Contextual and Seasonal LSTMs for Time Series Anomaly Detection

TL;DR

CS-LSTMs address univariate time series anomaly detection by coupling a noise-decomposition preprocessor with a dual-branch prediction model that operates in time and frequency domains. The S-LSTM captures evolving seasonal patterns in the frequency domain, while the C-LSTM focuses on local contextual dynamics, both optimized with a noise-decomposed NLL loss. Empirical results on Yahoo, KPI, WSD, and NAB show state-of-the-art F1 scores and a ~40% reduction in inference time, with strong cross-domain transferability. The approach offers robust, efficient TSAD suitable for IT monitoring and similar applications, advancing detection of subtle point and slowly rising anomalies.

Abstract

Univariate time series (UTS), where each timestamp records a single variable, serve as crucial indicators in web systems and cloud servers. Anomaly detection in UTS plays an essential role in both data mining and system reliability management. However, existing reconstruction-based and prediction-based methods struggle to capture certain subtle anomalies, particularly small point anomalies and slowly rising anomalies. To address these challenges, we propose a novel prediction-based framework named Contextual and Seasonal LSTMs (CS-LSTMs). CS-LSTMs are built upon a noise decomposition strategy and jointly leverage contextual dependencies and seasonal patterns, thereby strengthening the detection of subtle anomalies. By integrating both time-domain and frequency-domain representations, CS-LSTMs achieve more accurate modeling of periodic trends and anomaly localization. Extensive evaluations on public benchmark datasets demonstrate that CS-LSTMs consistently outperform state-of-the-art methods, highlighting their effectiveness and practical value in robust time series anomaly detection.

Figures (10)

• Figure 1: Anomaly types: (a), (b) segment anomalies; (c), (d) point anomalies. (a) Abrupt period shortening; (b) Unexpected trend drop; (c) Global outlier; (d) Contextual outlier within range but locally deviant.
• Figure 2: Two anomaly types existing methods fail to detect. Normal points are shown in black, detected anomalies in blue, and undetected anomalies in red. (a) smaller point anomaly; (b) gradual rising segment anomaly.
• Figure 3: Point anomalies at different scales. Normal points are black; anomalies are red. In (a), a value of 0.5 is anomalous due to the smooth background, while in (b), only a value around 5 is considered anomalous amid larger fluctuations. The key lies in context sensitivity.
• Figure 4: Periodicity visualization in Yahoo and WSD. Time series are shifted and overlaid using different colors. Stronger overlap indicates stronger periodicity; reduced overlap over time suggests periodic changes.
• Figure 5: Architecture of CS-LSTMs.