统一多种模型的异常检测框架，在真实数据上验证了不同方法的优劣。
A Comprehensive Forecasting-Based Framework for Time Series Anomaly Detection: Benchmarking on the Numenta Anomaly Benchmark (NAB)
- 用统一残差接口整合经典与深度学习模型，支持模块化流程
- LSTM在复杂模式中表现最佳（F1: 0.688），Informer训练快30%
- 为不同场景推荐模型：复杂用LSTM，高效选Informer，简单数据用经典方法
时间序列异常检测对现代数字基础设施至关重要，但现有方法缺乏系统性跨领域评估。本文提出一个基于预测的综合框架，将经典方法（Holt-Winters、SARIMA）与深度学习架构（LSTM、Informer）统一于同一残差检测接口下。模块化流程包含预处理（归一化、STL分解）、四种预测模型、四种检测方法，并通过预测指标（MAE、RMSE、PCC）与检测指标（精确率、召回率、F1、AUC）双重评估。首次在Numenta异常基准（NAB）上完成全面评估，涵盖58个数据集、7个类别，共232次模型训练与464次检测评估，实现100%成功率。LSTM表现最优（F1: 0.688），在81%数据集上排名第一或第二，复杂模式相关性达0.999。Informer精度接近（F1: 0.683），训练速度提升30%。经典方法在简单合成数据上预测完美，成本低60%，但在真实数据上F1得分低2-3。预测质量主导检测性能：模型间差异（F1: 0.344–0.688）远大于检测方法间差异（F1: 0.621–0.688）。研究提供实证指导：复杂模式用LSTM，效率优先选Informer，资源受限且数据简单时用经典方法。完整实现与结果为后续研究建立基准。
原文摘要 · Abstract (English)
Time series anomaly detection is critical for modern digital infrastructures, yet existing methods lack systematic cross-domain evaluation. We present a comprehensive forecasting-based framework unifying classical methods (Holt-Winters, SARIMA) with deep learning architectures (LSTM, Informer) under a common residual-based detection interface. Our modular pipeline integrates preprocessing (normalization, STL decomposition), four forecasting models, four detection methods, and dual evaluation through forecasting metrics (MAE, RMSE, PCC) and detection metrics (Precision, Recall, F1, AUC). We conduct the first complete evaluation on the Numenta Anomaly Benchmark (58 datasets, 7 categories) with 232 model training runs and 464 detection evaluations achieving 100\% success rate. LSTM achieves best performance (F1: 0.688, ranking first or second on 81\% of datasets) with exceptional correlation on complex patterns (PCC: 0.999). Informer provides competitive accuracy (F1: 0.683) with 30\% faster training. Classical methods achieve perfect predictions on simple synthetic data with 60 lower cost but show 2-3 worse F1-scores on real-world datasets. Forecasting quality dominates detection performance: differences between detection methods (F1: 0.621-0.688) are smaller than between forecasting models (F1: 0.344-0.688). Our findings provide evidence-based guidance: use LSTM for complex patterns, Informer for efficiency-critical deployments, and classical methods for simple periodic data with resource constraints. The complete implementation and results establish baselines for future forecasting-based anomaly detection research.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。