Time series anomaly detection weights detectors with one confirmed label
OneShot: Label-Efficient Detector Weighting for Time Series Anomaly Detection
Artificial IntelligenceMachine Learning
Summary
Detecting unusual events in time series data is tricky because the best method depends on the data itself. The authors created ONESHOT, a way to improve detection by using just one confirmed anomaly to assign importance to different detection methods. This approach mixes the predictions from many methods, guided by that one known anomaly, to get better results. ONESHOT works well on many different datasets, coming close to the best possible detector for each series.
What this means in practice
- •For data engineering teams: Improve monitoring systems by dynamically weighting anomaly detectors after a single confirmed event to enhance alert accuracy on operational time series.
- •For financial risk analysts: Combine multiple anomaly detectors with a single confirmed fraud case to better spot unusual patterns in financial transaction data.
Authors
Seunghan Lee, Jun Seo, Jaehoon Lee, Junhyeok Kang, Sangjun Han, Sungdong Yoo, Minjae Kim, Tae Yoon Lim, Dongwan Kang, Hwanil Choi, Soonyoung Lee, Wonbin Ahn
Abstract
Time series (TS) anomaly detection (AD) lacks a universal detector, with the best choice determined by the series rather than by the algorithm. Existing methods therefore either select one detector for each series or average a pool of them. However, both assume that no label ever arrives, while a deployed monitor does receive them, since an operator confirms the alarms it raises. In this paper, we propose ONESHOT, which uses a single confirmed anomaly to weight the pool rather than to choose one detector from it. Specifically, we score each detector on the confirmed anomaly, and those scores become the weights of a soft mixture over the whole pool. We show that a single confirmed anomaly is enough to come close to the best detector for the series. Across 152 univariate and 73 multivariate series, ONESHOT outperforms the strongest single detector, averaging the whole pool, and even picking the best detector on the confirmed event. Code is available at: https://github.com/seunghan96/one_shot.