https://github.com/yanexr/awesome-tsad
List of time series anomaly detection resources, including methods, datasets, benchmarks, libraries, frameworks, and papers.
https://github.com/yanexr/awesome-tsad
List: awesome-tsad
anomaly-detection collection machine-learning outlier-detection time-series
Last synced: about 1 month ago
JSON representation
List of time series anomaly detection resources, including methods, datasets, benchmarks, libraries, frameworks, and papers.
- Host: GitHub
- URL: https://github.com/yanexr/awesome-tsad
- Owner: yanexr
- License: cc0-1.0
- Created: 2025-02-09T22:28:35.000Z (3 months ago)
- Default Branch: main
- Last Pushed: 2025-02-09T22:38:56.000Z (3 months ago)
- Last Synced: 2025-04-07T16:01:48.685Z (about 2 months ago)
- Topics: anomaly-detection, collection, machine-learning, outlier-detection, time-series
- Homepage:
- Size: 12.7 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
- ultimate-awesome - awesome-tsad - List of time series anomaly detection resources, including methods, datasets, benchmarks, libraries, frameworks, and papers. (Other Lists / Julia Lists)
README
# Time Series Anomaly Detection
A curated list of resources for anomaly detection in time series data. For additional related lists, explore [rob-med/awesome-TS-anomaly-detection](https://github.com/rob-med/awesome-TS-anomaly-detection), [zamanzadeh/ts-anomaly-benchmark](https://github.com/zamanzadeh/ts-anomaly-benchmark), and [yzhao062/anomaly-detection-resources](https://github.com/yzhao062/anomaly-detection-resources).
_Last edited: 01/14/2025_
## Contents
1. [Methods](#methods)
2. [Datasets & Benchmarks](#datasets--benchmarks)
3. [Libraries & Frameworks](#libraries--frameworks)
4. [Survey & Review Papers](#survey--review-papers)
## Methods
| Acronym | Description | Category | Year | Materials |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- | ---- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| k-means | Clusters subsequences and then use the distances between subsequences and their corresponding cluster centroids as anomaly scores. | Clustering, Distance-based | 1967 | [[PDF]](https://citeseerx.ist.psu.edu/document?repid=rep1&type=pdf&doi=730898e5a7e655cc8359d496f26ffb6ecfc8850b), [[Code]](https://scikit-learn.org/stable/modules/generated/sklearn.cluster.KMeans.html) |
| MERLIN | Discord discovery method that identifies subsequences that are maximally distant from their nearest neighbors across all possible lengths in a computationally efficient manner. | Discord Discovery, Distance-based | 2020 | [[PDF]](https://par.nsf.gov/servlets/purl/10286775), [[Code]](https://gitlab.com/dlr-dw/py-merlin) |
| STOMP | STOMP (Scalable Time series Ordered-search Matrix Profile) efficiently computes the matrix profile, which is a data structure that stores the nearest neighbor distance of each subsequence in a time series. | Matrix Profile, Distance-based | 2016 | [[PDF]](https://escholarship.org/content/qt7b4425nr/qt7b4425nr_noSplash_ddcf64b604aa324557f4c8f039d66d13.pdf), [[Code]](https://stumpy.readthedocs.io/en/latest/api.html#stumpy.stump) |
| DAMP | DAMP (Discord Aware Matrix Profile) computes exact left-discords optimized for online anomaly detection in high-frequency data streams. | Matrix Profile, Streaming Data, Distance-based | 2022 | [[PDF]](https://dl.acm.org/doi/pdf/10.1145/3534678.3539271), [[Code]](https://github.com/sihohan/DAMP) |
| SAND | SAND (Streaming Subsequence Anomaly Detection) continuously clusters incoming subsequences using adaptive k-Shape and updates cluster weights dynamically. | Clustering, Streaming Data, Distance-based | 2021 | [[PDF]](https://www.researchgate.net/profile/Paul-Boniol-2/publication/355657812_SAND_streaming_subsequence_anomaly_detection/links/62e2455c9d410c5ff36a2dd4/SAND-streaming-subsequence-anomaly-detection.pdf), [[Code]](https://github.com/dawnvince/EasyTSAD?tab=readme-ov-file#built-in-methods) |
| LOF | LOF (Local Outlier Factor) computes the local density of each subsequence relative to its neighbors; points with significantly lower density are marked as anomalies. | Density-based, Distance-based | 2000 | [[PDF]](https://dl.acm.org/doi/pdf/10.1145/342009.335388), [[Code]](https://tods-doc.github.io/tods.detection_algorithm.html#tods-detection-algorithm-pyodlof) |
| MDI | MDI (Maximally Divergent Intervals) scans subsequences and detects anomalies by computing the KL divergence between the interval’s probability density and that of the remaining time series, maximizing divergence to identify the most distinct intervals. | Density-based, Distribution | 2016 | [[PDF]](https://arxiv.org/pdf/1610.06761), [[Code]](https://github.com/cvjena/libmaxdiv) |
| Isolation Forest | IF (Isolation Forest) Isolates anomalies by randomly partitioning the data; anomalous points require fewer splits to isolate, resulting in shorter average path lengths. | Isolation-based, Ensemble | 2008 | [[PDF]](https://cs.nju.edu.cn/zhouzh/zhouzh.files/publication/icdm08b.pdf?q=isolation-forest), [[Code]](https://scikit-learn.org/stable/modules/generated/sklearn.ensemble.IsolationForest.html) |
| RRCF | RRCF (Robust Random Cut Forest) is a variant of Isolation Forest that selects cutting dimensions proportional to their range and uses collusive displacement to robustly score anomalies. | Isolation-based, Streaming Data, Ensemble | 2016 | [[PDF]](http://proceedings.mlr.press/v48/guha16.pdf), [[Code]](https://github.com/kLabUM/rrcf) |
| OCSVM | OCSVM (One-Class Support Vector Machine) detects anomalies in time series by mapping data into a high-dimensional space and separating normal instances from the origin using a maximal margin hyperplane. | One-Class, Kernel-based, Distance-based | 1999 | [[PDF]](https://proceedings.neurips.cc/paper_files/paper/1999/file/8725fb777f25776ffa9076e44fcfd776-Paper.pdf), [[Code]](https://scikit-learn.org/stable/modules/generated/sklearn.svm.OneClassSVM.html) |
| Deep SVDD | Deep SVDD (Deep Support Vector Data Description) learns a neural network transformation that attempts to map normal data into a hypersphere of minimum volume. | One-Class, Representation, Deep Learning | 2018 | [[PDF]](http://proceedings.mlr.press/v80/ruff18a/ruff18a.pdf), [[Code]](https://github.com/lukasruff/Deep-SVDD-PyTorch) |
| COUTA | COUTA (Calibrated One-class classification-based Unsupervised Time Series Anomaly detection method) uses a TCN to embed subsequences into a hypersphere and calibrates learning via uncertainty modeling with synthetic anomalies. | One-class, TCN, Deep Learning | 2024 | [[PDF]](https://arxiv.org/abs/2207.12201), [[Code]](https://github.com/xuhongzuo/couta) |
| DACAD | Domain Adaptation Contrastive learning model for Anomaly Detection in multivariate time series (DACAD) leverages synthetic anomaly injection, contrastive triplet losses, a Temporal Convolutional Network with adversarial domain alignment, and a centre-based entropy classifier to detect anomalies. | Contrastive Learning, TCN, Representation, Deep Learning | 2024 | [[PDF]](https://arxiv.org/pdf/2404.11269), [[Code]](https://github.com/zamanzadeh/DACAD) |
| PCA | Principal Component Analysis (PCA) detects anomalies by projecting data into a lower-dimensional space, then flagging points with high reconstruction errors. | Reconstruction, Statistical | 1933 | [[PDF]](https://www.ics.forth.gr/mobile/Bibliography/LoadBalancing/LB/PCA_Anomaly_Deytection.pdf), [[Code]](https://tods-doc.github.io/tods.detection_algorithm.html?highlight=pca#tods-detection-algorithm-pcaodetect) |
| EncDec-AD | EncDec-AD detects anomalies in time series by training an LSTM Encoder-Decoder to reconstruct normal sequences, then identifying anomalies based on high reconstruction errors using a probabilistic threshold. | Reconstruction, LSTM, Deep Learning | 2016 | [[PDF]](https://arxiv.org/pdf/1607.00148), [[Code]](https://github.com/chickenbestlover/RNN-Time-series-Anomaly-Detection) |
| Donut | Donut detects anomalies by training a VAE with a sliding window approach, reconstructing normal patterns while handling missing data using M-ELBO and Missing Data Injection, then identifying anomalies based on low reconstruction probability. | Reconstruction, VAE, Deep Learning | 2018 | [[PDF]](https://arxiv.org/pdf/1802.03903), [[Code]](https://github.com/NetManAIOps/donut) |
| BeatGAN | BeatGAN uses Generative Adversarial Networks (GANs) to regularize an autoencoder, reconstructing normal beats and detecting anomalies based on high reconstruction errors. | Reconstruction, GAN, Deep Learning | 2019 | [[PDF]](https://www.ijcai.org/Proceedings/2019/0616.pdf), [[Code]](https://github.com/hi-bingo/BeatGAN) |
| OmniAnomaly | A stochastic recurrent neural network that combines GRU and VAE to learn normal patterns in multivariate time series, detecting anomalies based on reconstruction probability. | Reconstruction, GRU, VAE, Deep Learning | 2019 | [[PDF]](https://netman.aiops.org/wp-content/uploads/2019/08/OmniAnomaly_camera-ready.pdf), [[Code]](https://github.com/NetManAIOps/OmniAnomaly) |
| Tran-AD | Detects anomalies by reconstructing time series windows with a two-phase transformer that flags high reconstruction errors via dynamic thresholds. | Reconstruction, Transformer, Deep Learning | 2022 | [[PDF]](https://arxiv.org/pdf/2201.07284), [[Code]](https://github.com/imperial-qore/tranad) |
| MSCRED | MSCRED (Multi-Scale Convolutional Residual Encoder-Decoder) detects anomalies by leveraging multi-scale signature matrices processed through a convolutional encoder, an attention-based ConvLSTM, and a convolutional decoder. | Reconstruction, Convolutional, Deep Learning | 2018 | [[PDF]](https://arxiv.org/pdf/1811.08055), [[Code]](https://github.com/Zhang-Zhi-Jie/Pytorch-MSCRED) |
| ImDiffusion | ImDiffusion detects anomalies by using an unconditional diffusion model with transformer-based imputation and grating data masking, leveraging imputation errors as anomaly signals while reducing uncertainty through neighboring value conditioning. | Reconstruction, Diffusion, Deep Learning | 2023 | [[PDF]](https://arxiv.org/pdf/2307.00754), [[Code]](https://github.com/17000cyh/imdiffusion) |
| DiffusionAE | Detects anomalies by jointly training an Transformer-based autoencoder and a diffusion model to reconstruct and denoise a time series. | Reconstruction, Diffusion, Deep Learning | 2023 | [[PDF]](https://arxiv.org/pdf/2311.01452), [[Code]](https://github.com/fbrad/diffusionae) |
| Time-VQVAE-AD | Encodes time-frequency transformed data into a discrete latent space via VQ-VAE, then learns a masked modeling prior with a bidirectional transformer, enabling anomaly detection through the probability of observed tokens deviating from the learned normal states. | Reconstruction, VQVAE, Deep Learning | 2024 | [[PDF]](https://arxiv.org/pdf/2311.12550), [[Code]](https://github.com/ml4its/timevqvae-anomalydetection) |
| MTAD-GAT | MTAD-GAT: Multivariate Time-series Anomaly Detection (MTAD) via Graph Attention Networks (GAT), leveraging GATs to capture feature-wise and temporal dependencies, followed by a GRU-based encoder that jointly optimizes forecasting and reconstruction losses to identify anomalies. | Hybrid, Graph-based, Deep Learning | 2020 | [[PDF]](https://arxiv.org/pdf/2009.02040), [[Code]](https://github.com/ML4ITS/mtad-gat-pytorch) |
| GDN | GDN (Graph Deviation Network) detects anomalies in multivariate TS by learning a graph of sensor relationships, using graph attention-based forecasting to predict normal behavior, and flagging deviations as anomalies. | Forecasting, Graph-based, Deep Learning | 2021 | [[PDF]](https://arxiv.org/pdf/2106.06947), [[Code]](https://github.com/d-ailin/GDN?tab=readme-ov-file) |
| GTA | GTA (Graph Transformer Autoencoder) learns sensor graphs via Gumbel-softmax sampling, captures spatial-temporal patterns using graph and dilated convolutions, and detects anomalies with an multi-branch Transformer. | Forecasting, Graph-based, Transformer, Deep Learning | 2021 | [[PDF]](https://arxiv.org/pdf/2104.03466), [[Code]](https://github.com/zackchen-lb/GTA) |
| ARIMA | AutoRegressive Integrated Moving Average (ARIMA) detects anomalies by building a forecast model during testing and flagging significant deviations between predicted and actual values. | Forecasting, Statistical | 1970 | [[PDF]](https://www.mdpi.com/2076-3417/11/7/3194/pdf), [[Code]](https://github.com/waico/arimafd) |
| Telemanom | Telemanom detects anomalies by using LSTMs to forecast time series values and flagging deviations based on dynamic error thresholds. | Forecasting, LSTM, Deep Learning | 2018 | [[PDF]](https://arxiv.org/pdf/1802.04431), [[Code]](https://github.com/khundman/telemanom) |
## Datasets & Benchmarks
| Dataset/Benchmark | Description | #Entries | #Samples | #Dim | Materials |
| -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | -------: | --------: | --------: | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **MSL** (Mars Science Laboratory) | Real NASA rover telemetry (Aerospace domain) | 27 | 132,046 | 55 | [[PDF]](https://arxiv.org/pdf/1802.04431) [[Kaggle]](https://www.kaggle.com/datasets/patrickfleith/nasa-anomaly-detection-dataset-smap-msl) |
| **SMAP** (Soil Moisture Active Passive) | Real NASA rover soil sensor data (Aerospace/Environmental) | 55 | 562,800 | 25 | [[PDF]](https://arxiv.org/pdf/1802.04431) [[Kaggle]](https://www.kaggle.com/datasets/patrickfleith/nasa-anomaly-detection-dataset-smap-msl) [[Homepage]](https://catalog.data.gov/dataset/soil-moisture-active-passive-smap-l1-l3-ancillary-satellite-data-v001-58cbf) |
| **SMD** (Server Machine Dataset) | Real 5-week server logs from 28 machines (IT Ops domain) | 28 | 1,416,825 | 38 | [[PDF]](https://netman.aiops.org/wp-content/uploads/2019/08/OmniAnomaly_camera-ready.pdf) [[Kaggle]](https://www.kaggle.com/datasets/mgusat/smd-onmiad/data) |
| **SWaT** (Secure Water Treatment) | Real ICS logs from a functional water treatment testbed (7 days normal, 4 days attacks) | 1 | 946,719 | 51 | [[PDF]](https://arxiv.org/pdf/1709.05342) [[Homepage]](https://itrust.sutd.edu.sg/itrust-labs_datasets/dataset_info/) |
| **WADI** (Water Distribution) | Real ICS logs from a water distribution testbed (14 days normal, 2 days attacks) | 1 | 1,221,372 | 123 | [[PDF]](https://arxiv.org/pdf/1901.04997) [[Homepage]](https://itrust.sutd.edu.sg/itrust-labs_datasets/dataset_info/) |
| **PSM** (Pooled Server Metrics) | Real server metrics from eBay’s environment (asynchronous, repetitive signals) | 1 | 132,480 | 24 | [[Paper]](https://dl.acm.org/doi/abs/10.1145/3447548.3467174) [[GitHub]](https://github.com/eBay/RANSynCoders) |
| **Yahoo S5** | Real & synthetic univariate time series from Yahoo services (tagged anomalies) | 367 | 572,966 | 1 | [[PDF]](https://yahoo-webscope-publications.s3.amazonaws.com/Yoshihara+and+Takahashi(2022%2C+PLoS+ONE).pdf) [[Homepage]](https://webscope.sandbox.yahoo.com/catalog.php?datatype=s&did=70) |
| **NAB** (Numenta Anomaly Benchmark) | Real & synthetic univariate time series from multiple domains (real-time streaming) | 58 | 365,551 | 1 | [[PDF]](https://arxiv.org/pdf/1510.03336v4) [[GitHub]](https://github.com/numenta/NAB) |
| **UCR Anomaly Archive** | 250 univariate time series (human medicine, biology, meteorology, industry), often with a single artificial anomaly | 250 | 1K–20K | 1 | [[PDF]](https://arxiv.org/abs/1810.07758) [[Homepage]](https://www.cs.ucr.edu/%7Eeamonn/time_series_data_2018/) |
| **Exathlon** | Real high-dimensional time series from 93 Spark streaming traces (server/app monitoring) | 93 | 2,335,781 | 2,283 | [[PDF]](https://arxiv.org/pdf/2010.05073v3) [[GitHub]](https://github.com/exathlonbenchmark/exathlon) |
| **TODS** (Time Series Outlier Detection Suite) | 35 synthetic + 4 real multivariate time series, covering various outlier types (point / pattern) | 39 | Varies | Varies | [[PDF]](https:/openreview.net/pdf?id=r8IvOsnHchr) [[GitHub]](https://github.com/datamllab/tods/tree/benchmark/benchmark) |
| **TSB-AD** (Time-Series Benchmark for Anomaly Detection) | Time series from 40 diverse datasets (1,070 series) | 1,070 | Varies | Uni/Multi | [[PDF]](https://openreview.net/pdf?id=R6kJtWsTGy) [[Homepage]](https://thedatumorg.github.io/TSB-AD/) |
| **TSB-UAD** (Time-Series Benchmark for Univariate Anomaly Detection) | 12,686 univariate time series with labeled anomalies, combining 18 public datasets plus synthetic transformations | 12,686 | Varies | 1 | [[PDF]](http://lipade.mi.parisdescartes.fr/wp-content/uploads/2022/03/AD_Benchmark_tech_report.pdf) [[GitHub]](https://github.com/TheDatumOrg/TSB-UAD) [[Homepage]](https://tsb-uad.readthedocs.io/en/latest/) |
## Libraries & Frameworks
| Name | Description | Language | License |
| ----------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ------------ |
| [TODS](https://tods-doc.github.io) | Supports components from preprocessings, feature extraction and detection algorithms, including point-wise detection algorithms supported by [PyOD](https://pyod.readthedocs.io), state-of-the-art pattern-wise (collective) detection algorithms such as DeepLog, Telemanon, and also various ensemble algorithms for performing system-wise detection. | Python | Apache-2.0 |
| [DeepOD](https://deepod.readthedocs.io) | A library for deep learning-based tabular and time-series anomaly detection. Includes models such as TranAD, DeepIsolationForestTS, DeepSADTS, DevNetTS, PReNetTS and more. | Python | BSD-2-Clause |
| [EasyTSAD](https://github.com/dawnvince/EasyTSAD) | A framework for running and evaluating your TSAD algorithm including several built-in methods such as SubLOF, SAND, Donut, EncDecAD, Anomaly Transformer and more. | Python | GPL-3.0 |
| [STUMPY](https://stumpy.readthedocs.io) | A powerful and scalable library that efficiently computes the matrix profile, that can then be used for a variety of time series data mining tasks such as anomaly/novelty (discord) discovery. | Python | BSD-3-Clause |
| [sktime](https://www.sktime.org) | A library for time series analysis, that includes forecasting, time series classification, clustering, anomaly/changepoint detection, and other tasks. | Python | BSD-3-Clause |
| [scikit-learn](https://scikit-learn.org/) | Classical ML methods like One-Class SVM, Isolation Forest, DBSCAN, and more. | Python | BSD-3-Clause |
| [aeon](https://www.aeon-toolkit.org/en/stable/api_reference/anomaly_detection.html) | aeon is a scikit-learn compatible toolkit for learning from time series and provides a variety of anomaly detection algorithms, including MERLIN, LOF, STOMP, and more. | Python | BSD-3-Clause |
| [Skyline](https://earthgecko-skyline.readthedocs.io) | A real time anomaly detection, time series analysis and performance monitoring system, built to enable passive monitoring on metrics, without the need to configure a model/thresholds for each one. | Python | MIT |
| [Merlion](https://github.com/salesforce/Merlion) | An end-to-end machine learning framework for various time series learning tasks, including forecasting, anomaly detection, and change point detection for both univariate and multivariate time series. | Python | BSD-3-Clause |
| [Kats](https://github.com/facebookresearch/Kats) | A time series analysis toolkit for understanding key statistics and characteristics, detecting regressions and anomalies, and forecasting future trends. | Python | MIT |
| [Orion](https://sintel.dev/Orion/index.html) | A machine learning library built for unsupervised time series anomaly detection. | Python | MIT |
| [Darts](https://unit8co.github.io/darts/) | A library for forecasting and anomaly detection on time series. It contains a variety of models, from classics such as ARIMA to deep neural networks. | Python | Apache-2.0 |
| [Flow Forecast](https://github.com/AIStream-Peelout/flow-forecast) | Deep learning PyTorch library for time series forecasting, classification, and anomaly detection (originally for flood forecasting). | Python | GPL-3.0 |
## Survey & Review Papers
| Paper Title | Year | Link |
| --------------------------------------------------------------------------------------------------------------- | ---- | ---------------------------------------------------------------------------- |
| Dive into Time-Series Anomaly Detection: A Decade Review | 2024 | [Paper](https://arxiv.org/pdf/2412.20512) |
| Anomaly detection in time series: a comprehensive evaluation | 2022 | [Paper](https://vldb.org/pvldb/vol15/p1779-wenig.pdf) |
| Unsupervised anomaly detection in time-series: An extensive evaluation and analysis of state-of-the-art methods | 2024 | [Paper](https://arxiv.org/pdf/2212.03637) |
| Current time series anomaly detection benchmarks are flawed and are creating the illusion of progress | 2021 | [Paper](https://arxiv.org/pdf/2009.13807) |
| Anomaly detection in univariate time-series: A survey on the state-of-the-art | 2020 | [Paper](https://arxiv.org/pdf/2004.00433) |
| Deep learning for time series anomaly detection: A survey | 2024 | [Paper](https://dl.acm.org/doi/pdf/10.1145/3691338) |
| Deep learning for anomaly detection in time-series data: Review, analysis, and guidelines | 2021 | [Paper](https://ieeexplore.ieee.org/iel7/6287639/6514899/09523565.pdf) |
| Deep learning for anomaly detection in multivariate time series: Approaches, applications, and challenges | 2023 | [Paper](https://www.sciencedirect.com/science/article/pii/S1566253522001774) |
| Revisiting time series outlier detection: Definitions and benchmarks | 2021 | [Paper](https://openreview.net/pdf?id=r8IvOsnHchr) |
| A Unifying Review of Deep and Shallow Anomaly Detection | 2020 | [Paper](https://arxiv.org/pdf/2009.11732) |