Temporal-Conditioned Normalizing Flows for Multivariate Time Series Anomaly Detection

Abstract

This paper introduces temporal-conditioned normalizing flows (tcNF), a novel framework that addresses anomaly detection in time series data with accurate modeling of temporal dependencies and uncertainty. By conditioning normalizing flows on previous observations, tcNF effectively captures complex temporal dynamics and generates accurate probability distributions of expected behavior. This autoregressive approach enables robust anomaly detection by identifying low-probability events within the learned distribution. We evaluate tcNF on diverse datasets, demonstrating good accuracy and robustness compared to existing methods. A comprehensive analysis of strengths and limitations and open-source code is provided to facilitate reproducibility and future research.

Figures (9)

• Figure 1: Forward propagation of one coupling layer from the base distribution to the data distribution.
• Figure 2: Overview of a temporal-conditioned coupling layer, drawn as normalization (reverse process) of the data distribution $\boldsymbol{u}_{2,t} = \boldsymbol{g}(\boldsymbol{x}_{1,t}, \boldsymbol{w}_t)$. We drop the coupling layer index $i = 1,\dots,N$ and the time index $t$ from $\boldsymbol{x}_{i,t}$ and $\boldsymbol{u}_{i,t}$ whenever it is clear from the context. The diagram illustrates how the conditioning information (red arrows) is added to the conditioner function expressed as $\boldsymbol{w}_t$. After one such transformation, it is required to swap the two slices, such as $\boldsymbol{x}_{2,t}^{1:d} = \boldsymbol{u}_{2,t}^{d+1:D}$ and $\boldsymbol{x}_{2,t}^{d+1:D} = \boldsymbol{u}_{2,t}^{1:d}$, to achieve a full coupling of the input as the next $\boldsymbol{x}_t$ of the following layer.
• Figure 3: Comparison of anomaly detection performance on the FSB benchmark using AUC (top) and VUS (bottom) sorted by average performance on the AUC metric. The results demonstrate the competitive performance of the proposed tcNF models compared to established baselines, particularly in terms of RealNVP dinh_density_2017 as the unchanged baseline method.
• Figure 4: The first row shows the training sequences and the latent representation to the right. The second row contains the test sequence with no clearly visible anomaly in the sequence to the human eye. The latent representation to the right clearly shows one out-of-distribution point as indicated by the red triangle. The anomaly in this case is a sudden jump in one timestep, as marked by the anomaly label in the third row, and is based on the standard deviation of the values in the 10 previous timesteps. Both latent space representations indicate that the model captured the sequence behavior, and only noise remains.
• Figure 5: The parameter search in this case highlights that a rather extensive access to previous datapoints is important, which correlates with an increased model capacity, such as $\Theta(\cdot)$ multiplier and $\Theta(\cdot)$ layers in each coupling layer.