Finding Time Series Anomalies using Granular-ball Vector Data Description

TL;DR

This work tackles time series anomaly detection in dynamic nonlinear data by proposing GBOC, which leverages GVDD to adaptively partition latent space into dense granular-balls that represent local normal behavior. The method encodes time series windows into a latent space, constructs and refines granular-balls via density-guided splits and pruning, and optimizes representations with a reconstruction and alignment loss, enabling robust anomaly scoring by distance to the nearest granular-ball center. Across diverse univariate and multivariate benchmarks, GBOC demonstrates superior accuracy, scalability, and resilience to drift and noise, outperforming both traditional and deep-learning baselines. By providing a compact, interpretable, geometry-aware description of normality, this approach offers practical benefits for real-world TSAD tasks in noisy, nonstationary environments.

Abstract

Modeling normal behavior in dynamic, nonlinear time series data is challenging for effective anomaly detection. Traditional methods, such as nearest neighbor and clustering approaches, often depend on rigid assumptions, such as a predefined number of reliable neighbors or clusters, which frequently break down in complex temporal scenarios. To address these limitations, we introduce the Granular-ball One-Class Network (GBOC), a novel approach based on a data-adaptive representation called Granular-ball Vector Data Description (GVDD). GVDD partitions the latent space into compact, high-density regions represented by granular-balls, which are generated through a density-guided hierarchical splitting process and refined by removing noisy structures. Each granular-ball serves as a prototype for local normal behavior, naturally positioning itself between individual instances and clusters while preserving the local topological structure of the sample set. During training, GBOC improves the compactness of representations by aligning samples with their nearest granular-ball centers. During inference, anomaly scores are computed based on the distance to the nearest granular-ball. By focusing on dense, high-quality regions and significantly reducing the number of prototypes, GBOC delivers both robustness and efficiency in anomaly detection. Extensive experiments validate the effectiveness and superiority of the proposed method, highlighting its ability to handle the challenges of time series anomaly detection.

Figures (13)

• Figure 1: Latent space comparison between clustering-based modeling (left) and the proposed method preserving structural continuity (right). Clustering-based methods assume well-defined boundaries, which are unsuitable for the continuous and boundary-free distributions typical of time series data, requiring a more adaptive descriptive approach.
• Figure 2: Illustration of the proposed Granular-ball One-Class Network (GBOC).
• Figure 3: (a) shows high VUS but low Affiliation-F1 due to misaligned anomaly scores. (b) shows high VUS but NaN F1 as no predicted scores overlap with anomalies.
• Figure 4: Sensitivity analysis of GBOC on VUS-PR to the number of LSTM encoder layers, input window size and loss weight $\lambda$ across multiple datasets.
• Figure 5: Visualization of anomaly scores on two representative datasets from YAHOO and WSD, comparing GBOC with KNN, KShapeAD, and MEMTO. Ground-truth anomalies are shaded in red.

Theorems & Definitions (3)

• Definition 1: Granular-ball (GB)
• Definition 2: Granular-ball Distribution Measure
• Definition 3: Refinement Criterion