F-SE-LSTM: A Time Series Anomaly Detection Method with Frequency Domain Information

TL;DR

The paper addresses time-series anomaly detection by leveraging frequency-domain information. It constructs a frequency matrix from the data using two sliding-window FFT steps ($N=60$, $T=30$) and processes it with a SENet-LSTM-DNN pipeline to capture within-period and between-period dependencies. Empirical results on Yahoo Webscope S5 A1 and Numenta benchmarks show that the frequency-matrix representation yields superior discriminative power, with F-SE-LSTM achieving higher F1, recall, and precision than state-of-the-art methods while maintaining efficiency. The approach offers a practical boost for real-world anomaly detection and suggests future work in combining time-domain and frequency-domain cues for even greater robustness.

Abstract

With the development of society, time series anomaly detection plays an important role in network and IoT services. However, most existing anomaly detection methods directly analyze time series in the time domain and cannot distinguish some relatively hidden anomaly sequences. We attempt to analyze the impact of frequency on time series from a frequency domain perspective, thus proposing a new time series anomaly detection method called F-SE-LSTM. This method utilizes two sliding windows and fast Fourier transform (FFT) to construct a frequency matrix. Simultaneously, Squeeze-and-Excitation Networks (SENet) and Long Short-Term Memory (LSTM) are employed to extract frequency-related features within and between periods. Through comparative experiments on multiple datasets such as Yahoo Webscope S5 and Numenta Anomaly Benchmark, the results demonstrate that the frequency matrix constructed by F-SE-LSTM exhibits better discriminative ability than ordinary time domain and frequency domain data. Furthermore, F-SE-LSTM outperforms existing state-of-the-art deep learning anomaly detection methods in terms of anomaly detection capability and execution efficiency.

Figures (7)

• Figure 1: Two network traffic time series data show similar trends in time.
• Figure 2: Two sequences A and B that are very similar in the time domain have significant differences in the frequency domain at specific frequencies.
• Figure 3: Frequency matrix creation steps.
• Figure 4: Anomaly detection model: (a) Frequency matrix is convoluted; (b) SENet is used to extract the dependencies between frequencies in the same time period; (c) LSTM is adopted to extract the dependencies between frequencies in different time periods.
• Figure 5: Influence of frequency matrices on various deep learning algorithms and datasets.