1 Introduction↩︎

Time Series Anomaly Detection (TSAD) serves as a critical component in modern IT infrastructure [1], [2] and manufacturing systems [3], [4], enabling rapid identification of potential anomalies and providing sufficient clues for fault localization [5], [6]. The emergence of deep learning-based forecasting approaches [7]–[9] have superseded traditional rule-based methods [10], [11], establishing new state-of-the-art performance through their capacity to fit historical data and detect anomalies via prediction-observation comparisons.

However, the effectiveness of the forecasting-based approach declines when encountering time series with localized disturbances. As illustrated in 1, time series data frequently exhibit local peaks and drops that can significantly impact model learning. deep learning methods [8], [12] often overfit to these local disturbances, compromising their ability to detect anomalies effectively. From the third column of 2, we can observe that compared to training with clean data, TimesNet [8] trained on noisy data fails to detect anomalies in the samples.

To achieve formulation, Kolmogorov-Arnold Networks (KANs) [13] offer a promising direction by decomposing complex objectives into combinations of learnable univariate functions based on the Kolmogorov-Arnold representation theorem [14]. This decomposition approach has shown remarkable effectiveness in various domains [15], [16]. However, direct application of KAN to TSAD presents significant challenges. From the upper part of 2, it can be observed that models trained on clean training samples can detect anomalies in the test samples. But we find that KAN fails to detect anomalies when the training samples contain noisy samples . The main reason is that, although KAN can specify univariate functions, these functions are not specifically designed for time series and can still overfit local features, failing to completely eliminate the impact of local peaks or drops.

To address these challenges, we propose , adopting KAN as our backbone. By considering the characteristics of time series, we redesign KAN in three aspects. First, we replace the B-spine function with Fourier series. Second, as the Fourier series contains unlimited terms which is computation intensive, we only use the first \(N\) terms of Fourier series. To overcome the limitation that the first N terms of Fourier series can only model periodic no smaller than \(\frac{1}{N}\), we designed an alternative index-based univariate function to capture the fine-scale periodic missing from the first N terms.

Our comprehensive evaluation demonstrates that KAN-AD achieves 15% higher F1 accuracy while being 50% faster than the original KAN architecture. Our code is publicly available at https://github.com/CSTCloudOps/KAN-AD. Our contributions are as follows:

• We reformulate the problem to assist deep learning-based forecasting models for time series anomaly detection (TSAD) tasks by minimizing overfitting to local perturbations.

• We introduce , an innovative TSAD approach. KAN-AD, built meticulously on the KAN backbone, .

• We performed comprehensive experiments on four publicly available datasets, verifying the effectiveness and efficiency against state-of-the-art TSAD benchmarks.

2 Preliminaries and Problem Formulation↩︎

2.1 Problem Statement↩︎

This paper primarily addresses the issue of anomaly detection in single time series curves, also known as univariate time series (UTS). To elaborate on the problem more comprehensively, consider the following UTS observational data: \(x_{0:t} = \{ x_0, x_1, x_2, \dots, x_t \}\) and anomaly labels \(C = \{ c_0, c_1, c_2, \dots, c_{t}\}\), where \(x_t \in \mathbb{R}\), \(c \in \{0, 1\}\), and \(t \in \mathbb{N}\). Here, \(x_{0:t}\) represents the entire observed time series, and \(C\) denotes the temporal anomaly labels.

Given a UTS \(x=[x_0,x_1,x_2,\dots,x_t]\), the objective of UTS anomaly detection is to utilize the data \([x_0,x_1,\dots,x_i]\) preceding each point \(x_i\) to predict \(c_i\).

2.2 Kolmogorov–Arnold Networks↩︎

2.2.1 Theoretical Foundation↩︎

The Kolmogorov–Arnold representation theorem demonstrates that any multivariate continuous function can be decomposed into a finite sum of univariate functions, as shown in 1 , where \(\varphi_{q,p}\) are univariate functions that map each input variable \(x_p\), and \(\Phi_q\) are continuous functions. \[\begin{align} f(x_1,x_2,\dots,x_n)&=\sum_{q=1}^{2n+1}\Phi_q(\sum_{p=1}^n\varphi_{q,p}(x_p)) \tag{1} \\ \text{KAN}(x) & = (\Phi_{L-1} \circ \Phi_{L-2} \circ \dots \circ \Phi_0)(x) \tag{2} \end{align}\]

2.2.2 Network Architecture and Function Representation↩︎

KAN consists of a series of interconnected univariate sub-networks, each responsible for learning distinct features of the data. Unlike traditional multi-layer perceptrons (MLPs), which employ fixed activation functions at each node, KAN replaces each weight parameter with a univariate function. The resulting functional form for deeper KAN can be expressed as 2 , where each \(\Phi_l\) represents a layer of univariate functions applied to the input or intermediate outputs. The vanilla KAN [13] implements these univariate functions using B-splines [17], which provide localized function approximation capabilities. However, this localization property presents a notable consideration in anomaly detection contexts. Since anomalous patterns typically manifest as localized features [7], B-splines may inadvertently fit these outliers, potentially compromising model accuracy.

3 Methodology↩︎

3.1 Design of↩︎

\[\begin{align} f(x_{0:i}) = A_0 & + \underbrace{\sum_{n=1}^{N}{\left(A_n \cos(nx_{0:i}) + B_n \sin(nx_{0:i})\right)}}_{g(x_{0:i})} + \epsilon \label{agn:fourier-formula} \end{align}\tag{3}\] \[\begin{align} &\mathbf{H} = \mathsf{Stack}( \cos(x_{0:i}),\sin(x_{0:i}),\dots,\cos(nx_{0:i}),\sin(nx_{0:i}) ) \notag \\ &\mathbf{\Theta} (x_{0:i}) = \begin{bmatrix}A_1,B_1,A_2,B_2,\dots,A_n,B_n\end{bmatrix} \nonumber \\ & x'_{0:i} = A_0 + \mathbf{\Theta}(x_{0:i}) \times \mathbf{H} \label{agn:fan-formula} \end{align}\tag{4}\]

3.2 Mapping Phase↩︎

As shown in 3 (b), the primary purpose of the mapping phase is to transform the original time series signal \(x_{0:i} \in \mathbb{R}^{T}\) into multiple new sets of values \(x_{0:i} \in \mathbb{R}^{T \times (N+N)}\) through a series of univariate functions. Here, \(T\) is the size of the sliding window. The first \(N\) represents the number of sine series univariate functions, and the other \(N\) represents the number of cosine series univariate functions. The detailed calculation method is shown in 3 . Notably, besides the univariate function terms, an \(A_0\) term representing the average value within the sliding window is also present, which varies across different windows. To mitigate the impact of fluctuating \(A_0\) on coefficient fitting, a constant term elimination module is employed.

Constant Term Elimination: In Fourier series, \(A_0\) represents the mean value of the function. Although normalization ensures that the entire time series has a mean of zero, individual time windows may still exhibit significant fluctuations in their means due to the presence of a trend. These variations in the constant term ultimately affect the model’s accurate estimation of Fourier coefficients, leading to biases in the construction of the normal pattern.

To mitigate the impact of mean fluctuations on the model’s approximation of normal time series patterns, we employ first-order differencing during data preprocessing to minimize the residual trend component in the data and subsequently renormalize the differenced data. This strategy allows the model to focus on estimating Fourier coefficients \(A_{1:n}\) and \(B_{1:n}\), thereby avoiding the need to learn frequently changing constant terms. After this differential strategy, the normal pattern \(x'_{0:i}\) can be expressed as \(x'_{0:i} \sim \mathbf{\Theta}(x_{0:i}) \times \mathbf{H}\)

Periodic-Enhanced :

To address this limitation and enhance the model’s ability to capture periodic patterns in time series, we introduce additional univariate functions with different periods. Specifically, we incorporate trigonometric components \(\cos(\frac{2\pi ni}{T})\) and \(\sin(\frac{2\pi ni}{T})\) where \(i\) denotes the window index, with coefficients learned through one-dimensional convolution networks. Our implementation utilizes three complementary univariate functions shown in 5 : the raw time variable \(X\), the Fourier series \(S_n\), and the sine-cosine wave \(P_n\). This integration of multi-periodic univariate functions enhances ’s capacity to model temporal patterns. \[\begin{align} \mathrm{X}\; &= x_{0:i} \notag \\ \mathrm{S_n} &= \{\sin(nx_{0:i}), \cos(nx_{0:i})\} \label{agn:feature-set} \\ \mathrm{P_n} &= \{\sin(\frac{2\pi ni}{T}), \cos(\frac{2\pi ni}{T})\} \notag \end{align}\tag{5}\]

3.3 Reducing Phase↩︎

Another challenge in real-world time series anomaly detection is the high computational cost. Existing methods often sacrifice efficiency for accuracy, making them impractical in resource-constrained or large-scale settings.

\[\begin{align} &\mathbf{H}^{(0)} {=} \mathsf{Stack}(X, S_1, P_1, \dots, S_n, P_n), \forall n {\in} \left [1,\dots,N \right] \tag{6} \\ &\mathbf{H}^{(l)} = \mathsf{CNN}(\mathsf{CNN}(\mathbf{H}^{(l-1)})) \quad \forall l\in [1,2,\dots, L]\tag{7} \\ &\mathsf{Conv}(\mathbf{H}) = \sum_{c=1}^{2N} \sum_{m=0}^2 W_c[m]\cdot \mathbf{H}_c[i+m-1] \tag{8} \\ &\mathsf{CNN}(\mathbf{H}) = \mathsf{GELU}(\mathsf{BN}(\mathsf{Conv}(\mathbf{H}))) \tag{9} \end{align}\]

To effectively estimate these univariate function coefficients, we employ a stacked one-dimensional convolutional neural network (1D CNN). This architecture choice is motivated by two key factors: 1D CNNs excel at sequence modeling through temporal dimension traversal, while their convolutional kernels naturally capture the diverse features introduced by the  mechanism. As shown in 6 , first constructs a univariate function matrix \(\mathbf{H}^{(0)}\) by combining the required functions for a given time window. This matrix is then processed through multiple stacked 1D convolutional layers with a kernel size of 3, progressively approximating the normal pattern through coefficient learning, as expressed in 7 . Here, \(L\) denotes the number of CNN blocks, with the network \(\mathsf{CNN}(\mathbf{H})\) and convolution operation \(\mathsf{Conv}(\mathbf{H})\) defined in [agn:single-layer,agn:conv]. The convolution operation in 8 applies a kernel \(W_c\) to each channel \(\mathbf{H}_c\), where indices \(m\) and \(t\) represent positions within the convolutional kernel and time window, respectively.

To ensure training stability and reduce internal covariate shift, we apply batch normalization [18] after each convolutional layer (9 ), followed by Gaussian Error Linear Units (GELUs) [19] for activation. The final stage of the reducing phase employs a residual connection [20] between the hidden state \(\mathbf{H}^{(L)}\) and the original input \(\mathbf{H}^{(0)}\) to maintain numerical stability, as shown in 10 . Finally, a 1-width convolutional kernel reduces the dimensionality of \(\mathbf{H}^{(L)'}\) to generate the normal pattern approximation \(x'_{0:i}\) within the current time window: \[\begin{align} \mathbf{H}^{(L)'} =\;& \mathbf{H}^{(L)} + \mathbf{H}^{(0)} \tag{10}\\ x'_{0:i} =\;& \mathsf{GELU}(\mathsf{BN}(\mathsf{DownConv}(\mathbf{H}^{(L)'})) \tag{11} \end{align}\] Here, \(\mathsf{DownConv}(\mathbf{H}) =\sum_{c=1}^{2N} W_c\cdot\mathbf{H}_c[i]\) denotes the convolution operation for reducing dimensions.

3.4 Projection Phase↩︎

After obtaining the current window’s normal mode approximation \(x'_{0:i}\), we predict the future behavior \(x_{i+1}\) through a linear layer, leveraging ’s accurate approximation capability: \[x_{i+1} = W \cdot x'_{0:i} + b\] where \(W\) and \(b\) denote the weight matrix and bias term of the linear layer.

4 Evaluation↩︎

In this section, we conduct comprehensive experiments primarily aimed at answering the following research questions.

RQ1: How does compare to state-of-the-art anomaly detection methods in performance and efficiency? RQ2: How sensitive is to hyperparameters? RQ3: How effective is each design choice in ? RQ4: How sensitive is to anomalies in the training data?

In addition, we also evaluate our method on a multivariate time series anomaly detection dataset to demonstrate the application potential of in more scenarios.

4.1 Experimental settings↩︎

4.1.1 Dataset↩︎

We evaluate on four publicly available UTS datasets: KPI [21], TODS [22], WSD [23], and UCR [24]. Dataset characteristics are summarized in 1, including curve counts, sizes, and anomaly rates. The anomaly interval length distributions, shown in 6, reveal that while most anomalies span less than 10 points, WSD and UCR contain extended anomaly segments exceeding 300 points, enabling comprehensive evaluation. Detailed dataset descriptions are provided in 7.1.

4.1.2 Model training and inference↩︎

We implement a systematic experimental protocol for both our method and baseline approaches. For each time series, we train dedicated models using consistent hyperparameters: batch size 1024, learning rate 0.01, and maximum 100 epochs. The validation strategy varies by dataset, with UCR reserving 20% of training data and other datasets employing a 4:1:5 ratio for training, validation, and testing splits. To ensure fair comparison, we faithfully replicate all baseline methods following their original implementations and hyperparameter settings as specified in their respective papers. During inference, we standardize the batch size to 1 across all methods for comparable efficiency assessment. Results presented in 2 report means and standard deviations from five independent trials with different random seeds.

4.1.3 Baselines↩︎

0.5em -1em

We conducted comparative experiments with ten state-of-the-art time series anomaly detection methods: LSTMAD [25], FCVAE [26], SRCNN [27], FITS [28], TimesNet [8], OFA [9], TranAD [12], SubLOF [10], Anomaly Transformer [7] (abbreviated as AnoTrans in the tables), KAN [13] and SAND [29]. Detailed descriptions of these methods can be found in 7.2. For datasets not featured in the baseline literature, we meticulously tuned hyperparameters via grid search to optimize the performance of the baseline method on the respective evaluation metrics.

4.1.4 Evaluation metrics↩︎

In practical applications, operations teams are less concerned with point-wise anomalies (i.e., whether individual data points are classified as anomalous) and more focused on detecting sustained anomalous segments within time series data. Furthermore, due to the potential impact of such segments, early identification is crucial. Previous work [30] proposed the Best F1 metric, which iterates over all thresholds and applies a point adjustment strategy to calculate the F1 score. However, it has been criticized for performance inflation [22], [24].

To address this, we also adopt Delay F1 [27] and Event F1. Delay F1 is similar to Best F1 but uses a delay point adjustment strategy. As shown in 4, the second anomaly was missed because the detection delay exceeded the threshold of five time intervals. In all experiments, a delay threshold of five was used across all datasets. Event F1, on the other hand, treats anomalies of varying lengths as anomalies with a length of 1, minimizing performance inflation caused by excessively long anomalous segments. For the sake of convenience, unless otherwise stated, we use Event F1 as the primary metric, as it is more alignment with the need for real-time anomaly detection in real-world situations.

4.2 RQ1. Performance and Efficiency Comparison↩︎

We present a comprehensive evaluation of across multiple time series anomaly detection (TSAD) experiments, with results summarized in 2. Our analysis focuses on three key dimensions: detection accuracy, model efficiency, and computational requirements.

Across diverse experimental settings, KAN-AD demonstrates consistent and robust performance advantages. In the TODS dataset, where training data contains a substantial proportion of anomalies, significantly outperforms SOTA by 27% on Event F1, highlighting its robust learning capabilities in handling noisy training data. For datasets exhibiting strong periodic characteristics (WSD and KPI), achieves comparable or superior performance relative to state-of-the-art approaches. Even in the challenging UCR dataset scenario, where the training set lacks anomaly samples and contains significant periodic variations, effectively captures normal patterns, whereas baseline methods show reduced effectiveness in pattern recognition. Quantitatively, achieves more than a 15% improvement in average Event F1 score compared to existing state-of-the-art methods.

The computational efficiency analysis, presented in 3, reveals another distinctive advantage of . We note that several baseline methods are excluded from this comparison due to implementation constraints: SAND’s CPU-only execution requirement and SubLOF’s limited multi-core utilization capabilities preclude fair comparison in modern hardware acceleration contexts. Among the other models, we observe a wide spectrum of model complexities, with parameter counts ranging from millions to hundreds. Large-scale models like OFA utilize 81.92M parameters, while established approaches such as Anomaly Transformer, FCAVE, and TimesNet employ between 73k and 4.75M parameters. In contrast, achieves competitive performance with remarkable efficiency, requiring only 274 parameters, a 25% reduction compared to TranAD, the next most compact model in our comparison.

These empirical findings underscore ’s exceptional efficiency-performance in TSAD tasks. By achieving state-of-the-art or near state-of-the-art performance while significantly reducing the parameter footprint, demonstrates the effectiveness of our design principles in creating efficient, practical solutions. This combination of high detection accuracy and minimal computational requirements positions as an ideal choice for resource-constrained or cost-sensitive deployment scenarios, offering a compelling balance between model complexity and detection capabilities.

4.2.1 Case Study↩︎

We analyzed anomaly detection performance on UCR dataset samples to illustrate how various methods respond to identical anomalies, as shown in 5. The selected sample displayed pattern anomalies, marked by significant deviations from typical behavior. Both TranAD and TimesNet exhibit difficulty establishing normal patterns. Minor variations among normal samples across cycles lead to periodic false alarms during normal segments, consistent with our observations in 2. Among the methods listed, while OFA, LSTMAD, SubLOF, and FITS can detect anomalies, their high anomaly scores during normal segments indicate excessive sensitivity to minor fluctuations in normal data. In contrast, excels in identifying anomalies while maintaining minimal anomaly scores during normal segments.

4.3 RQ2. Hyperparameter sensitivity↩︎

The model incorporates two key hyperparameters: the number of terms in univariate functions \(N\) and the window size \(T\). To investigate the ultimate impact of these parameters on model performance, we conducted experiments on the UCR dataset while holding all other parameters constant. As findings summarized in [fig:hp], a larger window size facilitates more accurate learning of normal patterns when \(N\) is fixed, leading to improved performance. When \(T\) is fixed, insufficient univariate functions limit ’s expressive power, while excessive \(N\) can lead to overfitting. Overall, achieved its best performance with \(T=96\) and \(N=2\). Notably, even with suboptimal hyperparameter settings like \(T=16\) and \(N=1\), we surpassed SOTA methods on the UCR dataset.

4.4 RQ3. Ablation Studies↩︎

In this section, we investigated the impact of constant term elimination modules, different univariate function selections on algorithm performance and the influence of the  mechanism.

4.4.1 Constant term elimination module↩︎

We employed a constant term elimination (CTE) module during data preprocessing to mitigate the influence of the offset term \(A_0\) in 3 . Further experiments were conducted across all datasets to evaluate the impact of incorporating CTE within the preprocessing pipeline. As presented in 7, the impact of CTE varies across datasets, reflecting inherent data characteristics. For datasets with pronounced periodicity or strong temporal stability (e.g., WSD), the benefits of CTE are less apparent. Conversely, for datasets exhibiting larger value fluctuations or trends (e.g., KPI, TODS and UCR), CTE yields significant improvements.

4.4.2 Selection of univariate functions↩︎

we conducted experiments using common univariate functions listed in 4. In our implementations, due to varying input range requirements across univariate functions, appropriate normalization techniques are employed. Specifically, min-max scaling to the range \(x\in[-1, 1]\) was utilized for both types of Chebyshev polynomials, while z-score was employed for Taylor series and Fourier series. The performance of all four univariate functions was compared using the same configuration. As results presented in [fig:basic], Fourier series consistently achieved the top two performance across all datasets. In contrast, Taylor series exhibited persistent bias due to non-zero function values in most cases, hindering optimal model performance. The objective of both types of Chebyshev polynomials is to minimize the maximum error, which potentially conflicts with anomaly detection methods that minimize mean squared prediction error, thus leading to suboptimal performance.

4.5 RQ4. Robustness to Anomalous Data↩︎

To evaluate ’s robustness to anomalies in the training set, we conducted additional experiments using synthetic datasets constructed in accordance with the TODS dataset generation methodology. We synthesized test datasets containing local peaks and drops anomalies, and progressively increased the proportion of these anomalies in the initially anomaly-free training set. As illustrated in [fig:noise-ratio], demonstrates stable performance across all anomaly ratios. Popular methods such as LSTMAD, perform well at lower anomaly ratios but experience a significant decline as the ratio increases. Other approaches, like TranAD, fail to achieve optimal performance due to overfitting to fine-grained structures within the time series.

4.6 Ablation on function deconstruction mechanism↩︎

To investigate the impact of the function deconstruction mechanism, we compared the model’s detection capabilities under different univariate function combination strategies. For clarity, the specific definitions are provided in 5 . As the results presented in 5, the model’s detection performance exhibited a notable improvement with an increasing number of univariate functions. Both Fourier series and cosine waves outperformed the raw input data, likely due to their smoother representations compared to the original signal, enabling higher detection accuracy. The combination of different features, particularly those involving Fourier series and cosine waves, resulted in significant performance gains as the feature count increased. Ultimately, achieved optimal detection performance by integrating all features. It is worth noting that even the variant of utilizing only the raw time series X outperforms KAN, clearly demonstrating the advantage of Fourier series over the use of spline functions for optimizing univariate functions.

4.7 Performance on Multivariate Time Series↩︎

To extend ’s application to the multivariate time series (MTS) scenario, we adopt a channel-independent approach. Specifically, an MTS input with the shape (batch_size, window_length, n_features) is reshaped into (batch_size * n_features, window_length). Each of the n_features channels is thus treated as an independent univariate time series instance. is then applied to these individual series. This channel-independent strategy has proven effective [36]. By adopting a similar principle, can leverage its robust univariate modeling capabilities across all channels of an MTS dataset. The model is trained on the collection of these reshaped univariate instances, allowing it to learn generalized normal patterns.

We implemented MTS versions of in popular time series library [37] and evaluated them on the common SMD [38], MSL [39], SMAP [40], SWaT [41], and PSM [42] datasets. Our evaluation metric uses the Best F1 score which is consistent with the baseline methods. We introduce these datasets and baseline methods in detail in the 8. As detailed in 6, KAN-AD achieves the highest average Best F1 score of 0.9076, across all five benchmark datasets, outperforming all listed SOTA methods. A significant advantage of KAN-AD is its exceptional parameter efficiency. With only 4,491 trainable parameters (measured on MSL), KAN-AD utilizes substantially fewer parameters than all other compared methods.

5 Related Work↩︎

Time Series Forecasting Methods: These methods can be categorized into prediction-based and reconstruction-based methods, both aiming to identify deviations from normal patterns through temporal analysis. Prediction-based methods, like FITS [28] achieves efficient detection through frequency domain analysis with minimal parameters, while LSTMAD [25] leverages LSTM networks [43] to capture complex temporal dependencies. Reconstruction-based approaches, like Donut [30] focus on time series denoising, while FCVAE [26] enhances the VAE [44] framework by incorporating frequency domain information. Recent advances in Transformer architectures have further strengthened reconstruction capabilities: TranAD [12] employs adversarial learning for robust pattern capture, while OFA [9] leverages GPT-2 [45] for modeling complex temporal dependencies.

Pattern Change Detection Methods: These approaches identify anomalies through comparative analysis of current and historical patterns. Early methods, like SubLOF [10] quantify pattern variations using window-based distance metrics. SAND employs temporal shape-based clustering to distinguish anomalous patterns. Recent advances, exemplified by TriAD [5], leverage multi-domain contrastive learning frameworks, demonstrating superior performance on UCR datasets.

6 Conclusion↩︎

Training time series anomaly detection models with datasets containing anomalies is essential for deployment in production environments. Existing algorithms often rely on carefully selected features and complex architectures to achieve minor accuracy gains, neglecting robustness during training. This paper introduces , a robust anomaly detection model rooted in the Kolmogorov–Arnold representation theorem. transforms the prediction of time points into the estimation of coefficients of Fourier series, achieving strong performance with few parameters, significantly reducing costs while enhancing robustness to outliers. includes a constant term elimination module to address temporal trends and leverages frequency domain information for better performance. With , a promising research direction is to explore whether normal patterns in time series can be represented more efficiently by leveraging additional data.

Acknowledgments↩︎

This work was partially funded by the National Key Research and Development Program of China (No.2022YFB2901800), the National Natural Science Foundation of China (62202445), the National Natural Science Foundation of China-Research Grants Council (RGC) Joint Research Scheme (62321166652), and the National Natural Science Foundation of China (Grant No. W2412136).

Impact Statement↩︎

This paper presents work whose goal is to advance the field of Machine Learning. There are many potential societal consequences of our work, none which we feel must be specifically highlighted here.

7 Datasets and Baseliens on Univariate Time Series↩︎

7.1 Datasets↩︎

We selected four datasets from diverse domains, with samples originating from:

• KPI [21]: This dataset comprises service metrics collected from five major Internet companies: Sogou, eBay, Baidu, Tencent, and Alibaba. The data points are primarily recorded every 1-2 minutes, with some sections exhibiting a 5-minute interval.

• TODS [22]: TODS comprises artificially created time series, each designed to present specific types of anomalies. Its excellent interpretability and carefully constructed data distributions make it suitable for in-depth case studies.

• WSD [23]: This dataset consists of web server metrics collected from three companies providing large-scale web services: Baidu, Sogou, and eBay.

• UCR [24]: This archive contains data from multiple domains with a single anomalous segment on each time series. In addition to real anomalies, UCR also includes synthetic but highly plausible anomalies.

• NAB [46]: We utilize the Twitter dataset within the NAB, which was published by Numenta and comprises various time series data from machine, environmental, financial, and other domains.

• Yahoo [47]: Developed by Yahoo Labs, this dataset encompasses both real and synthetically generated data. The synthetic portion features fluctuating trends, noise, and seasonal patterns, while the real data encapsulates metrics from various Yahoo services.

7.2 Baselines↩︎

We selected the following baseline approaches to further elaborate on the performance differences between and SOTA methods:

• SubLOF [10] represents traditional outlier detection techniques based on distance metrics.

• SRCNN [27] is a supervised approach reliant on high-quality labeled data.

• LSTMAD [25] leverages Long Short-Term Memory (LSTM) networks [43] for deep learning-based anomaly detection.

• FITS [28] achieves parameter-efficient anomaly detection by upsampling frequency domain information using a low-pass filter and simple linear layers.

• FCVAE [26] is unsupervised reconstruction method based on Variational Autoencoder (VAE) [44], designed to reconstruct normal patterns.

• Anomaly Transformer [7] employs attention mechanism to computer the association discrepancy.

• TranAD [12] incorporates the principles of adversarial learning to develop a training framework with two stages while integrating the strengths of self-attention encoders to capture the temporal dependency embedded in the time series.

• SAND [29] utilizes a novel statistical approach based on curve shape clustering for anomaly detection in a streaming fashion.

• TimesNet [8] leverages an Inception [48]-based computer vision backbone to enhance learning capabilities.

• OFA [9], with GPT-2 [45] as its backbone, improves its ability to capture point-to-point dependencies.

• KAN [13] leverages Kolmogorov-Arnold representation theory to decompose complex learning objectives into linear combinations of univariate functions.

These baseline methods encompass a variety of anomaly detection paradigms: shape-based SAND, subsequence distance-based SubLOF, Transformer-based approaches like OFA, TranAD, and Anomaly Transformer for modeling sequence relationships, and frequency domain information enhanced methods FCVAE and FITS.

8 Datasets and Baselines on Multivariate Time Series↩︎

8.1 Datasets↩︎

We evaluated KAN-AD on five widely-used public benchmark datasets for multivariate time series anomaly detection:

• SMD [38]: A dataset collected from a large internet company, containing data from many server machines over several weeks.

• MSL [39]: A dataset from NASA containing telemetry data from the Mars Science Laboratory rover.

• SMAP [40]: Another NASA dataset, containing telemetry data from the SMAP satellite.

• SWaT [41]: A dataset generated from a scaled-down real-world water treatment testbed, including normal and attack scenarios.

• PSM [42]: A dataset from eBay, consisting of aggregated metrics from multiple application servers.

8.2 Baselines↩︎

We selected the following baseline approaches to further evaluate and SOTA methods on multivariate time series datasets:

• Informer [31]: A Transformer-based model designed for long sequence time-series forecasting, featuring a ProbSparse self-attention mechanism to improve efficiency. For anomaly detection, it typically relies on reconstruction error or forecast error.

• Anomaly Transformer [7]: A Transformer architecture specifically tailored for time series anomaly detection, which aims to learn prior-associations and series-associations to better distinguish anomalies.

• DLinear [32]: A simple yet effective linear model that decomposes the time series into trend and remainder components, challenging the necessity of complex Transformer architectures for some forecasting tasks and adaptable for anomaly detection via reconstruction.

• Autoformer [33]: A Transformer model with a novel decomposition architecture and an Auto-Correlation mechanism, designed to discover series-wise connections and improve long-term forecasting accuracy.

• FEDformer [34]: A Transformer variant that enhances performance for long sequence forecasting by employing frequency-enhanced decomposition and a mixture of expert design in the frequency domain.

• TimesNet [8]: A model that transforms 1D time series into a set of 2D tensors based on identified periods and applies a 2D kernel (e.g., Inception block) to capture both intra-period and inter-period variations for general time series analysis.

• UniTS [35]: Aims to provide a unified framework for time series analysis, often leveraging large-scale pre-training on diverse datasets to build a universal representation for both univariate and multivariate time series tasks.

References↩︎