Journal Article
Machine Learning

DeepAnT: A Deep Learning Approach for Unsupervised Anomaly Detection in Time Series

Mohsin Munir(University of Kaiserslautern), Shoaib Ahmed Siddiqui(University of Kaiserslautern), Andreas Dengel(University of Kaiserslautern), Sheraz Ahmed(German Research Centre for Artificial Intelligence)
December 19, 2018IEEE Access660 citations
PDFDOI

660

Citations

39

Influential Citations

IEEE Access

Venue

2018

Year

Abstract

Traditional distance and density-based anomaly detection techniques are unable to detect periodic and seasonality related point anomalies which occur commonly in streaming data, leaving a big gap in time series anomaly detection in the current era of the IoT. To address this problem, we present a novel deep learning-based anomaly detection approach (DeepAnT) for time series data, which is equally applicable to the non-streaming cases. DeepAnT is capable of detecting a wide range of anomalies, i.e., point anomalies, contextual anomalies, and discords in time series data. In contrast to the anomaly detection methods where anomalies are learned, DeepAnT uses unlabeled data to capture and learn the data distribution that is used to forecast the normal behavior of a time series. DeepAnT consists of two modules: time series predictor and anomaly detector. The <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">time series predictor</i> module uses deep convolutional neural network (CNN) to predict the next time stamp on the defined horizon. This module takes a window of time series (used as a context) and attempts to predict the next time stamp. The predicted value is then passed to the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">anomaly detector</i> module, which is responsible for tagging the corresponding time stamp as normal or abnormal. DeepAnT can be trained even without removing the anomalies from the given data set. Generally, in deep learning-based approaches, a lot of data are required to train a model. Whereas in DeepAnT, a model can be trained on relatively small data set while achieving good generalization capabilities due to the effective parameter sharing of the CNN. As the anomaly detection in DeepAnT is unsupervised, it does not rely on anomaly labels at the time of model generation. Therefore, this approach can be directly applied to real-life scenarios where it is practically impossible to label a big stream of data coming from heterogeneous sensors comprising of both normal as well as anomalous points. We have performed a detailed evaluation of 15 algorithms on 10 anomaly detection benchmarks, which contain a total of 433 real and synthetic time series. Experiments show that DeepAnT outperforms the state-of-the-art anomaly detection methods in most of the cases, while performing on par with others.

Analysis

Why This Paper Matters

Time series anomaly detection is critical in IoT, finance, and industrial monitoring, but traditional distance- and density-based methods fail to capture periodic and seasonal anomalies common in streaming data. DeepAnT addresses this gap by leveraging deep learning to model normal temporal patterns without requiring labeled anomalies, which is a major practical advantage. Its ability to train on small datasets and generalize well makes it particularly relevant for real-world deployments where data is scarce or expensive to label.

The paper also tackles a broader challenge: unsupervised anomaly detection in non-stationary time series. By using a CNN predictor that learns the data distribution from unlabeled data, DeepAnT avoids the need for anomaly labels during training, a key limitation of many prior methods. This aligns with the growing demand for self-supervised and unsupervised approaches in AI.

Technical Contributions

  • Two-module architecture: A CNN-based time series predictor forecasts the next time stamp from a context window, and an anomaly detector compares the prediction to the actual value to flag anomalies.
  • Unsupervised training: The model learns normal behavior from unlabeled data, even when anomalies are present in the training set, without requiring manual removal.
  • CNN parameter sharing: Enables effective learning from relatively small datasets, overcoming the typical data hunger of deep learning models.
  • Broad anomaly coverage: Detects point anomalies, contextual anomalies, and discords, covering a wide range of time series anomaly types.

Results

DeepAnT was evaluated on 10 benchmark datasets comprising 433 real and synthetic time series, comparing against 15 state-of-the-art anomaly detection algorithms. The experiments show that DeepAnT outperforms competitors in most cases and performs on par in others. Specific metrics (e.g., F1-score, precision, recall) are not detailed in the abstract, but the claim of superiority is supported by the large-scale evaluation.

Significance

DeepAnT advances the field by providing a practical, unsupervised deep learning solution for time series anomaly detection that works with small datasets and does not require labeled anomalies. This is particularly impactful for IoT and streaming applications where labeling is impractical. The approach also demonstrates the effectiveness of CNNs for time series prediction, encouraging further exploration of convolutional architectures for temporal data. Its success on diverse benchmarks suggests broad applicability across domains such as sensor monitoring, finance, and cybersecurity.

deep-learningtime-seriesanomaly-detectionunsupervised-learningcnniotstreaming-data
BenchmarksNeural Networks

Related Papers