Types of Anomalies in Outlier Detection (Part 2.2): Univariate Time Series

Arima, ETS

[embed]Anomaly_Detection_toolkit/README.md at main · GeneSUN/Anomaly_Detection_toolkit this file contains anomaly detection related script/model/automation, and explanation. …github.com

This is a series of article about outlier detection, all article, notebook, script are summaried in above github repository

Value-based methods are great for catching outliers in static or independent data, but things get trickier when the order of the data matters.

In many real-world cases — like network signals, sensor logs, or financial transactions — what happens over time is just as important as the individual values themselves.

That’s where sequential-based anomaly detection comes in. By looking at how data changes and evolves, these methods can spot patterns or sudden shifts that simple statistical tests might miss.

Time-series Anomalous

In this section, we’ll dig into how time-aware models help us catch unusual trends and events in time series data.

You can also use the colab notebook to explore this topic:

[embed]Google Colab Edit descriptioncolab.research.google.com

1. Forecasting-Based Novelty Detection in Streaming Time Series

A widely used approach to anomaly detection in time series is regression-based forecasting. The idea is straightforward:

1. the model predicts the expected next value of the series along with a confidence interval that represents normal variation.
2. When the actual observation falls far outside this expected range, it is flagged as an anomaly.

In this sense, anomaly detection becomes the residual Detection:

• Forecast → expected value.
• Compare actual vs. expected: residual
• Large deviation = anomaly.

2. Reconstruction-based methods:

Reconstruction-based anomaly detection uses a model — often an autoencoder neural network — to “learn” the normal patterns in your data.

The model is trained to compress (encode) and then reconstruct (decode) the original time series as accurately as possible. Once it’s learned what “normal” looks like, you can measure how well it reconstructs each data point.

2.1. In-sample Prediction

Fit the model on the existing data, use the model to reconstruct (or predict) the training data itself, and flag points where the model’s prediction differs greatly from the observed value.

It’s important to note that this method isn’t about predicting future values. Instead, it focuses on what has already happened in your data.

The model isn’t used to extrapolate into the unknown, but rather to “interpolate” — that is, to reconstruct or predict the points in the data it’s already seen.

The goal is to check whether each point fits the common patterns learned from the whole dataset. If the model struggles to explain a particular value, that’s a signal it might be an anomaly.

If you want to dive deeper, check out below Github code or this Medium article on anomaly detection.

[embed]Time Series Anomaly Detection with ARIMA Anomaly detection methods can be grouped into three main types: rule-based, value-based, and sequential-based…medium.com

[embed]Anomaly_Detection_toolkit/ARIMA_anomaly/ARIMAAnomalyDetector.py at main ·… this file contains anomaly detection related script/model/automation, and explanation. …github.com

Key Takeaways: Sequential-Based Anomaly Detection

Time matters — Unlike rule- or value-based methods, sequential-based detection integrates temporal context to identify anomalies that only make sense when considering past behavior.

Two main approaches:

• Forecasting-based: Models like ARIMA/LSTM predict future values and flag anomalies when observations fall outside confidence intervals.
• Reconstruction-based: Autoencoders (and similar models) learn “normal” temporal patterns and highlight anomalies when reconstruction errors are high.

Why it works better:

• Detects subtle shifts or emerging trends that static methods miss.
• Adapts to evolving seasonality and trend changes — captures the nuance of sequential behavior.

Limitations to watch:

• Requires enough historical data for reliable modeling and forecasting.
• Noise or volatility in baseline data may reduce detection accuracy.
• Additional complexity and computational cost — especially for real-time or high-frequency data.

When to choose sequential methods: Ideal for domains where data evolves over time — think sensor readings, network signals, financial transactions — where anomalies are defined by deviations from temporal patterns, not just extreme values.