Contextual and Seasonal LSTMs for Time Series Anomaly Detection

Univariate time series (UTS), where each timestamp records a single variable, serve as crucial indicators in web systems and cloud servers. Anomaly detection in UTS plays an essential role in both data mining and system reliability management. However, existing reconstruction-based and prediction-based methods struggle to capture certain subtle anomalies, particularly small point anomalies and slowly rising anomalies. To address these challenges, we propose a novel prediction-based framework named Contextual and Seasonal LSTMs (CS-LSTMs). CS-LSTMs are built upon a noise decomposition strategy and jointly leverage contextual dependencies and seasonal patterns, thereby strengthening the detection of subtle anomalies. By integrating both time-domain and frequency-domain representations, CS-LSTMs achieve more accurate modeling of periodic trends and anomaly localization. Extensive evaluations on public benchmark datasets demonstrate that CS-LSTMs consistently outperform state-of-the-art methods, highlighting their effectiveness and practical value in robust time series anomaly detection.

💡 Research Summary

The paper tackles anomaly detection in univariate time series (UTS), a critical task for monitoring web services, cloud servers, and IoT devices. Existing reconstruction‑based methods treat sliding windows independently and ignore temporal continuity, while prediction‑based approaches struggle to capture subtle anomalies because a single variable provides limited contextual information. Consequently, small point anomalies and slowly rising segment anomalies often go undetected.

To overcome these issues, the authors propose Contextual and Seasonal LSTMs (CS‑LSTM), a prediction‑centric framework built around three challenges: (1) capturing local trends rather than absolute values, (2) modeling evolving periodicity instead of assuming a static seasonality, and (3) learning normal patterns in the presence of noise and unlabeled anomalies.

CS‑LSTM first applies a noise‑decomposition step based on wavelet transform and median absolute deviation (MAD). The series is expressed as Trend + Season + Noise, and only the noise component is removed via soft‑thresholding, preserving the underlying trend and seasonal signals without requiring ground‑truth anomaly labels.

The core model consists of a dual‑branch architecture. The Seasonal‑LSTM (S‑LSTM) branch receives frequency‑domain features obtained through Fourier analysis and learns long‑term periodic patterns and their evolution. The Contextual‑LSTM (C‑LSTM) branch processes the normalized raw time‑domain data to capture short‑term dynamics within a sliding window. Outputs from both branches are combined (weighted sum) to forecast future values.

Training employs a masked negative log‑likelihood loss that is computed only on normal points (identified via a mask), preventing anomalous samples from biasing the model. Anomaly scores are derived from the deviation between predicted and observed values; a point is flagged as anomalous when the deviation exceeds a learned normal range.

Extensive experiments on five public benchmarks—including the Numenta Anomaly Benchmark (NAB), Yahoo, Yahoo S5, and real cloud‑log datasets—show that CS‑LSTM consistently outperforms state‑of‑the‑art baselines such as FCV‑AE, KAN‑AD, TF‑AD, and Transformer‑based predictors. It achieves 3–7 percentage‑point improvements in F1 score, reduces detection latency by over 40 %, and markedly improves recall for the previously hard‑to‑detect anomaly types. Moreover, CS‑LSTM requires fewer parameters and less inference time than Transformer models, making it suitable for real‑time monitoring.

The authors acknowledge limitations: hyper‑parameters like wavelet decomposition level and window size still need dataset‑specific tuning, and performance on series lacking clear seasonality is modest. Future work includes automated hyper‑parameter selection, multi‑scale seasonal modeling, and extension to multivariate time series. Overall, CS‑LSTM demonstrates that jointly modeling time‑domain local trends and frequency‑domain evolving seasonality, together with robust noise handling, yields a powerful solution for subtle anomaly detection in univariate time series.