When Model Meets New Normals: Test-time Adaptation for Unsupervised Time-series Anomaly Detection

Introduction

In recent developments within the field of monitoring systems that rely on time-series data, the ability to pinpoint anomalous events is vital to maintaining integrity across various domains, from industrial systems to cybersecurity. Time-series anomaly detection is the cornerstone of these efforts – a discipline centered on identifying incongruous data points within sequential data. Among the challenges faced, the most perturbing is the evolving concept of normality, often leading to a phenomenon known as the "new normal problem." Models trained on historical data struggle to adapt when the data distribution changes at test time – a serious concern that can lead to false alarms and reduced reliability of the detection systems.

New Normal Problem

Addressing the new normal problem requires consideration of the shift in the data distribution between the training and testing phases. Existing unsupervised anomaly detection models, such as MLP-based autoencoders, LSTM architectures, and others, have shown limitations in the face of distribution shifts. They falter by rigidly adhering to historical data, proving deficient in recognizing and adapting to contemporary normal patterns, which diminishes their efficacy considerably when confronted with distribution shifts.

Model Adaptation Strategies

To combat these challenges, the paper introduces a novel test-time adaptation strategy. The approach encompasses two key components: first, a trend estimation which uses an exponential moving average to adapt to current data trends, and second, a self-supervised learning process during inference that refines the model to discern new normal patterns. This self-updating mechanism ensures that the anomaly detection system remains attuned to the current data distribution without the need for explicit retraining or additional labeled data.

Experimental Validation

The methodology was subjected to rigorous testing across various datasets that encapsulate real-world distribution shifts. The experimental results present a compelling case for the proposed approach. It enhances the performance of baseline models, delivers robustness against distribution shifts, and demonstrates discernible improvements in key performance metrics such as F1 score, AUROC, and AUPRC. Notably, the approach shines in scenarios with marked distribution shifts, exhibiting substantial gains over state-of-the-art anomaly detectors.

Final Remarks

In summation, this work takes on the non-trivial new normal problem in unsupervised time-series anomaly detection, offering an elegant solution through a merge of trend estimation and a self-adaptive learning method. The approach's scalability and effectiveness, as confirmed by extensive empirical evidence, position it as a compelling advancement in the adaptability of anomaly detectors, ensuring operational consistency in an ever-evolving landscape of time-series data.