Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SMKC: Sketch Based Kernel Correlation Images for Variable Cardinality Time Series Anomaly Detection

Haokun Zhou

TL;DR

This paper tackles anomaly detection in multivariate time series under dynamic sensor cardinality, where channels may appear or disappear across windows. It introduces SMKC, a two-stage framework that first hashes variable-cardinality inputs into fixed-width state sequences and then builds a six-channel kernel image that encodes global temporal structure via cosine and robust log-distance measures; a kernel-aware transformer with masked reconstruction and teacher–student prediction learns normal patterns, while a training-free RandProj-kNN detector demonstrates strong cold-start performance. The key findings are that robust log-distance channels dominate the discriminative signal, cosine channels alone are insufficient, and linear-in-L scalable HYB variants (bandfeat/anchorfeat) enable efficient deployment at scale. Practically, SMKC enables robust variable-cardinality anomaly detection with a continuum of deployment options, from immediate training-free detection to fully learned representations with validation-time fusion, suitable for resource-constrained environments. The results suggest representation design—via permutation-invariant hashing and kernel-based imagery—offers a primary lever for handling sensor churn, with self-supervised learning and calibration providing added gains when resources permit.

Abstract

Conventional anomaly detection in multivariate time series relies on the assumption that the set of observed variables remains static. In operational environments, however, monitoring systems frequently experience sensor churn. Signals may appear, disappear, or be renamed, creating data windows where the cardinality varies and may include values unseen during training. To address this challenge, we propose SMKC, a framework that decouples the dynamic input structure from the anomaly detector. We first employ permutation-invariant feature hashing to sketch raw inputs into a fixed size state sequence. We then construct a hybrid kernel image to capture global temporal structure through pairwise comparisons of the sequence and its derivatives. The model learns normal patterns using masked reconstruction and a teacher-student prediction objective. Our evaluation reveals that robust log-distance channels provide the primary discriminative signal, whereas cosine representations often fail to capture sufficient contrast. Notably, we find that a detector using random projections and nearest neighbors on the SMKC representation performs competitively with fully trained baselines without requiring gradient updates. This highlights the effectiveness of the representation itself and offers a practical cold-start solution for resource-constrained deployments.

SMKC: Sketch Based Kernel Correlation Images for Variable Cardinality Time Series Anomaly Detection

TL;DR

This paper tackles anomaly detection in multivariate time series under dynamic sensor cardinality, where channels may appear or disappear across windows. It introduces SMKC, a two-stage framework that first hashes variable-cardinality inputs into fixed-width state sequences and then builds a six-channel kernel image that encodes global temporal structure via cosine and robust log-distance measures; a kernel-aware transformer with masked reconstruction and teacher–student prediction learns normal patterns, while a training-free RandProj-kNN detector demonstrates strong cold-start performance. The key findings are that robust log-distance channels dominate the discriminative signal, cosine channels alone are insufficient, and linear-in-L scalable HYB variants (bandfeat/anchorfeat) enable efficient deployment at scale. Practically, SMKC enables robust variable-cardinality anomaly detection with a continuum of deployment options, from immediate training-free detection to fully learned representations with validation-time fusion, suitable for resource-constrained environments. The results suggest representation design—via permutation-invariant hashing and kernel-based imagery—offers a primary lever for handling sensor churn, with self-supervised learning and calibration providing added gains when resources permit.

Abstract

Conventional anomaly detection in multivariate time series relies on the assumption that the set of observed variables remains static. In operational environments, however, monitoring systems frequently experience sensor churn. Signals may appear, disappear, or be renamed, creating data windows where the cardinality varies and may include values unseen during training. To address this challenge, we propose SMKC, a framework that decouples the dynamic input structure from the anomaly detector. We first employ permutation-invariant feature hashing to sketch raw inputs into a fixed size state sequence. We then construct a hybrid kernel image to capture global temporal structure through pairwise comparisons of the sequence and its derivatives. The model learns normal patterns using masked reconstruction and a teacher-student prediction objective. Our evaluation reveals that robust log-distance channels provide the primary discriminative signal, whereas cosine representations often fail to capture sufficient contrast. Notably, we find that a detector using random projections and nearest neighbors on the SMKC representation performs competitively with fully trained baselines without requiring gradient updates. This highlights the effectiveness of the representation itself and offers a practical cold-start solution for resource-constrained deployments.
Paper Structure (32 sections, 5 equations, 3 figures, 9 tables)

This paper contains 32 sections, 5 equations, 3 figures, 9 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Methodology
  4. Overview and design goals
  5. SMKC representation for variable-cardinality inputs
  6. From $(X,M)$ to a fixed-width hashed sequence
  7. Implementation details: $\lambda(n_t)$ and deterministic hashing.
  8. From hashed sequence to a hybrid kernel image
  9. Addressing the $O(L^2 d)$ bottleneck: scalable HYB representations
  10. Baseline HYB image ($O(L^2 d)$).
  11. Constant-factor ablations (still $O(L^2 d)$).
  12. Linear-in-$L$ scaling fixes: bandfeat and anchorfeat.
  13. Protocol.
  14. Results and takeaways.
  15. End-to-end scaling is dominated by the encoder at large $L$.
  16. ...and 17 more sections

Figures (3)

  • Figure 1: SMKC transform example (normal vs. anomalous). Starting from a window with values $X$ and missingness mask $M$, we construct the fixed-width hashed state sequence $g_{1:L}$ and then compute kernel-view channels. Shown are two representative channels derived from $g$: cosine similarity $\mathrm{Cos}(g)$ and robust log-distance $\mathrm{LogDist}(g)$. While missingness can obscure localized changes in $X$, the kernel view reveals structured deviations that are more amenable to masked modeling and window-level scoring.
  • Figure 2: Six-channel SMKC hybrid kernel image for a normal window. We stack cosine similarity and robust log-distance matrices computed on the hashed sequence $g$, its first difference $\Delta g$, and the absolute difference $|\Delta g|$. The cosine channels emphasize bounded directional similarity, whereas the log-distance channels emphasize magnitude-based deviations with robust compression. The scale token summarizes the robust bandwidth used in the log-distance transform and conditions the encoder on the window’s intrinsic distance scale.
  • Figure 3: Diagnostic illustrating why cosine-only kernel images can collapse under magnitude-driven anomalies. A short-segment amplitude scaling leaves the cosine kernel essentially unchanged (top row; max difference $\approx 10^{-7}$), while the robust log-distance kernel changes substantially (bottom row; max difference $\approx 2.08$), producing high-contrast structure. This supports the ablation result that cosine-only channels are ineffective in our setting, whereas log-distance channels remain discriminative. A controlled diagnostic in the appendix (Table \ref{['tab:cos-log-diagnostic']}) confirms this mechanism: cosine-kernel statistics are near-random for amplitude scaling and additive magnitude perturbations, whereas log-distance statistics separate normal and anomalous windows almost perfectly.