Anomaly Detection for Non-stationary Time Series using Recurrent Wavelet Probabilistic Neural Network

TL;DR

This paper tackles anomaly detection in non-stationary time series with limited training data by introducing RWPNN, a two-module framework that learns compressed temporal features via a stacked recurrent encoder-decoder (SREnc-Dec) and models the latent space with a nonparametric, ensemble wavelet density estimator (MRWPN). Unlike reconstruction-based or parametric-density methods, RWPNN captures multiple rates of data variation and adapts online through a forgetting mechanism in MRWPN, enabling robust detection under concept drift. The approach is validated on 45 real-world datasets, outperforming several unsupervised baselines in precision, recall, and F1, and demonstrates potential for early warning via latent-space density trends. The work advances anomaly detection in non-stationary environments by integrating deep temporal representations with wavelet-based probabilistic density estimation, offering practical benefits for real-time monitoring and decision support.

Abstract

In this paper, an unsupervised Recurrent Wavelet Probabilistic Neural Network (RWPNN) is proposed, which aims at detecting anomalies in non-stationary environments by modelling the temporal features using a nonparametric density estimation network. The novel framework consists of two components, a Stacked Recurrent Encoder-Decoder (SREnc-Dec) module that captures temporal features in a latent space, and a Multi-Receptive-field Wavelet Probabilistic Network (MRWPN) that creates an ensemble probabilistic model to characterise the latent space. This formulation extends the standard wavelet probabilistic networks to wavelet deep probabilistic networks, which can handle higher data dimensionality. The MRWPN module can adapt to different rates of data variation in different datasets without imposing strong distribution assumptions, resulting in a more robust and accurate detection for Time Series Anomaly Detection (TSAD) tasks in the non-stationary environment. We carry out the assessment on 45 real-world time series datasets from various domains, verify the performance of RWPNN in TSAD tasks with several constraints, and show its ability to provide early warnings for anomalous events.

Figures (7)

• Figure 1: The flowchart of the proposed RWPNN. The temporal feature extractor block consists of an RNN-based Encoder and a Decoder to compress and reconstruct the input signal. And a Multi-receptive-field Wavelet Probabilistic Network (MRWPN) creates an ensemble probabilistic model that handles different rates of data variation in the non-stationary environment for anomaly detection.
• Figure 2: Visualisation of the MRWPN module, which provides $|\Gamma|$ views at the same time. Each dashed module refers to an MRWPN with a specific value of $\alpha$, and different values of $\alpha$ are used to construct the ensemble view.
• Figure 3: Distribution of the estimated $\hat{p}_i(h^E_{\mathbf{x}})$ in Dataset ItalyPowerDemand; the normal and anomaly data can then be separated by selecting an appropriate threshold $\beta$.
• Figure 4: F1-Score performance heatmap for the models and datasets considering $\mathcal{P}=\{0.8, 0.2\}$ and the presence of CD. The heatmap is segmented into four regions: (i) $\mathcal{P} = 0.8$, (ii) $\mathcal{P} = 0.8$ with CD, (iii) $\mathcal{P} = 0.2$, (iv) $\mathcal{P} = 0.2$ with CD. A warmer colour denotes a higher F1-score while a cooler one indicates a lower F1-score.
• Figure 5: The estimated PDFs for the ECG5000 dataset are depicted. (a) shows the mean and highlights the standard deviation of the normal and anomaly classes. (b) is the anomaly scores $a(\mathbf{x})$ for LED. (c) shows the scores generated $\hat{p}(y^E_{\mathbf{x}})$ by RWPNN. (d-e) are the pattern variations of $\hat{p}(y^E_{\mathbf{x}})$ for the normal and anomaly classes, respectively.