Multivariate anomalies detection

[AyumiTPK]

Thank you for working on this amazing tool.

I am looking for a benchmarking pipeline framework to compare different models and saw that UCR anomaly archive is included in dtaianomaly as a default dataset. Is it possible to use dtaianomaly for multivariate anomaly detection if custom datasets are added?

Thank you. Best, Ayumi

[AyumiTPK]

I believe I found your answer here. Thank you again!

Multivariate wrapper for anomaly detection.

Wraps around existing anomaly detectors to detect anomalies in multivariate
time series. This is done by detecting anomalies in each attribute independently.
This approach lifts univariate models to the multivariate setting. In addition,
methods which detect anomalies using a multivariate sliding window (e.g., all
``PyODAnomalyDetector``) receive a lot of input features. The ``MultivariateDetector``
limits the amount of input features, which may improve the performance.

Note that each feature is handled independently, which makes it impossible
to detect anomalies based on the relation of multiple attributes.

[LouisCarpentier42]

Hi Ayumi,

Thank you for your interest in dtaianomaly!

Indeed, the tool can be used for both univariate and multivariate time series. By default most anomaly detectors can handle multivariate time series. Only a few methods (such as KShapeAnomalyDetector and MedianMethod) can not.

As you pointed out, it is possible to extend any anomaly detector to multivariate time series through the MultivariateDetector. You can pass any detector to this wrapper, including models that natively support multivariate time series. However, note that this will lead to different models.

For example, the following model will detect anomalies by considering each multivariate subsequence as a feature vector:

from dtaianomaly.anomaly_detection import IsolationForest
detector = IsolationForest(window_size=16)

Passing this exact model to the MultivariateDetector, however, will apply the isolation forest to each attribute, using univariate subsequences as inputs, after which the anomaly scores for each attribute are combined:

from dtaianomaly.anomaly_detection import IsolationForest, MultivariateDetector
detector = MultivariateDetector(IsolationForest(window_size=16), aggregation ="max")

Using the MultivariateDetector can thus not detect any anomalies in the correlation of attributes, but generally performs better in high-dimensional time series because of smaller input features.

Kind regards,
Louis

[AyumiTPK]

Hi Louis,

Thank you for your detailed response. Much appreciated!

I was wondering if it might be possible to extend this library to include additional foundation models, such as TimesFM, TTM, and Moirai v2. I am currently working on multiple anomaly detection projects and exploring tools. Given the exploratory nature of these research projects, they should involve testing foundation models before selecting the best-performing one. I believe adding these models could benefit other users as well. Thank you in advance for considering this!

Best regards,
Ayumi

[LouisCarpentier42]

Hi Ayumi,

We are indeed working on foundation models, and integrating them in dtaianomaly. At this point, we are looking into integrating these models in the tool, but we do not have a defined timeline for doing so. Specifically, we are looking int Chronos [1] , MOMENT [2] and Time-MoE [3]. However, we are open to also add the models you mention to dtaianomaly. If you have an implementation to these, we would be happy to include your models in our toolbox. Feel free to open a pull request (contributing guidelines), in which you implement one or more of those models (example of implementing a dtaianomaly detector).

Kind regards,
Louis

[1] Ansari, Abdul Fatir, et al. "Chronos: Learning the language of time series." arXiv preprint arXiv:2403.07815 (2024).
[2] Goswami, Mononito, et al. "Moment: A family of open time-series foundation models." arXiv preprint arXiv:2402.03885 (2024).
[3] Shi, Xiaoming, et al. "Time-moe: Billion-scale time series foundation models with mixture of experts." arXiv preprint arXiv:2409.16040 (2024).