VAN-AD: Visual Masked Autoencoder with Normalizing Flow For Time Series Anomaly Detection

Abstract

Time series anomaly detection (TSAD) is essential for maintaining the reliability and security of IoT-enabled service systems. Existing methods require training one specific model for each dataset, which exhibits limited generalization capability across different target datasets, hindering anomaly detection performance in various scenarios with scarce training data. To address this limitation, foundation models have emerged as a promising direction. However, existing approaches either repurpose large language models (LLMs) or construct largescale time series datasets to develop general anomaly detection foundation models, and still face challenges caused by severe cross-modal gaps or in-domain heterogeneity. In this paper, we investigate the applicability of large-scale vision models to TSAD. Specifically, we adapt a visual Masked Autoencoder (MAE) pretrained on ImageNet to the TSAD task. However, directly transferring MAE to TSAD introduces two key challenges: overgeneralization and limited local perception. To address these challenges, we propose VAN-AD, a novel MAE-based framework for TSAD. To alleviate the over-generalization issue, we design an Adaptive Distribution Mapping Module (ADMM), which maps the reconstruction results before and after MAE into a unified statistical space to amplify discrepancies caused by abnormal patterns. To overcome the limitation of local perception, we further develop a Normalizing Flow Module (NFM), which combines MAE with normalizing flow to estimate the probability density of the current window under the global distribution. Extensive experiments on nine real-world datasets demonstrate that VAN-AD consistently outperforms existing state-of-the-art methods across multiple evaluation metrics.We make our code and datasets available at https://github.com/PenyChen/VAN-AD.

Figures (7)

• Figure 1: Examples of the over-generalization and local-perception issues of MAE in TSAD on the PSM dataset. The red background indicates anomalous segments. Fig. \ref{['fig:over_generalization']} illustrates the over-generalization problem of MAE: both anomalous and normal sequences can be reconstructed well, resulting in similarly low anomaly scores. Fig. \ref{['fig:local_perception']} illustrates the local-perception issue of MAE. When the current window is fully occupied by an anomalous segment, the variations within the window often fail to reflect abnormal behavior, leading to a low anomaly score.
• Figure 2: The overall architecture of VAN-AD. (1) Forward Module: transforms the input time series into a format compatible with MAE. (2) Reconstruction Module: generates a pair of complementary masked images using the Checkerboard Mask strategy, and reconstructs the masked regions through MAE to obtain the reconstructed time series. (3) ADMM: maps the reconstructed sequence into the statistical space of the original sequence to amplify reconstruction discrepancies. (4) NFM: applies normalizing flow to the reconstructed sequence to model the probability density of the current window.
• Figure 3: Backbone analysis of MAE variants with different model sizes (base, large, and huge), evaluated by A-R and V-R.
• Figure 4: Density modeling analysis evaluated by A-R and V-R. The compared methods include VAN-AD, MTGFLOW, and GANF.
• Figure 5: Parameter sensitivity studies of main hyper-parameters in VAN-AD.