With the growing adoption of time-series anomaly detection (TAD) technology, numerous studies have employed deep learning-based detectors to analyze time-series data in the fields of Internet services, industrial systems, and sensors. The selection and optimization of anomaly detectors strongly rely on the availability of an effective evaluation for TAD performance. Since anomalies in time-series data often manifest as a sequence of points, conventional metrics that solely consider the detection of individual points are inadequate. Existing TAD evaluators typically employ point-based or event-based metrics to capture the temporal context. However, point-based evaluators tend to overestimate detectors that excel only in detecting long anomalies, while event-based evaluators are susceptible to being misled by fragmented detection results. To address these limitations, we propose OIPR1, a novel TAD evaluator with area-based metrics. It models the process of operators receiving detector alarms and handling anomalies, utilizing area under the operator interest curve to evaluate TAD performance. Furthermore, we build a special scenario dataset to compare the characteristics of different evaluators. Through experiments conducted on the special scenario dataset and five real-world datasets, we demon-strate the remarkable performance of OIPR in extreme and complex scenarios. It achieves a balance between point and event perspectives, overcoming their primary limitations and offering applicability to broader situations.

Accurate forecasting of time series is crucial for many applications in the real world. Conventional methods primarily rely on statistical analysis of historical data, often leading to overfitting and failing to account for background information and constraints imposed by external events. Therefore, introducing large language models (LLMs) with robust textual capabilities holds significant potential. However, due to the inherent limitations of LLMs in handling numerical data, they do not exhibit advantages in precise numerical prediction tasks. Therefore, we propose a framework to integrate LLMs with conventional methods synergistically. Rather than directly outputting numerical predictions, we leverage the capabilities of the LLMs to generate textual temporal patterns, thereby fully utilizing their inherent knowledge and reasoning abilities. Additionally, we introduce a memory network designed to decode these textual representations into a format that numerical models can effectively interpret. This approach not only capitalizes on the strengths of the LLM in text processing but also bridges the gap between textual and numerical data, enhancing the overall predictive performance of the model. Our experimental results demonstrate the framework's effectiveness, achieving state-of-the-art performance on various benchmark datasets.

Multivariate time-series (MTS) classification tasks play a key role in data-driven applications spanning healthcare, finance, and mobile communication. As MTS data are typically collected from multiple interdependent sensors, the resulting temporal patterns inherently reflect the characteristics of the underlying sensing systems. Despite this connection, conventional MTS classification models predominantly focus on raw time-series data while disregarding valuable sensor-specific prior knowledge, which fundamentally constrains their classification accuracy. The emergence of large language models (LLMs) has encoded extensive sensor-related knowledge within their parameter spaces. However, effectively harnessing such knowledge to enhance MTS classification networks remains an open challenge. To address this, we propose Foresail, a status-guided neural framework that bridges this gap through systematic integration of LLM-derived sensor knowledge via the status relationship matrix and fine-grained status labels. Foresail can be seamlessly integrated with existing MTS networks to optimize performance and generate interpretable intermediate results. Experiments on irregularly and regularly sampled MTS data demonstrate that Foresail outperforms state-of-the-art approaches, achieving a notable improvement in F1-score of up to 10.9% compared to the basic MTS network.

Recently, reconstruction-based deep models have gained widespread usage in unsupervised anomaly detection. However, they may overlook some anomalies owing to the over-generalization of neural networks. Several studies have incorporated memory networks to mitigate this problem. Nonetheless, some of them lack an explicit memory updating process, while others rely on data-driven updating methods that are sensitive to initial values and unsuitable for end-to-end training. Additionally, the traditional criterion for detection computed in the high-dimensional input space may collapse as the spike in the deviation score is averaged across numerous dimensions. To address these challenges, we propose MCAKE, a M emory-augmented C ontrastive A utoencoder with K NN-Based E xtraction. It is designed to highlight the deviation score for anomalies by reconstructing input using fixed normal prototypes recorded in the memory. We explicitly encourage the memory to be autonomously learned and effectively allocated through contrastive learning with multiple positive and multiple negative samples. Furthermore, we introduce a bivariate detection criterion that calculates anomaly scores considering both input and latent space to tackle the collapse. Extensive experiments on 50 datasets across various categories demonstrate the superiority of our approach, with a 2% relative improvement over the previous state-of-the-art models.

Logs record crucial information about runtime status of software system, which can be utilized for anomaly detection and fault diagnosis. However, techniques struggle to perform effectively when dealing with interleaved logs and entities that influence each other. Although manually specifying a grouping field for each dataset can handle the single grouping scenario, the problems of multiple and heterogeneous grouping still remain unsolved. To break through these limitations, we first design a log semantic association mining approach to convert log sequences into Log-Entity Graph, and then propose a novel log anomaly detection model named Lograph. The semantic association can be utilized to implicitly group the logs and sort out complex dependencies between entities, which have been overlooked in existing literature. Also, a Heterogeneous Graph Attention Network is utilized to effectively capture anomalous patterns of both logs and entities, where Log-Entity Graph serves as a data management and feature engineering module. We evaluate our model on real-world log datasets, comparing with nine baseline models. The experimental results demonstrate that Lograph can improve the accuracy of anomaly detection, especially on the datasets where entity relationships are intricate and grouping strategies are not applicable.

Artificial Intelligence for IT Operations (AIOps) for microservice systems has attracted much attention in academia and industry, aiming to reduce the burden of operations developers and improve the reliability of microservices. However, due to mostly private datasets and unique data requirements of different studies, researchers are forced to invest considerable effort in tedious tasks such as data simulation and data collection, which prevents them from concentrating on model development. To tackle this dilemma, we introduce MicroOps, a microservice data simulation and AIOps model development platform. MicroOps provides full-process automation support for microservice AIOps research, with key roles for rapid dataset generation and intuitive model testing. Based on MicroOps, we release two multimodal datasets collected from two widely used microservice systems. A user survey is conducted on MicroOps, evaluating its usability and practicality through the System Usability Scale (SUS) and open-ended questions. The results show that both are highly positively rated. Platform: https://github.com/OpenNetAI/MicroOps.

Monitoring and anomaly detection of key performance indicators (KPIs) are crucial for large Internet companies to maintain the reliability of their Web services. Influenced by human behavior and schedules, the KPIs of Web services typically exhibit seasonal characteristics. These characteristics may be complex as different KPIs exhibit differences in trend, multiple periods, and noise behaviors. However, existing anomaly detection methods typically only model one fixed pattern of seasonal KPIs, which may lead to performance degradation when dealing with diverse seasonal KPIs. In this work, we propose a novel anomaly detection model for seasonal KPIs,Diner, which incorporates multiple interpretable components. It is able to capture the additive and multiplicative trends, multiple periods, and seasonal noise in intricate seasonal KPIs, making it easily adaptable to different types of seasonal KPIs. Additionally, we present a set of evaluation criteria for generic time series anomaly detection tasks, which prove more effective in handling ambiguous manual labels and various anomaly events. Experiments are conducted on three real-world datasets, and the performanceDinersurpassed both the statistical baseline and the state-of-the-art deep learning baselines.

Anomaly detection using KPIs (Key Performance Indicators) is key to AIOps (Artificial Intelligence for IT Operations). Recent anomaly detection approaches have adopted machine learning to detect anomalies on the perspective of individual time points more than events. These approaches do not make effective use of the labels of continuous anomaly intervals, nor do they pay attention to the differences among anomaly points. The detection performance is therefore not high enough. In this paper, we propose an anomaly detection approach named ALSR, which uses a label screening model and a relearning model to analyze and utilize the continuous anomaly intervals of KPIs in finer granularity. The label screening algorithm takes advantage of the continuity of anomaly intervals to remove unnecessary data from the training set, so as to better suit to interval-oriented anomaly detection. The relearning algorithm reclassifies the true/false positive points within range of detected anomalies, thus effectively reduces the number of false positive points. ALSR uses statistical characteristics and time series models for feature extraction, and the feature set is proved to better describe the characteristics of KPIs. We conduct comprehensive experiments on 25 KPIs, and the total F-score of ALSR is 0.965, which outperforms state-of-the-art anomaly detection approaches.