Bridging Classification and Reconstruction: Cooperative Time Series Anomaly Detection

The evolution of time series anomaly detection has transitioned from classical statistical methods like ARIMA and control charts to machine learning algorithms such as clustering and support vector machines. Recently, deep learning models like LSTM, Transformer, and autoencoders have gained prominence due to their ability to model complex temporal dependencies. Despite these advances, challenges remain in detecting subtle, long-duration, and unforeseen anomalies, especially in noisy real-world data. Traditional data mining techniques like Matrix Profile and KShape excel in specific scenarios but lack adaptability. The current research landscape emphasizes hybrid models combining deep learning with domain knowledge, aiming to improve robustness and generalization.

Existing deep learning methods often fail to detect subtle or prolonged anomalies due to overfitting to known patterns or poor generalization. Methods relying solely on classification (OE) are limited by their dependence on predefined anomaly types, leading to poor detection of unseen anomalies. Conversely, reconstruction-based approaches (MAE) suffer from masking misalignment, where normal and anomalous regions are masked indiscriminately, reducing detection accuracy. The core challenge is designing a unified framework that leverages the strengths of both paradigms while mitigating their weaknesses, enabling accurate detection of complex, unseen anomalies in large-scale, real-time streams.

The paper introduces several key innovations: 1) Probabilistic soft masking guided by a classification module, dynamically suppresses anomalous cues during reconstruction. 2) Dual-branch time-frequency classification captures both temporal and spectral features, improving detection of complex anomalies. 3) Residual-based classification leverages differences between original and reconstructed data, enhancing generalization to unseen anomalies. 4) End-to-end training ensures synergy between modules, optimizing detection accuracy and efficiency. These innovations collectively address the limitations of prior methods, enabling robust, scalable anomaly detection.

• �� Input: raw time series segmented into overlapping windows. • Simulate anomalies via distortions like uniform replacement, mirror flip, jittering, and length scaling. • Divide windows into non-overlapping patches; embed via linear layers. • Train a dual-branch classifier: one branch applies STFT for frequency features, the other processes raw patches. • Generate anomaly probabilities per patch from each branch, fuse via max operation. • Use probabilities to create soft masks, blending learnable mask embeddings with raw patches. • Feed masked patches into MAE for reconstruction, producing normal references. • Compute residuals between original and reconstructed patches, extract features for residual classification. • Jointly optimize classification and reconstruction losses during training. • During inference, use classifier probabilities to guide masks, reconstruct normal patterns, and detect anomalies based on residuals.

Datasets include MUTIC, SWaT, and NAB, evaluated with AUC and F1-score. Baselines encompass DeepAnomaly, USAD, and Transformer-based models. Hyperparameters tuned via grid search; ablation studies conducted to assess each component. Cross-validation ensures robustness. Experiments test detection of subtle, long-term, and unseen anomalies, with additional analysis on computational efficiency. Results demonstrate superior performance and real-time capability, confirming the framework's practical value.

CoAD achieves an AUC of 92.3% on MUTIC, outperforming the best baseline by over 6%. On SWaT and NAB, it reduces false alarms by 30%, with detection accuracy significantly improved for subtle anomalies. Ablation shows soft masking and dual channels are critical. The model maintains high performance in unseen anomaly scenarios, confirming its robustness and generalization. Speed tests indicate it runs three times faster than existing SOTA, suitable for large-scale deployment.

Ideal for industrial equipment monitoring, financial fraud detection, and network security, where early anomaly detection prevents costly failures. Its lightweight design allows deployment on edge devices, enabling real-time alerts. The framework requires only raw time series data, making it adaptable across domains. Its high accuracy and speed make it a valuable tool for automated, continuous monitoring systems.

Dependence on predefined anomaly patterns limits detection of completely novel anomalies. Sensitivity to noisy data may affect probability estimates and mask effectiveness. Scalability to ultra-large data streams needs further optimization. Future work should focus on unsupervised learning and adaptive models to address these issues.