This work investigates the zero-shot application of a univariate forecasting FM, TimesFM, to industrial MTSAD on the Secure Water Treatment (SWaT) benchmark, and concludes that the proposed naive zero-shot FMs are unsuitable for MTSAD but promising for change-point detection.
Abstract
Multivariate Time Series Anomaly Detection (MTSAD) is essential for reliability and safety in domains such as industrial process monitoring and financial risk management, yet conventional approaches rely on application-specific models that are costly to train and hard to scale. Foundation Models (FMs), pre-trained on broad data with strong zero-shot generalization, have recently become available for univariate time series forecasting, raising the question of whether they can address MTSAD without task-specific training. We investigate the zero-shot application of a univariate forecasting FM, TimesFM, to industrial MTSAD on the Secure Water Treatment (SWaT) benchmark, evaluating two strategies: treating the FM as a per-feature forecaster with thresholded prediction errors, and as an embedder whose intermediate representations feed standard outlier detectors. Neither of our proposed setups is competitive with established baselines; embeddings reveal only partial separation between normal and anomalous segments, insufficient for reliable detection. The cause is that the FM is too effective at capturing temporal dynamics, yielding low error even within fully anomalous windows, so persistent anomalies become indistinguishable from normal behavior. However, these observations yield valuable insights: the error peaks at anomaly boundaries, indicating FMs reliably detect distribution changes. We conclude that the proposed naive zero-shot FMs are unsuitable for MTSAD but promising for change-point detection.
This work presents a protocol-aware empirical assessment across three settings: a C-MAPSS degradation-risk proxy, normal-only training for anomalous-sound detection on MIMII, and BDG2 forecasting-residual diagnostics with synthetic target perturbations.
Anomaly detection for multivariate time series is a critical task with broad applications in industrial monitoring, IT operations, and healthcare. Recent deep learning methods—including reconstruction-based, forecasting-based, and representation-learning approaches—have substantially improved detection accuracy by modeling complex temporal dependencies and inter-variable correlations within a fixed observation window. However, these methods have largely overlooked the historical context preceding the window-of-interest, referred to as the current window. Since time series anomalies are inherently contextual, modeling only the current window while neglecting long-term historical patterns inevitably leads to a high false alarm rate. In this paper, we propose CHAIN (long-Context History-supervised Anomaly detectIoN), a novel framework that explicitly captures long-term historical contexts under anomaly simulation and supervises current-window anomaly detection via masked cross-attention fusion. CHAIN adopts a history–current encoder–decoder design comprising three modules: a history context encoder based on the structured state space sequence model (S4) for efficient long-range modeling; a current context encoder based on a decoder-only Transformer for autoregressive forecasting; and a fused context decoder employing cascaded cross-attention layers that suppress simulated anomalous history via a learned mask. We jointly optimize autoregressive forecasting and a mask-prediction self-supervised auxiliary task in an end-to-end manner. Extensive experiments on three real-world benchmarks (SWaT, WADI, and SMD) demonstrate that CHAIN achieves competitive detection performance against fifteen state-of-the-art baselines. Ablation studies further verify the effectiveness of each proposed component.
Multivariate time series anomaly detection is critical in safety-critical domains such as industrial monitoring and financial systems. However, real-world time series are inherently non-stationary, with evolving data distributions driven by changing operational regimes and system dynamics. As a result, most existing methods, which assume static data distributions, exhibit severe performance degradation over time and are prone to catastrophic forgetting when incrementally updated. To address these challenges, we propose ReCATS, a replay-free framework for continual anomaly detection in non-stationary multivariate time series. ReCATS combines multi-regime modeling with a dual-phase generative alignment mechanism, enabling effective adaptation to distribution shifts while preserving knowledge acquired from past tasks. Furthermore, we introduce a dynamic dual-scale thresholding strategy to mitigate decision boundary drift under evolving data distributions. Extensive experiments on six real-world benchmark datasets demonstrate that ReCATS consistently outperforms state-of-the-art methods in terms of detection accuracy, knowledge retention, and transferability, as evaluated by standard continual learning metrics, including Backward Transfer and Forward Transfer. The code is available at https://github.com/Li-Qiuyang/ReCATS.
Qiuyang Li, Q. Ma, Zhongming Yao et al.· Proceedings of the 32nd ACM...· 0 citations
Time series anomaly detection (TSAD) underpins applications in predictive maintenance, finance, and cloud computing, however performance remains sensitive to representation choices, especially in multivariate settings. While transforming time series into images has shown success in forecasting and classification, it remains unclear how multivariate, high-dimensional series should be mapped to multi-channel images and whether vision backbones can match time-domain baselines in TSAD. We introduce PRISM, a plug-and-play meta-workflow enabling systematic construction and evaluation of image-based representations for multivariate TSAD. Our evaluation spanning over 7,000 experiments shows that well-designed PRISM configurations are competitive with 24 time-domain baselines, achieving the best VUS-PR on 10 of 14 datasets, with an average improvement of 41% over the best competing method on those datasets. Further, we identify channelization - how the channel dimension of multi-channel images is constructed - as a critical and previously understudied design dimension, and introduce MSM, a novel statistics-based scheme achieving 11-27% gains over PCA-based alternatives. Finally, ImageNet-pretrained encoders transfer effectively to TSAD, with frozen encoders retaining 92% of fine-tuned performance while training 1.8 times faster. Our code is available at: https://github.com/Smendowski/PRISM.
Mateusz Smendowski, Kamil Faber, Piotr Nawrocki et al.· 0 citations
Networked systems continuously generate heterogeneous time series, including Key Performance Indicator (KPI) streams, logs, and spectrum measurements, whose interpretation is essential for automated monitoring, diagnosis, and control. Existing analysis approaches either rely heavily on labeled data specific to each deployment or fail to capture joint time-domain and frequency-domain characteristics that are common in communication signals. Motivated by these limitations for cognitive communications and network monitoring, we propose the Time-Frequency Multi-Task Network (TFMTNet), a self-supervised framework that provides a transferable representation module for the evaluated network telemetry tasks. TFMTNet integrates a multi-scale time-frequency fusion backbone with three complementary pretraining objectives and provides lightweight task heads for anomaly detection, forecasting, and classification. Under a pretraining and adaptation protocol, the model is pretrained once and then adapted to target domains with limited labeled data. Empirical evaluation on ten anomaly detection datasets and additional public classification and forecasting datasets, including an Artificial Intelligence for IT Operations (AIOps) telemetry dataset, shows consistent cross-domain improvements under the evaluated settings. For cognitive communications, TFMTNet learns representations that can feed downstream reasoning and control modules, including Software-Defined Networking (SDN) decision making, spectrum management, and AIOps pipelines, thereby supporting the perception, reasoning, and control loop in networked systems.
Qi Qi, Chengsen Wang, Xingyue Wang et al.· IEEE Transactions on Cogniti...· 0 citations
Multivariate Time Series Anomaly Detection (MTSAD) has multiple applications in real-world environments, e.g., vehicles, industrial plants, and monitoring systems. Most existing MTSAD approaches mainly focus on Transformer-based temporal modeling and representation-based learning, yet they still ignore two key limitations, i.e., sensitivity to noise perturbations and limited diversity of learned temporal representations, which hinder fine-grained discrimination between normal and anomalous samples. To address these issues, we introduce DAMR, a novel dual adaptive multi-head representation learning framework for the MTSAD task. Specifically, we design a feature extraction module based on the Multi-Scale Adaptive Spectral Block (MSASB) to capture multi-scale temporal patterns in both time and frequency domains. Then, we adopt multiple projection heads to generate diverse representations and capture variations induced by multiple data augmentations. Furthermore, to improve feature representation flexibility, we introduce an independent adaptive temperature for each projection head to re-weight similarity scores between time series pairs. Finally, extensive experiments and comparisons are conducted on five dominant datasets. The detailed experiments show that, compared with the current promising works, our DAMR achieves significant performance improvements and strong noise robustness, e.g., +5.7% on WADI, +4.7% on MSL. Notably, compared with Transformer-based temporal modeling works, our DAMR requires far less FLOPs and GPU memory cost. The code is available at https://github.com/wyn404/DAMR.
Yining Wang, Fujun Han, Ke Li et al.· Proceedings of the 32nd ACM...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
