-PAD. First, normal prototypes are learned from different sizes of the patches for time series to discover interval anomalies. These prototypes in different sizes are integrated together to reconstruct query series so that any anomalies would be smoothed off and high reconstruction errors are produced. Furthermore, period prototypes are learned to discover periodical anomalies. One period prototype is memorized for one variable of the query series. Finally, extensive experiments on five benchmark datasets show the effectiveness of H-PAD.

Published as a conference paper ICLR 2025
LEARN HYBRID PROTOTYPES FOR MULTIVARIATE TIME SE- RIES ANOMALY DETECTION
Ke- Yu-Y Shen
Hebei Key Laboratory of Machine Learning and Computational Intelligence College of Mathematics and Information Science Hebei University Beodding.eebiiChhing China www.euuuuu..c.oooooooooo 1 i og Bogghbu.. edu. cn
ABSTRACT
In multivariate time series anomaly detection (MTSAD), reconstruction-basee models re- construct testing series with learned knowledge of only normal series and identify anoma- lies with higher reconstruction errors. In practice, over-generalization often occurs with unexpectedly well reconstruction of anomalies. Although memory banks are employed by reconstruction-basee models to fight against generalizzation, these models are only efficient to detect point anomalies since they learn normal prototypes from time points, leaving interval anomalies and periodical anomalies to be discovered. To settle this prob- lem, this paper propose a hybrid prototypes learning model for MTSAD based on recon- struction, named as H-PAD. First, normal prototypes are learned from different sizes of the patches for time series to discover interval anomalies. These prototypes different sizes are integrated together to reconstruct query series so that any anomalies would be smoothed off and high reconstruction errors are produced. Furthermore, period proto- types learned discover periodical anomalies. One period prototype memorized for one variable of the query series. Finally, extensive experiments on five benchmark datasets show the effectiveness of H-PAD.
INTRODUCTION
Anomaly detection in multivariate time series is common but important issue in many fields such equip- ment monitoring, healthcare systems and aerospace engineering. Since labeling is time-consuming and labor-intensive, multivariate time series anomaly detection (MTSAD) is regarded as an unsupervised learn- ing task(Eldcle) atl (02I). Generally speaking. MTSAD learns knowledge directly from a set of normal data, and detects anomalies with learned normal knowledge.
The most popular MTSAD methods are developed based on reconstruction of time series. In the training phase, a set of time series of only normal points are featured latent space by an encoder. Following with a decoder, the training set of time series are expected to reconstructed with least losses. In the inference phase, the trained encoder and decoder try to reconstruct a new time series and anomaly points would be discov- ered. However, the best reconstruction of training time series raises the problem of over-generalization for testing time series, shown as in Figure [[a]. That is, not only normal points time series are reconstructed excellently, but abnormal points are also reconstructed very well. As result, abnormal points not be discovered because they can not be identified with high reconstruction errors no longer. To fight against weer-generalization, MEMTO employs memory bank of normal point prototypes to help reconstruct time series (Song et all, 2022)). However, local information should be seriously considered for learning time series since each point is closely related with its neighbours. Moreover, the absence of periodicity in MTSAD lead

---

Published as conference paper ICLR 2025
(a) Points and interval anomalics
(b) Period anomaly
Figure 1: Illustrations of weer-generalization The top time series is the time series including anomalies (highlighted pink). The middle time series is its reconstructed series due to over-generalization that anomalies are reconstructed as well as normal ones, After all, the time series is expected to be reconstructed as the bottom series, immune to anomaly influence.
to the fact that is difficult to identify long-term anomalies (e.g. period anomalies in Figure [[b] only with point prototypes. For detailed description, see appendix A
This paper proposes an MTSAD model based on learning hybrid prototypes (H-PAD) which consist of patch prototypes in different scales and periodical prototypes (as shown in Figure D). First of all, H-PAD is de- signed to learn memory prototypes of the patches in different scales, instead of prototypes of the time points. With patches prototypes, local information in time series taken into consideration for future reconstruc- tion, which enables the model to identify interval anomalies. And occasional point anomalies can not be reconstructed well with their local information, further preventing the occurrence of over-generalizzttin. Moreover, taking periodicity of time series into account, H-PAD also learns and memorizes period proto- types for time series in multiple variables, one period prototype for one variable. It enables the model identify long-term anomalies because period prototypes can help to reconstruct the testing time series as a normal series which deviates greatly from input series. Experimental results on five benchmarks illustrate the effectiveness of H-PAD.
The contributions of this paper are as follows:
We propose novel framework to learn hybrid prototypes for multivariate time series anomaly detection. Patch prototypes involves local information and period prototypes contains global infor- mation. The combination the patch and period prototypes can well discover point anomalies and interval anomalies well period anomalies.
The model comprehensively considers local information and global information, patches learn local features, and uses periods to learn global information. The learned local features and period features are helpful for learning hybrid prototypes.
By comprehensively considering the differences between different patch prototypes and time points, and the differences between period prototypes and period, and constructing anomaly scores based on the distance between the original features and the nearest prototype in the feature space, anomalies in the test data can be identified more accurately.
2

---

Published as conference paper ICLR 2025
X
R LxC
Docoder
Docoder
concat
concat
reconstruction
Pertod querry update module
Update Prototype
Mult scalle querry update module
Update Prototype
Encoder
Encoder
Q2
X XI
Blockom
A P
Blockxk
Pooling
Penod Division
X E RR LaC
Figure 2: The overall architecture of the H-PAD model.
2
RELATED WORKS
Early anomaly detection methods are generally some classical machine learning methods. Machine learn- ing methods include classficattoon-asee,, density-based and clustering- based methods. Classification-bar methods such as decision trees ell 2008), support vector machines, one-class SVM (Schölkopt et al, 2001) and support vector data description (1ax & Duin, 2044 were widely used the field of anomaly detection in the early days. Density- bease methods such as local outlier factor (Breunig all 2000) and connectivity outlier factor (Tang et al,, 2002) calculate local density and local connectivity respectively determine outliers. In recent years, methods combining density estimation with deep learning, such as DAGMM (Zong et alj, 2018) and MPPCACD (Yam et all 2017), have also been proposed. Common clus- tering methods include k-means (Kant Mahajan, 2019) THOC (Shen all 2020), and ITAD (Shm al 2020).
Deep learning methods have become the mainstream method for anomaly detection because they can cap- ture complex nonlinear relationships and time dependencies in time series data. The most commonly used method is reconstruction-bee based. Early methods include LSTM baseed encoder-decoder models and LSTM- VAE models (Park et all, 2018). Later, OmniAnomal (Su all, 2019) and InterFusion (Li eall 202 further extended the LSTM VAE model. With the deepening of research on reconstruction models, recon- struction models combined with generative models have also been applied time series anomaly detection, such as BeatGAN (Zhou et aD. 2019), a variant of generative adversarial networks. In recent years, Anomaly Transformer (Xu all 2022) has introduced the correlation difference between normal points and abnormal points to improve the effect of anomaly detection. Dedetector (Yang et al,, 2023) uses patch learning of local information and permutation- invarrinn representation based Anomaly Transformer to improve detection
3

---

Published as a conference paper ICLR 2025
accuracy. D3R (Wang al, 20233 addresses drift in time series by dynamically decomposing with data-time mix-attention and externally controlling the reconstruction bottleneck via noise diffusion. DMamba (Chen etlll (0224) proposes selective state space model with multi-stage detrending mechanism to enhance long-range dependency modeling and generalization in non-stationary Time Series Anomaly Detection. In addition, to capture the correlation between variables, graph structures are also used in time series anomaly results.
detection, GSC_MAD (Zhang et al, 2022)) uses graph structures for anomaly detection and achieves good
Memory networks were initially applied in natural language processing (Weston et all 2014), leveraging reasoning components and long-term memory components to perform inference and learn how to utilize them jointly. The long-term memory is designed to support read and write operations, enabling it to be used for prediction tasks. In the context of question answering (QA), these models were explored where the long-term memory effectively serves (dynamic) knowledge base, with the output being a textual re- sponse. Later, an improved version of memory networks was proposed (Sukhbaatar et all 2015), employing end-to-end training and utilizing a recurrent attention model retrieve memory items. Recently mem- ory networks have emerged as powerful tool in various fields, particularly in computer vision Park et all (2020). For anomaly detection, MemAE Gong et all (2019) is pioneering in integrating memory networks into an autoencoder framework. Despite its innovativeness. MemAE's performance is limited by the lack of a dedicated mechanism for updating memory prototypes. To overcome this shortcoming, MNAD Park et all (02))) proposes to update memory prototypes by storing multiple patterns of normal behaviors within the memory framework. While this method marked an improvement over MemAE, still faces challenges that it is difficult to embrace new information since the memory prototypes updated with
of related queries of fixed weights. As for application in MTSAD, MEMTO Song et all (2022) provides solution address this issue. A gating unit is taken by MEMTO regulate the amount of new information for prototypes updating during the learning procedure from normal time series.
3 PROPOSED METHOD
To begin with, the original time series is divided into multiple subsequences of the same length,
X = (X,, X2, X Each subsequence X E X is taken as one time series for training. Let X {x1,x2, , where L is the length of the series and x; E RCC an observation vector at time t. MT- SAD aims at learning knowledge from normal time series and generating labels Yeest- {y11 U2. Vz. } for unseen series Xtest E RL1XC where V/ E {0, 1), 0 for normal and for abnormal. For reconstruction- based model, anomaly scores are given by 8 = ||x, 8ell2 where &, is the reconstructed observation of x, with learning knowledge and |1-112 is L2-norm. Finally, anomaly labels are determined by the anomaly threshold 6. if s 2 öthen Yt 1, otherwise y1 O.
3.1 LEARNING NORMAL PATCH PROTOTYPES
To learn different scales of temporal information, H-PAD features different sizes of prototypes from different sizes of patches from normal times series. Different scales of local information contained into different sizes of prototypes and different views of normal features are embedded into patch prototypes.
Average Pooling. Given X LxC it is divided into several patches of size (1,2, .m) without overlapping. All x, in the same patch is averaged according to equation MI
where to = -2- 1).2+ +1. 11 Thus a new series is generated to be X = [xf,x3.... .x where L = [
Specifically, X for = 1 is the original time series X which remains the original information after passing
4

---

Published as conference paper ICLR 2025
quayy ugsken vedortatootoooooooooooommm
parto abantion
puolocy updiae
(b)
Figure 3: (a) Updating normal patch prototypes. (b) Query reconstruction with normal patch prototypes. (c) Updating period prototypes.
through the pooling layer with a pooling kernel size of 1, With average pooling, different X involve different width local information in order learn temporal dependencies within different durations.
Update Patch Prototypes To learn prototypes feature space, the generated series X are embedded into the feature space of higher dimension according to the Transformer Encoder
Q x Encoder (X*)
(2)
where Q = qqq . q.. } E RRD (D> C), which is used to learn patch prototypes in different scales. The detailed information about the Transformer Encoder can be found in Appendix B.
Initializing randomly, patch prototypes B = -bb b bis} E RMXD are updated with an update gate & based on the query series Q (Figure 5(a)). First of all, the similarity matrix V prototypes B and the query series Q* can be derived by
(v MxL.
patch
exp ((b) 93)
(3)
L, exp (bb q /T)
where 7 is the temperature parameter. It should be noted that patch prototypes should not only include new information, but also reserve history information. Therefore, the update gate Song al. (2024) employed to update by by
-1n bb + v
q
(4)
where takes clement-by-element multiplication,
L U
s = U + U
qi
(5)
and is the sigmoid activation function. UJ and U. are learnable matrices which are initialized randomly to adjust the degree preservation and removal of the history prototypes and new information.
Query Reconstruction. Within the scope of reconstruction, patch prototypes are expected to well recon- struct the query series. In each scale z, the updated patch prototypes B are taken to reconstruct the query series Q to be Q = {qi 9
oF. according to
M
exp (<9 by) /T) ΣM exp ((9j. b;) /T)
qj =
w. bk.
where w
(6)
5

---

Published as conference paper ICLR 2025
is the attention weight of the query qj for the patch prototype b. W
(wis&
Different scales of reconstructed queries Q Q
Q should be integrated properly to reconstruct Q in consideration of different length of temporal dependencies. Recalling the strategy of average pooling, local information of q: is included into 4: #j where (4₃ 1) 2j + S t S tj 22 1, ... m). In other words, in the scale of 2j. Ir contains the normal information of qt- Naturally, 9., ( 1,2, ... m) is
taken into account to reconstruct qe (as illustrated in Figure B(b)). All related qi is integrated with network reconstruct qu:
q Linear (ReTU (Linear (á))
Finally, Q = (q1. q .q)) is concatenated with Q and decoded into original space RCas as the recon- structed series X of X by normal patch prototypes.
3.2 LEARNING PERIOD PROTOTYPES
Most time series in the real world are multi-periodic, and these periods influence each other, presenting the overall variation tendency of the time series at (2023). In addition to normal patch prototypes, period prototypes of the normal time series are learned to model characteristics of the different periodic patterns (the right branch of the H-PAD framework in Figure 2))
Period Division. Technically, period division of the time series relies on the frequency information of the series in frequency domain. To this end, the time series X E RLCC' is transformed into the frequency domain by Fast Fourier Transform (FFT) Wu et all (2023) get the averaged amplitude values by
A Aug (Amp (FFT(X))).
Considering the sparsity of frequency domain, only the top-k amplitudes are selected to get P (p1.22.... .PK) fo for period partition where
L fz
(21,2,,... = =rgg=rggoppK/4
=
(i = 1,2, .., K)
and f2.. fx is the most significant frequencies Zhou at (2022). With p P, the time series X can be divided get N = I. segments (zero-padding at the end). As each observation variable has its own spe- cial changing period, the period prototype expected learn along each variable. Therefore, one univariate time series Xy E RR taken from X E I fxxx is divided into N segments of length p and is reshaped to X E IR N Then, the time series X E RAxC' is reorganized to be X (X,, X2, X Nxxx
for learning period prototypes.
Through Transformer Encoder, XP is embedded to obtain Q" (see Appendix B.) For one observing variable of the time series, one period prototype b" R. is learned from one period partition Q" { a.. ..., 4 where Q" E Q" (shown as in Figure Bic)). With randomly initialized b", the period prototype is updated with weighted segmented periods by
Update Period Prototypes.
N
b²= = (1 +) + Σ
of
(8)
1=1
where
N 3 = a UpB + U ce
exp (bP,a") /T)
Σ
09
(9)
N
exp ((b", ((b"..)) /T)
1=1
6

---

Published as a conference paper ICLR 2025
where Uf and U2 are also learnable matrices just like in Eq.Et Finally, a set of period prototypes for C variables are gained, B = , b for query reconstruction.
Query Reconstruction. Considering the variable correlations, each query vector q E Q" can be recovered to be qf with the updated period prototypes B" according to
w = exp ((d.bb)) /T)
by.
where
(10)
En exp (qP by) /T)
The reconstructed period partition QP = {h. L. ... Iv } are concatenated with QP = { L 4 produce Q" [qp of O' variables, O" o Øg 0% is used to reconstruct X X with decoder, where X is the reconstructed data obtained in the i-th period. The reconstructed data of the final period branch X, = - 8
L2 IN where of = (q. 4.) ReD. Collecting all reconstructed partitions
After finishing reconstruction with patch and period prototypes respectively, X is finally reconstructed by the weighted summation of X and X,, X =7x, (1 1 -- Xp, where a hyperparameter.
3.3 LOSS FUNCTION AND ANOMALY SCORES
Generally, the reconstruction loss is surely one component of the loss function for training phase, formulated
Liee
X X
(11)
where ||-||p- is the Frobenius norm. Besides, too many prototypes for reconstruction may over-interprete normal information in the training time series. To make sure that the most related prototypes presented reconstructing. the sparsity constraints on reconstruction weights are required to reduce the likelihood of wverggeneralization problem. In this paper, the entropy loss is taken as the sparsity constraint on reconstruc- tion weights Song et al, (2024):
L
M
Lient
wj. log (wz))
(12)
Note that the sparsity is not required for period reconstruction since all period prototypes are needed for reconstruction. Specially for period prototypes, they must appropriately characterize the periodicities of the training time series as much as possible. Therefore, the period loss in feature space is designed based on the distance between the period prototype by and the query vector Ly:
K C
N
Lyrd
b
Pmn
P
Pmn l12
(13)
m=1
where Hf is the j-th query of the i-th variable with period in feature space RRD. To sum up, the total loss function is weighted combination of Eq. (I), Eq. and (I)
LOSS ai Lrec + ag + azLLpd
(14)
where a1, 022 and Or are adaptive parameters of different loss parts.
To detecting anomalies, the protuberant deviations in both input space and feature space designed into anomalies scores. In the input space, the reconstruction error is generally considered to be anomalies scores:
st ||*; x,l12-
(15)
7

---

Published as conference paper ICLR 2025
the feature space, for patch reconstruction X;, the distance between the corresponding query q and the query's s nearest prototype b in the scale 2j is considered to be included into the anomaly score of x,: (16)
m
$2 st(+)
qt
25 sim
ll2
where q: Encoder(x:). The larger the scale 2j. the more different the patch prototype of scale 2j from the original query. An inverse proportional parameter 2; of the patch prototypes on the score 82 (t). For period reconstruction of X,, the anomaly score of x, is related with the period where it locates:
is employed to adapt the influence of different scale
Encoder (0 (Ot)())) b.*
sp(1)
(17)
where p(t) and O <p(() PR is the p(t)-th period of length ps along the i-th variable. b.th is the period prototype of length pıc in i-th variable. Thus the distance of the p(t)-th encoded period with the learned period prototype [
Ph
Considering that both scores in feature space affects the reconstruction enror, they are integrated into
s(t) softmar (t) + Btp(t)) x (t)
(18)
where 3 is the weight adapting parameters.
4 EXPERIMENTS
4.1 EXPERIMENTAL SETUP
Our model H-PAD evaluated on seven real-world multivariate datasets, namely, MSL, SMAP, PSM, SMD, SWaT, NIPS TS "__te and NIPS TS Swan. The more detailed content of the dataset can be found in Appendix Q In addition, specific implementation details are given in Appendix D
4.2
MAIN RESULTS
We comprchensively compare our model with 16 baseline models. Table M gives the evaluation results of different baseline models and our model in five real datasets. It can be seen that our model H-PAD can achieve the best results in most datasets, with an F1 score of more than 95% on all datasets.
However, many works have demonstrated that PA can lead to faulty performance evaluations WWng et al., 2023: Kim et all, 2021; Huet all 2022), and is known that using PA can result in of-te-of-the-arr perfor- mance even with random scores or random initialized non-trained models, making it impossible to conduct a fair comparison and assess the effectiveness of the models. To ensure fair comparison between H-PAD and the baseline models, we used AUC-ROC and AUC-PR as evaluation metries. As shown in Table D comparison H-PAD with other reconstruction models, H-PAD achieves the best or second-best results on most datasets. Furthermore, H-PAD exhibited the highest average AUC-ROC score and the highest AUC- PR score in all seven datasets, highlighting its effectiveness. Please refer to Appendix for more detailed description of the evaluation criteria.
4.3 ABLATION STUDY
Effectiveness of module The different effectiveness of using patch prototypes and period prototypes studies. As shown in Table matter which prototype removed, the performance will decrease, and the
8

---

Published as conference paper ICLR 2025
Table Precision, recall, Fi-score results (as %) on five real-world datasets. 'A.T.' means Anomaly Trans- former. 'Avg' means average. The best results are marked in bold, and the second best results are marked in underline.
Model
MSI.
SMAP
PSM
SMD
SWaTT
Avg
Pre
F1
Pre
Pre
Roc
Isolation Forest
53.94
86.54
66.45
52.39
59.07
55.53
76.09
92.45
83.48
42.31
73.29
53.64
49.29
44.95
47.02
61.22
OC-SVM
59.78
86.87
70.82
53.85
59.07
56. 3.6
62:75
80.89
70.67
44. 3.4
76.72
56.
45.99
49.22
47.23
60.25
LOF
58.93
66.68
DAGMM
89.60
63.93
74.62
86.45
56.73
68.51
93.49
70.03
80.08
67.
49.89
57. 37
89.92
57.82
70.40
70.18
MMPCACD
81.42
61.31
69.95
88.61
75,84
81.73
76.25
78.35
77.29
71.20
79.28
75.02
82.52
68.29
74.73
75.74
Deep-SVDD
91.92
76.63
83.58
89.93
56,02
69.04
95.41
86.49
90.73
78.54
79.67
79.30
80.42
84.45
82.39
80.97
THOC
88.45
90.97
89.69
92.06
89.34
90.68
88. 14
90.99
89.54
79.76
90.95
84.99
81.94
86.36
85.13
88.01
73.85
86.
LSTM-VAR
85.49
79. 94
82.62
92.20
67.75
78.10
73.62
89,
80.96
75.76
90.08
82.
76.00
89.50
82,20
81.24
OmmiAnomaly
89.02
86.37
87.67
92.49
81,99
86,
88.39
74,46
80.83
83.68
86.82
85.22
81.42
84.30
82.83
84.69
InterPusion
81.28
92.70
89.77
88.52
89.
83.45
83.52
87.02
83.01
BeaGAN
89.75
85.42
87.53
92.38
55.85
69.61
90.30
9.1844
92.04
72.90
84.09
78.10
64.01
87.46
73.92
80.24
A.T.
92.96
93.65
96.47
95.56
DCdletector
92.09
98.89
95.37
94.42
98.95
96.63
97.24
97.72
97.48
86.08
85.60
85.84
93.29
100,00
96.53
94.37
D3R
91.77
94.33
93.03
92.25
96.11
94.21
93.84
99.11
96.45
87.74
96.09
91.91
83.09
83.00
83.04
91.73
91.95
97.23
93.66
99.73
96.60
98
98.03
88 24
92.03
91.72
93.73
94.
DMamba
93.69
64.06
76.09
95.
52.98
68.05
98.66
82.59
89.91
92.57
54.04
68 24
94.11
86.75
90.28
78.51
GSC MAD
94.19
93.09
89.57
93.76
99.
92.25
94.42
93.32
96.73
95.10
H-PAD
94.05
96.88
95.45
96.00
98.45
97.21
98.82
99.41
99.12
92.86
98.20
95.45
94.34
100,00
97.09
96.86
Table 2: AUC-ROC and AUC-PR seven real-world datasets. 'N T__ W means NIPS_ TS_ Water. 'N_T_S' means NIPS_TS _S__SS_nSS 'AR' means AUC-ROC, 'AP' means AUC-PR.
MSL
SMAP
PSM
SMD
SWaT
N.T.W
N_T.S
Avg
Madel
AR
AP
AR
AR
AP
AR
AP
AR
AP
AP
LSTM-VAE
52.12
4.52
50.83
4.19
49.15
40.22
50.05
4.15
49.59
4.13
51.75
4.34
51.73
4.49
50.74
9.43
D3R
68.26
16.99
41.35
10.62
50.03
26.31
64.20
12.24
56.65
13.30
80.32
12.39
53.40
40.97
58.74
18.97
A.T.
48.72
10.64
49.67
12.50
48.56
29.42
47.28
3.70
29.40
8.82
33.46
1.48
43.49
28.62
42.94
13.59
DCdetector
50,06
10.61
48.87
12.48
49.83
27.64
48.77
41.16
49.74
11.60
50.53
1.72
48.50
31.71
49.47
19.56
MEMTO
49.99
10.48
59.59
16.29
49.75
26.96
73.24
10.35
45.41
11.45
60.96
4.21
51.12
49.06
55.72
18.40
DManha
61.54
15.02
38.99
10.85
59.53
47
64.55
11.99
74.49
25.33
96.93
46.32
77.84
64.64
67.69
30.61
H-PAD
59.99
15.06
59.13
15.30
75.01
51.83
76.49
14.05
81.54
53.99
75.96
7.30
81.66
74.31
72.83
33.12
performance decrease is the largest when the patch prototype is removed. Based the comparison of these results, the effectiveness of using patch prototypes and period prototypes is demonstrated.
Abnormality Criteria Effectiveness of different abnormality score criteria is also studied. As shown in Table A. when we only used the reconstruction error as the criterion, the Fl score dropped the most, with an average drop of 14.21% %. Removing differrntt evaluation criteria separately will result different degrees of decline in results, which also proves the effectiveness of the abnormality criteria we used in this paper.
4.4 DISCUSSION AND ANALYSIS
Parameter sensitivity analysis The impact of the numbers of prototypes, scales, and periods on H-PAD is analyzed numerically. It can be seen from Figure g that F1 has small variance for different number of prototypes per scale (Figure Aa) to exhibit the robustness of H-PAD, as well as the number of periods shown in Figure Hcl H-PAD can get optimal F1 for each dataset (Figure Hb with the best scale number.
9

---

Published as conference paper ICLR 2025
Table 3: Modules Effectiveness measured in Fl-score (%). Scale is the patch prototype branch, and Period is the period prototype branch.
Scale
Period
MSL
SMAP
PSM
SWaT
SMD
Avg.
X
93.93
96.30
97.95
93.73
92.03
94.78
X
94.56
96.51
98.37
96.89
94.26
96.11
x
v
83.48
69.52
93.72
89.55
78.13
83.08
v
95,45
97.21
99.12
97.09
95.45
96.86
Table 4: Effectiveness of anomaly criterions. Comparison using F1 score (%)
Spee
Pp
MSI.
SMAP
PSM
SWaT
SMD
Avg.
X
88.32
78.21
93.40
94.08
59.25
82.65
V
93.18
96.73
98.24
96.78
93.24
95.63
X
v
91.27
91.71
93.40
84.88
59.61
84.17
X
V
93.18
96.47
97.85
96.62
89.84
94.79
95.45
97.21
99.12
97.09
95.45
96.86
106
96-
66
84
F1 (i-sccre(1))
F1-score (%)
24
3ND
SHD
RT3L
MSL
58
PSM
PEM
52
SMAP
50
22000122222221111115552 number prototypes
The number Periods
(a)
(b)
(c)
Figure 4: Sensitivity analysis of hyperparameters for H-PAD.
5 CONCLUSION
This paper introduces new time series anomaly detection model called H-PAD. The model utilizes differ- ent patch prototypes and period prototypes to detect various interval and period anomalies. Furthermore, we employ data of different scales to capture short-term changes and use data of different periods to capture periodic information, enabling the modeling of the time series using long-term and short-term normal pro- totypes. H-PAD is compared seven datasets, illustrating the advantages of the model. In future work, plan to optimize the overall framework to improve efficiency, reducing training time and memory consump- tion without compromising performance.
10

---

Published as conference paper ICLR 2025
ACKNOWLEDGMENTS
This work is supported by the National Natural Science Foundation of China (61672205), the Hige-Level Talents Research Start-Up Up Project of Hebei University (521 100222002), the Innovation Capacity Enhance- ment Program Science and Technology Platform Project of Hebei Province (22567623H) and the Natural Science Foundation of Hebei Province (No. F2024201032, A2024201031 and H2024201062).
REFERENCES
Ahmed Abdulaal, Zhuanghua Liu, and Tomer Lancewicki. Practical approach asynchronous multivariate time series anomaly detection and localization. In Proceedings of the 27th ACM SIGKDD conference on knowledge discovery Data mining. pp. 2485-2494, 2021.
Markus M Breunig, Hans-Peter Kriegel, Raymond T Ng, and Jörg Sander. Lof: identifying density -base local outliers. Proceedings of the 2000 ACM SIGMOD international conference on Management of data, pp. 93-104, 2000.
Junqi Chen, Xu Tan, Sylwan Rahardja, Jiawei Yang, and Susanto Rahardja. Joint selective state space model and detrending for robust time series anomaly detection. IEEE Signal Processing Letters, 31:2050-2054, 2024.
Emadeldeen Eldele, Mohamed Ragab, Zhenghua Chen, Min Wu, Chee Keong Kwoh, Xiaoli Li, and Cuntai Guan. Time-series representation learning via temporal and contextual contrasting. In Zhi-Hua Zhou (ed.), Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, IJCAI-21, pp. 2352-2359, 2021.
Dong Gong, Lingqiao Liu, Vuong Le, Budhaditya Saha, Moussa Reda Mansour, Svetha Venkatesh, and Anton Van Den Hengel. Memorizing normality to detect anomaly: Memory-augment deep autoencoder for unsupervised anomaly detection. In 2019 IEEE/CVF International Conference on Computer Vision (ICCV), pp. 1714-1714, 2019.
Alexis Huet, Jose Manuel Navarro, and Dario Rossi. Local evaluation of time series anomaly detection algorithms. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 635-645, 2022.
Kyle Hundman, Valentino Constantinou, Christopher Laporte, Ian Colwell, and Tom Soderstrom. Detecting spacecraft anomalies using Istms and nonparametric dynamic thresholding. In Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery Data Mining & data mining, pp. 387- 395, 2018.
Neha Kant and Manish Mahajan. Time-series outlier detection using enhanced k-means in combination with pso algorithm. In Engineering Vibration, Communication and Information Processing: ICoEVCI 2018, India, pp. 363-373. Springer, 2019.
Siwon Kim, Kukjin Choi, Hyun-Soo Choi, Byunghan Lee, and Sungroh Yoon. Towards rigorous evaluation of time-series anomaly detection. In AAAI Conference on Artificial Intelligence, 2021.
Kwei-Herng Lai, Daochen Zha, Junjie Xu, Yue Zhao, Guanchu Wang, and Xia Hu. Revisiting time series outlier detection: Definitions and benchmarks. In Thirty-fifth conference on neural information processing systems datasets and benchmarks track (round 1), 2021.
Dan Li, Dacheng Chen, Baihong Jin, Lei Shi, Jonathan Goh, and See-Kiong Ng. Mad-gan: Multivariate anomaly detection for time series data with generative adversarial networks. International conference on artificial neural networks, pp. 703-716. Springer, 2019.
11

---

Published as a conference paper ICLR 2025
Zhihan Li, Youjian Zhao, Jiaqi Han, Ya Su, Rui Jiao, Xidao Wen, and Dan Pei. Multivariate time series anomaly detection and interpretation using hierarchical inter-metric and temporal embedding. In Pro- ceedings of the 27th ACM SIGKDD conference on knowledge discovery & data mining, pp. 3220-3230, 2021.
Fei Tony Liu, Kai Ming Ting, and Zhi-Hua Zhou. Isolation forest. In 2008 eighth IEEE international conference on data mining, pp. 413 4.3.422.1 IEEE, 2008.
Dachyung Park, Yuuna Hoshi, and Charles Kemp. multimodal anomaly detector for robot-assisted feeding using an lstm-based variational autoencoder. IEEE Robotics and Automation Letters, 3(3): 1544- 1551, 2018.
Hyunjong Park, Jongyoun Noh, and Bumsub Ham. Learning memory-quided normality for anomaly de- tection. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 14372-14381, 2020.
Frederik Rehbach, Steffen Moritz, Sowmya Chandrasekaran, Margarita Rebolledo, Martina Friese, and Thomas BeielseBiellttin. Gecco 2018 industrial challenge: Monitoring of drinking- matter water quality. Ac- cessed: Feb, 19:2019, 2018.
Bernhard Schölkopf, John C Platt, John Shawe-Taylor, Alex Smola, and Robert C Williamson. Estimating the support of tigh-dimensional distribution. Neural computation, 13(7): (47)):443-144 1471, 2001.
Lifeng Shen, Zhuocong Li, and James Kwok. Timeseries anomaly detection using temporal hierarchical one-class network. Advances in Neural Information Processing Systems, 13:13016-13026, 2020.
Youjin Shin, Sangyup Lee, Shahroz Tariq. Myeong Shin Lee, Okchul Jung, Daewon Chung, and Simon S Woo. Itad: integrative tensor-based anomaly detection system for reducing false positives of satellite systems. In Proceedings of the 29th ACM international conference on information & knowledge manage- ment, pp. 2733-2740, 2020.
Junho Song, Keonwoo Kim, Jeonglyul Oh, and Sungzoon Cho. Memto: Memory- guided transformer for multivariate time series anomaly detection. Advances in Neural Information Processing Systems, 36, 2024.
Ya Su, Youjian Zhao, Chenhao Niu, Rong Liu, Wei Sun, and Dan Pei. Robust anomaly detection for multivariate time series through stochastic recurrent neural network. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery data mining, pp. 2828-2837, 2019.
Sainbayar Sukhbaatar, Jason Weston, Rob Fergus, et al. End-to-end memory networks. Advances in neural information processing systems, 28, 2015.
Jian Tang, Zhixiang Chen, Ada Wai-Chee Fu, and David W Cheung. Enhancing effectiveness of outlier detections for low density patterns. Advances in Knowledge Discovery and Data Mining: 6th Pacific- Asia Conference, PAKDD 2002 Taipei, Taiwan, May 6-8, 2002 Proceedings 6, pp. 535-548. Springer, 2002.
David MJ Tax and Robert PW Duin. Support vector data description. Machine learning. 54:45-66. 2004.
Chengsen Wang, Zirui Zhuang, Qi Qi, Jingyu Wang, Xingyu Wang, Haifeng Sun, and Jianxin Liao. Drift doesn't 't matter: Dynamic decomposition with diffusion reconstruction for unstable multivariate time series anomaly detection. In Thirty-seventh Conference on Neural Information Processing Systems, 2023.
Jason Weston, Sumit Chopra, and Antoine Bordes. Memory networks. arXiv preprint arXiv: -XXv:1410.3916, 2014.
12

---

Published as conference paper ICLR 2025
Haixu Wu, Tengge Hu, Yong Liu, Hang Zhou, Jianmin Wang, and Mingsheng Long. Timesnet: Temporal 2d-variation modeling for general time series analysis. In The Eleventh International Conference on Learning Representations, 2023.
Jichui Xu, Haixu Wu, Jianmin Wang, and Mingsheng Long. Anomaly transformer: Time series anomaly detection with association discrepancy. In International Conference on Learning Representattonns, 2022.
Takehisa Yairi, Naoya Takeishi, Tetsuo Oda, Yuta Nakajima, Naoki Nishimura, and Noboru Takata. A data- driven health monitoring method for satellite housekeeping data based on probabilistic clustering and dimensionality reduction. IEEE Transactions on Aerospace and Electronic Systems, 5363):1384-1401, 2017.
Yiyuan Yang, Chaoli Zhang, Tian Zhou, Qingsong Wen, and Liang Sun. Dedetector: Dual attention con- trastive representation learning for time series anomaly detection. In Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 3033-3045, 2023.
Zhen Zhang, Zhiqiang Geng, and Yongming Han. Graph structure change- based anomaly detection in multivariate time series of industrial processes. IEEE Transactions on Industrial Informatics, 2024.
Bin Zhou, Shenghua Liu, Bryan Hooi, Xueqi Cheng, and Jing Ye. Beatgan: Anomalous rhythm detection using adversarially generated time series. In IJCAI, volume 2019, pp. 4433-4439, 2019.
Tian Zhou, Ziqing Ma, Qingsong Wen, Xue Wang, Liang Sun, and Rong Jin. Fedformer: Frequency en-
hanced decomposed transformer for long-term series forecasting. In International conference machine learning, pp. 27268-27286. PMLR, 2022.
Bo Zong, Qi Song, Martin Renqiang Min, Wei Cheng, Cristian Lumezanu, Daeki Cho, and Haifeng Chen. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In International confer- ence on learning representations, 2018.
13

---

Published as conference paper ICLR 2025
A PROBLEM DESCRIPTION
Figure 5(a visualizes the reconstructed series by Anomaly Transformer atl (2022). It can be seen that both normal and abnormal points are well reconstructed by trained Anomaly Transformer, resulting the over-generalization problem that anomalies fight against gerrrenerlaiz,inn, MEMTO employs a memory bank of the normal point prototypes to help reconstruct time series Song all (20ZZ). The point prototypes normal points characters. inference phrase, the learned point prototypes are taken to reconstruct the test series. Because anomalies are absent from the prototype learning, MEMTO reconstructs the test series with none abnormal information, thereby alleviating the over-generalization problem. However, as visualized in Figure 50b1 MEMTO does not properly solve the over-generalization problem. The main reason lies in that point prototypes can not exhibit the intrinsic relevancy of neighbored points. Normal points and abnormal points are treated equally for reconstruction, indicating that the learned point prototypes can not well distinguish the abnormal characteristics from normal characteristics. What's more, point prototypes can not exhibit the varying trend in an interval, failing to identify interval anomalies which manifest as brief data fluctuations sudden changes over short interval. As long-term anomalies, period anomalies can also not be identified by point prototypes since single-point normal prototypes typically cannot capture periodic regularities. After reconstruction using different normal prototypes in H-PAD, the reconstructed data is closer to the normal data and farther from the anomalous data (as shown in Figure ())
longer be identified by high reconstruction emrors. To
learned from normal series to depict the
5-5N Virus britic
HANT V patis
Homal Anemey
20
-0-
-50
-0
(a) Anomaly Transformer reconstructs series
(b) MEMTO reconstructs series
Figure 5: Figure is t-SNE graph of the original data and the data reconstructed by Anomaly Transformer, and Figure is t-SNE graph of the original data and the data reconstructed by MEMTO. Blue points are normal data points, red points are abnormal data points, and green points are reconstructed data points.
ENCODER
To make the data operation clearer, this section explains the working principle of the encoder part.
To learn prototypes in feature space, different scale series are embedded into a high high-dimensional feature space with Transformer Encoder (Figure M):
Trans (Embedding (X=))
(19)
14

---

Published as conference paper ICLR 2025
Nomal
0
80
-40
Figure 6: The t-SNE graphs of the original data and the data reconstructed by H-PAD.
Embedding
Layer Layer Norm
Mulia Aull--Fa Hood
Layor Layer
Reed Forward
Attention
Q' E R 4xD
Nom
+
X E
FER4 C
Transformer block xe
Figure 7: Learn temporal dependencies at different scales with multiple Transformers.
(D C). Specifically, the pooled series X is embedded into a high-dimensional space through a linear layer order to present more complex information and latent regularities. Followed with multiple layers of Transformer blocks which capture long-term temporal dependencies, the query series Q is produced for learning the patches prototypes different scales.
where Q 1q......... qi.) E RR...
To characterize each period, X E Nx is embedded into a high-dimensional features space N by linear network and then Transformer blocks learn the variable correlations according to (Figure S)
Q2 = Transformet (Embedding (X) X
X
(20)
where Q" = (Qi Q 2') and Q² E NxD. QP is submitted to the period query update module learn one period prototypes for each variable. Note that one encoder structured for one period division learning since different periods p of the time series present different variable correlations.
15

---

Published as conference paper ICLR 2025
Sinpepzree La
L Layer CayarNom Nom
Layer Norm Norm
Forward
QP P'RR" ROND
P RR" Nap.C
Transforme block Xe
Figure 8: Transformer Encoder for learning multiple periods prototypes.
C DATASETS
Our model H-PAD is evaluated on seven real-world multivariate datasets. The specific description of the dataset is shown in Table B
Table 5: The dataset used in this study. Train and Test represent the number of time points in the training dataset and the test dataset, respectively, AR represents the anomaly rate.
Dataset
Dims
Train
Test
AR (%)
SWaT
475200
449919
12.14
PSM
25
132418
87841
27.76
MSL
55
58317
73729
10.48
SMAP
25
135183
427617
12.83
SMD
38
708405
708420
4.16
NIPS HIPS_TS_T Water
9
69260
69261
1.1
NIPS_TS_Swan
38
60000
60000
32.60
SSaT(Secure Water Treatment) Liet all (2019) a collection of sensor data from a water treatment process running continuously for 11 days under various operating conditions.
PSooeod Server Metrics) Andulaa al (20221 is a public data set composed of data generated by different application servers in eBay.
MSL(Mars Science Laboratory rover) Eundman el all (2018) is collected by NASA shows the status data of sensor and actuator of the Mars rover.
SMAP(Soil Moisture Active Passive satellite) Hundman al (2018) is provided by NASA's Soil Moisture Active Passive Satellite mission, which collects soil moisture data on global scale.
SMD(Server Machine Dataset) Su al (2019) is server data collected by large Internet company a period of weeks and contains telemetry data from multiple servers.
TS_Water Water ea et all (202 originates from a water quality monitoring system, which records water quality indicators measured by multiple sensors.
-NPS__T
-NPSS_TS Swan Rehhach at (2018 is multivariate time series extracted from vector magne-
tograms of the solar photosphere.
16

---

Published as a conference paper ICLR 2025
D IMPLEMENTATION DETAILS
In this paper, H-PAD algorithm experiments, parameters sensitivity analysis and ablation studies are imple- mented in PyTorch using a single NVIDIA GeForce RTX 4090 24GB GPU. H-PAD uses the Adam optimizer optimize the networks' parameters, with an initial learning rate of 10 4. The H-PAD training process uses early stopping mechanism that the model training stops when the model loss (LOOS)) in (Q.(LE) does not decrease within 8 epochs. We of each dataset and divide the training dataset into 80% training set and 20% validation set. The batch size is set to 32, and the model processes 32 batches of data each time. To find the best results, hyperparameters for different datasets, such as the feature dimension D. the number 2 of scales, the number K of periods, and the number M of patch prototypes. First, the hyperparameters (D, 2, K, M) are set to (128, 5, 3, 20), and then the optimal parameters for each dataset are obtained by adjusting the parameters. For the baseline model for comparison, we reproduced it using the parameters given in its paper. Our model defines anomalies as time points where the anomaly score exceeds a hyperparameter threshold 6, and marks the label the anomaly point as
non-overlapping sliding window of length 100 to split the time series
set different
E EVALUATION CRITERIA
Considering the main task of MTSAD, H-PAD is trained with only normal series and expected to be able detect anomalies in the testing series, which is also considered to be unbalanced binary classification problem. Thus, to assess and compare the performance of the proposed H-PAD, evaluation criteria based on confusion matrix are used in this study. Confusion matrix is composed of True Positive (TP). True Negative (TN), False Positive (FP) and False Negative (FN). Note that abnormal observations are regarded as positive
samples MTSAD. Based on the confusion matrix, several evaluation metries can be employed to quantify the detection performance:
Precision the proportion of observations predicted correctly to be abnormal among those pre- dicted to be abnormal, calculated as:
TP
Pre TP+
(21)
Recall is the proportion of observations predicted correctly to be abnormal among those labeled to be abnormal, calculated as:
TP
Rec TP + FN
(22)
F1-score can comprehensively evaluate the detecting performance. It is the harmonic mean of precision and recall, calculated as:
Pre Rec
F1 = 2 Pre + Rec
(23)
AUC-ROC (Area Under the Receiver Operating Characteristic Curve) is the area under the ROC (Receiver Operating Characteristic) curve which depicts the relationship between the false positive rate (FPR) and the true positive rate (TPR) where
TP
FP FP+TN
TPR = FN-
and FPR
(24)
AUC-PR (Area Under the Precision- Recall Curve) the area under the Precision-Reddd curve which is more suitable to evaluate imbalanced classifiers.
17

---

Published as conference paper ICLR 2025
F TRAINING EFFICIENCY ANALYSIS
The efficiency of the H-PAD training model is compared with another memory model MEDMTO. The results are shown in Table f Since H-PAD learns patch prototypes of time series of different scales and period prototypes of different periods, its efficiency much higher than MEMTO. MACs is the total number operations, which is used to measure the computational complexity of the neural network model. Epoch Time is the training time per epoch, in seconds. Max Memory Allocated the maximum GPU memory usage during training. Total Parameters is the total number of parameters in the neural network model, including weights, biases, and other parameters.
of
Table 6: Training efficiency analysis.
Dataset
Method
MACs
NPARAMS
EROCH TIME
MAX MEMORY(GB)
MSL
MEMTO
10415226880
5955182
1,46
1.04
H-PAD
90085779336
36345527
10.91
10.98
SMAP
MEMTO
10261626880
5862962
1.39
1.78
H-PAD
35983470152
23556227
19.58
9.36
PSM
MEMTO
10261626880
5862962
1.05
2.58
H-PAD
32452186440
22462860
10.70
3.35
SWaT
MEMTO
10394746880
5942886
3.63
4.37
H-PAD
72704662360
35411680
54.86
4.72
SMD
MEMTO
5902924
11.17
1.47
H-PAD
41111111808
20404825
81.89
6.33
G
MORE EXPERIMENTS
To further demonstrate the effectiveness of using patch prototypes and using period prototypes, compared multiple indicators with the memory model MEMTO (Song et an, 2022)) that only learns point normal prototypes. The results shown in Table Z Affiliation preiiion(AfffP) and recall(Aff-R) Rf are calculated based on the distance between ground truth and prediction events. VUS metric takes anomaly events into consideration based the receiver operator characteristic(ROCC) curve. R_A.R and R_A_P AUC-ROC and Range-AUC-PR, respectively, representing the two scores obtained under the ROC curve and PR curve according the label transformation. V_ROC and V_PR are the volumes under the ROC curve and PR curve, respectively.
Range-
Table 7: Comparion results with MEMTO with different metries on real-world datasets.
Dataset
Method
Acc
F1
Aff-P
Aff-R
R A.A.B R
R_A_P P
V. V_ROC
V V_PR
MSI.
MEMTO
98.09
93.54
51.43
96.00
90.56
88.35
88.71
86.73
H-PAD
99.03
95.45
55.98
96.25
91.34
88.66
89.94
87.91
SMAP
MEMTO
99.07
96.60
52.89
96.92
94.45
93.48
93.20
92.40
H-PAD
99.28
97.21
52.46
98.87
96.83
94.13
95.86
93,30
PSM
MEMTO
98.79
98.03
56.86
74.00
89.69
94,20
88.71
92.57
H-PAD
99.51
99.12
64.29
84.79
92.91
92.42
90.65
91.70
SWaT
MEMTO
98.44
93.73
59.04
93.44
92.01
89.16
92.09
89.23
H-PAD
99.22
97.09
60.40
97.54
98.28
95.88
98.31
95.91
SMD
MEMTO
99.18
92.03
56. 19
86.93
74.69
71.21
74.95
71.48
H-PAD
99.60
95.45
68.91
93.22
81.02
78.86
82.02
79.85
18

---

Published as conference paper ICLR 2025
addition, to further explore the impact of different hyperparameters on model performance, we conducted more parameter sensitivity experiments. The results are shown in the table &. table H. table ITI, table [.] table I figure Tora), figure [[[b]] and figure
100
98
96
F1-score (%)
94
90
SMD
MSL
PSM
SMAP
86
SWaT
5 10
50
60
The number of scales
Figure 9: Sensitivity experiments with larger number of prototypes.
Table The impact different sizes of hyperparameters y on the model. The result is Fl score (%).
7
MSL
SMAP
PSM
SMD SWaT
0.1
94.06
97.01
98.99
96.33
89.37
0.3
93.14
96.93
98.95
94.43
93.80
0.5
95.45
97.21
99.12
97.09
95,45
0.7
93.20
96.30
98.97
96.68
94.16
0.9
92.69
96.28
99.04
95.97
95.15
Table The impact of different sizes of hyperparameters 8 the model. The result is F1 score (%).
B
MSL
SMAP
PSM
SWaT
SMD
93.07
95.33
98.23
95.01
91.33
0.1
93.99
96.72
98.77
96.39
93.47
0.01
95.45
97.21
99.12
97.09
95.45
0.001
94.93
97.01
99.05
96.87
94.69
19

---

Published as conference paper ICLR 2025
Table 10: The impact of different sizes of hyperparameters a1 on the model. The result is Fl score (%).
01
MSL
SMAP
PSM
SWaT
SMD
0
94.92
96.83
98.13
96.46
90.95
0.1
93.32
96.59
98.13
94.66
95.00
0.5
94.00
96.63
98.68
94.66
93.59
0.8
93.53
96.42
98.95
96.48
94.61
1
95.45
97.21
99.12
97.09
95.45
Table 11: The impact of different sizes of hyperparameters 02 the model. The result is F1 score (%)
Q2
MSL
SMAP
PSM
SWaT
SMD
0
93.06
96.62
99.00
95.95
93.12
0.1
94.10
96.35
98.63
96.57
93.70
0.01
93.12
96.75
98.88
96.57
94.48
0.05
94.10
96.42
98.61
95.80
94.57
0.005
95.45
97.21
99.12
97.09
95.45
0.001
93.10
96.82
98.92
95.07
94.99
H VISUALIZATION ANALYSIS
We visualized anomalies and detection results validate the effectiveness of the proposed H-PAD, shown in Figure ID The black dashed line represents the anomaly threshold, with values above this threshold in- dicating anomalies. The pink highlighted sections denote the anomaly points. It can be observed that H-PAD assigns higher anomaly scores to anomalies and effectively detects various types of anoma- lies, including point anomalies, contextual anomalies, and periodic anomalies, further demonstrating the effectiveness of our model.
20

---

Published as conference paper ICLR 2025
Table 12: The impact of different sizes of hyperparameters dg on the model. The result is F1 score (%).
Cx3
MSL
SMAP
PSM
SWaT
SMD
0
93.41
97.11
98.94
94.17
94.44
0.1
92.72
96.96
98.95
92.65
94.64
0,01
93.02
96.73
98.60
94.80
94.55
0.001
93.19
96.57
99.09
95.94
94.34
0.0001
95.45
97.21
99.12
97.09
95.45
100
98
F1-score(%)
94
SMD
PSM
92
SMAP
64
256
Variable latent space dimension
(a) Variable latent space dimension D)
100
98-
F1-score(%)
SMD
PSM
92
SMAP
Period latent space dimension
(b) Period latent space dimension D..
Figure 10: Hyperparameter sensitivity analysis of the latent space dimension.
21

---

Published as conference paper ICLR 2025
Time Series
1.50
Aniomaly Score
Threshold
Anomaal Score
1.00
-2
9.50
0.25
-6
100
150
200
100
150
200
(a) Period anomaly
0.25
Time Series
Anomally Score
0.6
Anomaly
0.4
0
50
100
150
200
50
100
150
200
(b) Contextual anomaly
Time
Time Stco
12.5
Time Series
Anomalyy Score
10.0
Anomaly Score
Threshold
0.15
0.10
0.05
0.00
100
150
200
100
150
200
(c) Point anomaly
Figure 11: Anomaly visualization (Part 1). For each anomaly, such as periodic anomaly, the left side is the anomaly instance and the right side is the corresponding anomaly score.
22

---

Published as conference paper ICLR 2025
Time Series
Anomaly Score
Threshold
Anomaty
0.6
0.05
0.00
100
50
100
(a) Shapelet anomaly
Time Steo
0.08
Tirre Step
Anomaly Store
Threshald
Anomaly Store
0.06
0.6
0.4
0.02
0.00
(b) Tread anomaly
Time Step
Time Stop
Series
Anomaly
Threshold
Anormaly Store
0.1
0.0
50
100
150
50
100
200
Collective anomaly
Time Stee
Time Step
Time Series
Anomaly Score
Threshold
Aromaly Score
0.06
-2
0.04
0.00
50
100
150
0
50
100
150
(d) Global subsequence anomaly
Figure 11: Anomaly visualization (Part 2). For each anomaly, such as periodic anomaly, the left side is the anomaly instance and the right side is the corresponding anomaly score.
23


Reviews:
[{"review_id": "Ds7HpqXzG2", "reviewer": "Reviewer_2EhD", "summary": "This paper proposes H-PAD, a method to learn hybrid prototypes for multivariate time series anomaly detection. Hybrid prototypes contain both local and global information to help discover both shot-term (point) and long-term (period) anomalies. The authors evaluate their proposed method against various baseline models on 5 datasets and perform ablation studies to understand the importance of each component in the model architecture.\n\n[Update] Adjusted original score after reviewing the authors' rebuttal and revised manuscript", "questions": "1. How are the time series data preprocessed? What are the sizes of the datasets? Did the authors apply any filters or normalization to the datasets prior to training the model?\n2. How are different types of anomalies (point vs. period) defined in these datasets? \n3. What are the computing resources used to train the model? How is the model training efficiency?\n4. What are the raw precision, recall and AUC metrics of anomaly detection?\n5. How does model performance change with the dimensionality of the time series?\n6. What does it mean that “Generally speaking, the series of scale z1 is actually the original series X.”? Does this mean z1 is always set to 1? If so, the authors should clearly state this to avoid confusion. \n7. Why is Figure 5 (c) an example of period anomaly instead of point anomaly? It seems that the period is the same but the amplitude is anomalous. \n8. What distance metric is used to calculate affiliation precision/recall?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. The authors are familiar with the current literature on time series anomaly detection and evaluate their proposed method against SOTA baselines. \n2. Useful ablation studies are performed to understand the importance of each component (patch vs. period prototypes) in the model architecture.\n3. The model architecture design using query-based reconstruction (in both temporal and frequency domains) is motivated and explained with clear technical details.", "weaknesses": "1. The writing quality should be improved for better clarity. The authors use several non-standard terms such as “different local sizes” which should be corrected. \n2. The authors should provide additional implementation details on data processing and model training to help other researchers reproduce and extend their results. For example, how are the patch sizes {z1, z2, …, zm} and k (as in top-k amplitudes of FFT) selected?\n3. The authors should discuss the limitations of their work and outline the directions for future research.\n4. There are numerous typos and grammatical errors that need to be proofread and corrected. For example, “reference phase” should be “inference phase” (page 1) and “learn and memory prototypes” should be “learn memory prototypes” (page 2).\n5. The authors should provide rigorous mathematical definitions of affiliation precision/recall and RAP/RAR since they may not be familiar to most readers. The authors should also clearly explain why these metrics are used instead of the ordinary precision/recall/AUC.\n6. It’d be helpful to have more detailed review of the mechanism of memory networks and memory prototypes (either in Related Work or in Supplementary Materials) since these concepts may not be very familiar to most readers.  \n7. In addition to real-world datasets, it’d be ideal to evaluate the model on simulated time series data to verify that the patch and period prototypes indeed capture multi-scale and multi-period information and effectively detect the corresponding anomalies.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "5hZoaphcI4", "reviewer": "Reviewer_aDfE", "summary": "This manuscript proposes a hybrid prototypes learning model, H-PAD, which addresses the problem that existing models can only detect point anomalies. Specifically, normal prototypes are learned from different sizes of patches for time series to discover short-term anomalies. These prototypes in different sizes are integrated together to reconstruct query series so that any anomalies would be smoothed off and high reconstruction errors are produced.  Furthermore, period prototypes are learned to discover periodical anomalies. One period prototype is memorized for one variable of query series.", "questions": "See Weaknesses please.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is clearly organized.\n2. The authors propose H-PAD for multivariate timing anomaly detection, which addresses the problem that existing models can only detect point anomalies.", "weaknesses": "1. It is recommended that the authors optimize Fig. 1 to better describe the motivation for this paper.\n2. Since anomaly detection is inherently class unbalanced, it is recommended that the authors add AUC to Table 1 to fully analyze the effectiveness of the model.\n3. In experiments, whether or not these datasets chosen by the authors contain types of anomalies other than point anomalies seems to be important for the performance of the model. If we only look at Fig. 5, it seems that they are all point anomalies. It is recommended that the authors further add more types of anomalies to the visualization analysis to demonstrate the benefits of H-PAD.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YoVJnC5Fy0", "reviewer": "Reviewer_u2fE", "summary": "The main contribution of this paper lies in proposing a multiscale time series anomaly detection method H-PAD that combines local and periodic information. By designing local and periodic prototypes, introducing sparsity and periodic constraints, and integrating anomaly scoring mechanisms that consider both reconstruction errors and feature space deviations, the method effectively enhances the accuracy and robustness of anomaly detection.", "questions": "1.\tIn the INTRODUCTION section of the article, line 65 contains a typographical error: \"this paper proposes an MSTAD...\" should be \"MTSAD.\"\n2.\tIn line 81, the description of Contribution 2, \"but also can reconstruct abnormal series to be normal ones,\" is not accurately described. Providing a more detailed explanation might be better.\n3.\tIn line 180, it should specify that \"z1=1” corresponds to the original sequence X. Adding this detail would be more informative. Additionally, it would be helpful to clarify how the encoder part works—whether it directly uses the encoder block from the Transformer. Providing a more specific structural introduction would improve clarity.\n4.\tIn line 201, the introduction of the update gate is abrupt, and its function is unclear. Additionally, the introduction of the linear transformation matrices U_z and W_p is not well defined—what is their relationship to the context? It would be helpful to explain why linear transformations are applied to b and q.\n5.\tIn section 3.3, line 276, the calculation of the reconstructed sequence involves directly averaging the temporal and frequency domain reconstruction information. Since the sources and characteristics of these two types of reconstruction information are different, is this setting reasonable? It would be advisable to provide some explanation.\n6.\tIn line 296, are alpha_1, alpha_2, and alpha_3 manually adjusted hyperparameters or dynamically learnable parameters using an adaptive method? If they are manually adjusted, how can their approximate ranges be determined? It would be helpful to provide some analyses regarding the parameter settings.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The paper introduces a framework, H-PAD, for multivariate time series anomaly detection by combining patch-based and period-based prototypes to capture both local and global patterns. Combining local and periodic prototypes offers rich contextual information for anomaly detection.\n\n2. The methodology uses both time-domain and frequency-domain features to enhance detection accuracy. The dual-prototype mechanism, along with tailored anomaly scoring, demonstrates a robust approach to avoiding over-generalization.\n\n3. The reconstruction approach allows the model to effectively replicate normal patterns, aiding in more accurate anomaly identification.", "weaknesses": "1. The simple weighted average fusion of local and periodic reconstruction results may lead to information loss or conflict, lacking flexibility. \n2. The lack of detailed explanation regarding the implementation mechanism and role of the sparsity constraint may affect understanding and application effectiveness.\n3.\tThe lack of explanation regarding the basis for weight parameters in the loss function may lead to unstable model performance across different tasks.\n4.\tThe setup of the experimental section is not sufficient. Some parameter sensitivity experiments could be conducted to make the theoretical part of the article more convincing.\n5.\tWhile the paper is mostly clear, certain aspects, such as some definitions and mechanisms, could benefit from additional clarification to improve replicability and reader comprehension.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "jtdsuwMV4V", "reviewer": "Reviewer_WTSw", "summary": "This paper proposes a method to address the issue of overfitting to anomalies in existing time series anomaly detection algorithms. The approach involves learning different patches and periodic prototypes, and detecting anomalies through reconstruction. Experiments demonstrate that the proposed method outperforms existing algorithms.", "questions": "1. The paper claims that the proposed method can learn contextual information, and occasional point anomalies cannot utilize this context, thus avoiding overfitting. However, in reality, current time series analysis algorithms can also leverage contextual information. Could the paper provide a clearer explanation of why using multiple patches can mitigate the issue of overfitting to anomalies?\n2. In the contributions section, what does “reconstruct abnormal series to be normal ones” mean?\n3. Decomposing data using FFT and analyzing time series data from both the time and frequency domains is a common approach in many methods. What are the advantages of the proposed method compared to these existing techniques?", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "Comprehensive experiments were conducted to validate the proposed method.", "weaknesses": "1. The paper provides the formulas for the algorithm but lacks an explanation of the rationale and thought process behind their design. This omission may hinder readers' understanding of why the proposed method is effective.\n2. The paper primarily claims that current algorithms suffer from overfitting to anomalies. However, subsequent sections on method design do not explain how the proposed method addresses this issue.\n3. The text in Figures 1, 3, and 4 is too small.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Vg0VE9mPZU", "reviewer": "Reviewer_HAWs", "summary": "This paper proposed a reconstruction-based model called H-PAD for multivariate time series anomaly detection to address the issue of over-generalization.", "questions": "Please see above.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. Clear motivation\n2. Well structured", "weaknesses": "1. The font size of the figures is too small.\n2. There is a lack of related work, such as \"Joint Selective State Space Model and Detrending for Robust Time Series Anomaly Detection\".\n3. The principle of the proposed method is not clear enough. For example, please explain how the proposed method benefits from mapping the original features to a higher dimensional space (D > C). If C is already very large, will the proposed method still be effective?\n4. As shown in Table 1, the performance gain of the proposed method is marginal. Please test it on more datasets say 3 more datasets.\n5. Where is your code? the reproducibility is an issue.\n6. How did you set the parameters of your proposed method and all compared baselines?\n7. How should we choose the parameters of your proposed method?\n8. The cases in Figure 5 are overly simple/easy which cannot reflect the advantage of the proposed method.\n\n\n**I am willing to increase my scores if these issues are well addressed.**", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)