Abstract

Time-series anomaly detection underpins monitoring systems across infrastructure observability, industrial IoT, and financial surveillance. Despite a decade of research, no single algorithm dominates all time-series characteristics. The TSB-UAD benchmark, expanded through 2025 to cover over 1,700 expert-labeled datasets from real-world sources, provides the most rigorous public algorithm comparison to date. Combined with PyOD - the Python Outlier Detection library unifying dozens of detectors under a single interface - these tools give teams a principled workflow for algorithm selection and production deployment.

The TSB-UAD Benchmark and What It Reveals

TSB-UAD compiles datasets from server metrics, electrocardiograms, power consumption traces, and similar domains where labels come from expert annotation rather than synthetic injection. Real anomalies are contextual and multi-step; synthetically injected point spikes are far easier.

Key benchmark findings: Matrix Profile-based methods (via the STUMPY library) perform consistently across diverse series because they detect discord without shape assumptions. Isolation Forest underperforms on raw time-series without feature engineering. STL-residual thresholding works well on strongly periodic series but fails on aperiodic signals. No method is universally best - the benchmark makes this concrete rather than anecdotal.

PyOD Pipelines and Scaling

PyOD provides scikit-learn-compatible fit and decision_function across 45+ algorithms including ECOD, COPOD, LOF, and neural methods like DeepSVDD. For time-series, raw data is first transformed into feature matrices via sliding window extraction before passing to detectors.

A practical baseline: extract 50-point windows with 25% overlap, compute per-window mean, std, and lag-1 autocorrelation, run ECOD as primary (non-parametric, no hyperparameters), stack COPOD as secondary, and flag windows where both agree. This ensemble cuts false positives 30-40% vs single-detector approaches on moderately noisy sensor data.

At production scale - thousands of series per fleet - a single-threaded PyOD fit is the bottleneck. Joblib prefer="processes" parallelizes across cores; Ray or Dask distributes across workers for 10,000+ series. Pre-trained models load from object storage at consumer startup and publish anomaly scores to a downstream topic via decision_function on each incoming window.

Evaluation Without Clean Labels

TSB-UAD-style labeled evaluation is rarely feasible for proprietary data. Practical proxies: anomaly injection testing (inject known patterns, verify recall), precision-at-K via human review of top-scored samples, and alert fatigue rate as a false-positive proxy. ECOD and COPOD produce calibrated score distributions where the natural elbow often marks a meaningful anomaly boundary, making threshold selection more principled than a fixed percentile cutoff.