# CL-TAD: A Contrastive-Learning-Based Method for Time Series Anomaly Detection
## 3 The Proposed Method for Time Series Anomaly Detection: CL-TAD
### Generation of Positive Samples  
The component for positive sample generation is designed to create positive samples corresponding to each input subsequence sample. It consists of the masking module \(\gamma\) and the reconstruction-based encoder-decoder module \(\Phi\). From a given time series data \(X\), the set \(W\) of the original subsequence samples is generated, as depicted in Figure 5. In each learning iteration of the component, we first randomly choose from \(X\) a batch of \(S\) subsequence samples, each having a length of \(L\). This batch is represented as \(B=\{B_{i}\}_{i=0}^{S-1}\)  
Figure 6: **CL-TAD**: Contrastive-Learning-based model for Time series Anomaly Detection. cessing through the reconstruction module \(\Phi\), transformation module \(\Psi\), and the encoder module \(\Omega\) to derive its representation \(E_{iL+L-1}\). The normalized Euclidean distance function is used to compute the distance \(D(U_{i},E_{iL+L-1})\) between the representation \(U_{i}\) of the original subsequence \(B_{i}\) and the representation \(E_{iL+L-1}\) of the reconstructed subsequence \(M_{iL+L-1}\) as follows:  
\[D(U_{i},E_{iL+L-1})=\left|\left|\frac{U_{i}}{||U_{i}||}-\frac{E_{iL+L-1}}{||E_ {iL+L-1}||}\right|\right| \tag{9}\]  
The data point at the last time step in \(W_{i}\), specifically \(z_{iL+1}\), is designated as anomalous only when the distance \(D(U_{i},E_{iL+L-1})\) exceeds the pre-specified threshold \(\delta\). Figure 10 illustrates the process of generating and comparing the representations for the anomaly score calculation. The selection of the threshold value \(\delta\) is based on the examination of the \(F_{1}\) scores across a set of potential threshold values, uniformly distributed from 0 to the maximum representation distances observed on a held-out test dataset containing anomaly events. The value that produces the highest \(F_{1}\) score is chosen as the threshold \(\delta\). It is noteworthy that the distance distributions associated with anomalous events can differ depending on real-world applications. Algorithm A5 in Appendix A describes how the list of candidate thresholds is constructed. This thresholding approach has been adopted in several anomaly detection methods, including RAMED [27], OmniAnomaly [30], DeepFIB [21], MAD-GAN [32], and others. The \(F_{1}\) score is derived from precision and recall, and is defined as follows:  
\[F_{1}=\frac{2\times Precision\times Recall}{Precision+Recall} \tag{10}\]  
Figure 10: Representation generation and score computation for sequences of length 3. Each subsequence’s final time step is masked to produce a corresponding masked subsequence, which is then reconstructed. The trained model transforms both the original subsequence and its reconstructed version into their respective representations. The difference between these two representations, as measured by their distance, provides the anomaly score. \[Precision=\frac{TruePositives}{TruePositives+FalsePositives} \tag{11}\]  
\[Recall=\frac{TruePositives}{TruePositives+FalseNegatives} \tag{12}\]  
Refer to Algorithm 1 in Appendix A used to generate the list of thresholds. For datasets consisting of multiple time series, the final performance is evaluated by computing the average \(F_{1}\) scores over all sub-time series. Moreover, the proposed method incorporates the point adjustment technique [11] after performing threshold-based anomaly determination. Following this technique, once an individual time step within an anomalous segment is identified as anomalous, the entire segment is then considered as anomalous. This modification has demonstrated its effectiveness in practical scenarios, as recognizing an anomaly at a specific time step typically signals an alarm, bringing attention to its corresponding entire anomalous window. The point adjustment technique is visually presented in Figure 11. In this figure, the _Anomaly label_ represents the ground truth, with 1 signifying the presence of an anomaly event at a given time step and 0 denoting regular activity.