Anomaly Detection in Time Series Data via Multi-Source Feature Clustering: A Cross-Modal Approach Based on Deep Metric Learning

1. Introduction

Time series data in different environments often encompass a variety of relevant information and attributes, such as network traffic node categories, personal information in social media, and registration time. These can all be considered as attributes of time series data[1,2]. Research on time series data, especially for defining human or object activity patterns, has strong practical significance. Eliminating abnormal data interference has become a crucial challenge[3] , and is also the main focus of this paper.

To address the problem of anomaly detection, literature[4] adopts short-term memory network prediction to estimate the difference between predicted and actual values, and then uses a sliding window to model the distribution of differences. By estimating the probability density of the distribution within each segment, it obtains the probability of data anomalies. However, this method is not suitable for data with strong periodicity changes and lacks generalizability. Literature[5] uses a multi-Gaussian mixture model for binary feature probability density analysis. A sliding time window is used to construct a corrected data set. Within each window, the Grubbs test is used to complete the anomaly detection process. This method requires parameter tuning for the time window, and detection results are easily affected by parameter settings.

Based on the above, in response to the practical needs of time series anomaly detection, this paper proposes a time series anomaly detection method based on cross-modal deep metric learning. A cross-modal deep metric learning model is constructed, which optimizes feature spatial distribution using mean center measures, classifies time series data with different forms, and applies kernel principal component analysis (KPCA) to compute the probability distribution of principal component direction vectors of the data set. By comparing the probability values, the presence of anomalies is assessed. Simulation results show that the proposed method has practical application value.

2. Related Work

Anomaly detection in time series has gained significant traction with the rise of data-driven applications across sectors such as finance, cloud computing, and healthcare. These applications demand robust models capable of handling noisy, high-dimensional, and heterogeneous inputs. Traditional statistical approaches often fall short in terms of adaptability and precision, particularly in complex and dynamic environments. Consequently, research has increasingly focused on deep learning-based techniques that emphasize representation learning and generalization-aware strategies.

Recent studies have introduced contrastive learning methods designed for heterogeneous backend systems, highlighting the importance of feature discrimination when processing unstructured data [6]. This approach enables models to capture semantic similarities and differences without relying on handcrafted features. In related work, federated contrastive learning has been applied to detect behavioral anomalies in distributed environments while preserving data privacy [7]. Complementing these strategies, deep regression techniques have been utilized to forecast transmission time under variable network conditions, facilitating latency-aware anomaly detection [8].

Improving forecasting reliability under non-stationary and cross-domain conditions remains a critical challenge. Meta-learning has been explored to generalize knowledge across diverse workloads [9], while multi-task learning frameworks have enhanced predictive performance in contexts with limited data overlap [10]. These adaptive methods are vital for developing models that perform well not only on seen patterns but also on unforeseen operational scenarios.

The fusion of contrastive, federated, and meta-learning paradigms continues to push the boundaries of anomaly detection. Federated meta-learning techniques have shown success in detecting node-level faults within heterogeneous infrastructures [11]. Similarly, meta-learning frameworks have been proposed to enable elastic resource scaling in cloud-native systems [12]. Advancements in language modeling further contribute to this progress; prompt-based adaptations have been studied for low-resource tasks [13], while structured gradient and low-rank adaptation mechanisms have improved few-shot learning performance [14,15,16].

Natural language processing (NLP) and large language models (LLMs) have also emerged as powerful tools for anomaly characterization. Structural reconfiguration mechanisms have been proposed to support parameter-efficient fine-tuning of LLMs tailored to specific tasks [17]. Attention-based architectures have been used to model microservice access patterns, uncovering latent semantics beneficial for anomaly detection [18]. In addition, context-aware frameworks have been developed to detect hallucinations in LLM outputs [19]. Within the clinical domain, attention-enhanced models have achieved promising results for multi-disease prediction and classification [20,21]. Instruction encoding and gradient coordination strategies have improved multi-task generalization [22], while perception-guided structural designs have enhanced LLM robustness in dynamic environments [23].

Reinforcement learning (RL) continues to play a significant role in resource management and anomaly detection across real-time systems. RL-based approaches have enabled autonomous resource allocation in microservices [24], while multi-agent reinforcement strategies have supported scalable, collaborative optimization [25]. Edge-level applications have integrated deep Q-networks (DQNs) for intelligent scheduling [26], and subspace ensemble sampling guided by RL has been proposed for navigating high-dimensional anomaly boundaries [27].

Structured anomaly detection has also benefited from graph-based methods. Graph attention networks have been applied to detect fraud in financial transactions by capturing relational dependencies [28]. In the context of social data, hybrid BiLSTM-CRF models enriched with social features have improved entity recognition accuracy [29]. Heterogeneous graph learning techniques have been used to discover implicit relationships in corporate networks [30], while hybrid graph-sequential models have demonstrated scalable traffic estimation capabilities [31]. Causal representation learning has further enhanced prediction of financial returns under market volatility [32].

Fine-tuning strategies tailored for LLMs have also been instrumental in low-data, high-variability contexts. Transaction graph integration has supported real-time risk monitoring in financial systems [33], while attention-augmented recurrent networks have improved forecasting under noise and time drift [34]. Gradient coordination and perception-guided structures have improved multi-task modeling and contextual adaptability [35,36]. In addition, structured gradient guidance and low-rank adaptation techniques have bolstered few-shot learning robustness [37,38].

Collaborative and privacy-preserving learning frameworks have also made notable contributions. Federated recommendation systems have been optimized through the integration of user interest modeling and differential privacy [39]. In human-computer interaction, capsule network-based architectures have improved semantic intent modeling [40], while lightweight compression strategies have enabled edge deployment of deep models [41]. Efforts in hybrid sequence modeling and low-rank adaptation have addressed the need for efficient dynamic learning [42,43].

Real-world applications underscore the practical relevance of these advancements. In high-frequency trading scenarios, deep learning pipelines have demonstrated efficacy in capturing microsecond-level anomalies [44]. In regulatory and auditing settings, automated report generation using pretrained language models has shown promise in bridging structured data with textual compliance analysis [45].

Collectively, these advancements provide the foundational insights for this study, which proposes a unified framework incorporating cross-modal deep metric learning, kernel principal component analysis (KPCA), and von Mises–Fisher (vMF) modeling. The objective is to enable robust and generalizable anomaly detection in complex time series settings, where traditional methods often struggle.

3. Time Series Feature Clustering Based on Cross-Modal Deep Metric Learning

Network data often includes multiple types of time series features. To simplify the complexity of time series anomaly detection and enhance detection efficiency and accuracy, a time series feature clustering method based on cross-modal deep metric learning is proposed. The overall model architecture is illustrated in Figure 1.

In the feature space, time series data from different scenarios are more distant from each other, and the probability of confusion is lower. Therefore, the cross-modal deep metric learning model outputs a spatial feature distribution that strengthens the accuracy of feature clustering[46]. The following uses the mean center distance measure to optimize the spatial feature distribution.

Assume $d_{ij}$ is the squared Euclidean distance between the centers of cluster i and cluster j. The calculation is as follows:

$$d_{ij}=\sum _{k=1}^N{(c_{ik}-c_{jk})}^2$$

(1)

where $i,j$ are cluster labels, N is the number of samples, and $c_{ik},c_{jk}$ are the k-th dimension values of the center vectors of clusters i and j.

The loss function for the cross-modal deep metric learning model consists of two parts[47]: the cross-entropy loss $L_s$ and the mean center loss $L_{cm}$, weighted by coefficients ${\lambda }_1,{\lambda }_2$:

$$L=L_s+{\lambda }_1{L}_{cm}+{\lambda }_2{(\parallel W\parallel }_2^2+{\parallel b\parallel }_2^2)$$

(2)

Assume the time series sample set contains N samples, defined as:

$$\mathcal{N}=\{(x_i,y_i)\mid x_i\in {\mathbb{R}}^a,y_i\in {\mathbb{R}}^k,i=1,2,\dots ,N\}$$

(3)

$$x_i=[x_{i1},x_{i2},\dots ,x_{ia}]$$

(4)

$$y_i=[y_{i1},y_{i2},\dots ,y_{ik}]$$

(5)

Here, a is the feature dimension of model output, $x_i$ is the feature vector, and $y_i$ is the corresponding label vector.

The cross-entropy loss $L_s$ and the mean center loss $L_{cm}$ are defined as follows:

$$L_s=-\sum _{i=1}^{m}log{\displaystyle \frac{e^{w_{y_i}^T{x}_i+b_{y_i}}}{{\sum }_{j=1}^K{e}^{w_j^T{x}_i+b_j}}}$$

(6)

$$L_{cm}={\displaystyle \frac{1}{2}}\left(\sum _{i=1}^m\parallel x_i-c_{y_i}{\parallel }_2^2+\sum _{j=1}^K\sum _{k=1}^{K}h(\mathrm{margin}-\parallel c_j-c_k{\parallel }_2,0)\right)$$

(7)

where m is the number of training samples per batch. To enhance classification accuracy, the model is optimized via stochastic gradient descent (SGD). The gradients of $L_{cm}$ w.r.t. sample $x_i$ and cluster center $c_n$ are:

$${\displaystyle \frac{\partial L_{cm}}{\partial x_i}}=x_i-c_{y_i}$$

(8)

$$\Delta c_n={\displaystyle \frac{{\sum }_{i=1}^m\delta (y_i=n)(c_n-x_i)}{1+{\sum }_{i=1}^m\delta (y_i=n)}}$$

(9)

where $\delta (·)$ is the indicator function and n denotes the class label.

4. Anomaly Detection of Time Series Data Based on Kernel Principal Component Analysis

After categorizing the features of time series data, the next step is to detect anomalies in different types of time series data. This section proposes an anomaly detection method based on Kernel Principal Component Analysis (KPCA).

Principal Component Analysis (PCA) is a linear feature extraction method that decomposes the covariance matrix of the data[48,49]. By selecting the top M eigenvectors with the largest eigenvalues, it constructs a projection matrix to project the data into a low-dimensional subspace, achieving dimensionality reduction, noise removal, and decorrelation. If the data in the input space is non-linearly distributed, kernel transformation is applied to map the data into a higher-dimensional feature space where it becomes linearly separable. The PCA is then conducted in this space, a process known as Kernel PCA.

Let $x_i\in {\mathbb{R}}^p$ be one of N samples in the input space. With a non-linear mapping $\varphi$, the input data is projected into the feature space $F\left(R^p\right)$. Thus, $\varphi \left(x_i\right)$ are the mapped samples. To perform PCA in this high-dimensional space, we calculate the covariance matrix of the centered feature vectors:

$$C_{\varphi }={\displaystyle \frac{1}{N}}\sum _{i=1}^N\varphi \left(x_i\right)\varphi {\left(x_i\right)}^T$$

(10)

The relationship between the covariance matrix and eigenvectors is:

$$C_{\varphi }v=\sigma v$$

(11)

where $\sigma$, v are the eigenvalues and eigenvectors of $C_{\varphi }$, respectively.

Since $C_{\varphi }$ is symmetric[50], it contains r non-zero orthogonal eigenvectors. Due to high dimensionality, we express v as a linear combination of samples in the feature space:

$$v=\sum _{j=1}^N{\alpha }_j\varphi \left(x_j\right)$$

(12)

The kernel matrix is then defined by:

$$K\alpha =\lambda N\alpha$$

(13)

where $\alpha$ is the coefficient vector.

To identify anomalies, we compute the directional projection of time series data into the feature space. Selecting the top M eigenvectors, we compute the mean direction of the time series:

$$\theta =[{\theta }^1,{\theta }^2,\dots ,{\theta }^m]$$

(14)

where ${\theta }^i$ denotes the directional characteristics of the i-th time series.

After the detection model is trained on historical time series, we evaluate whether new data align with historical distributions. Assume two sets of principal direction vectors, and their inner product is computed by:

$$\langle v^1,v^2\rangle =\sum _{i=1}^N\sum _{j=1}^N{\alpha }_i^1{\alpha }_j^{2}k(x_i^1,x_j^2)$$

(15)

$$=\sum _{i=1}^N\sum _{j=1}^N{\alpha }_i^1{\alpha }_j^2\varphi {\left(x_i^1\right)}^T\varphi \left(x_j^2\right)$$

(16)

$$=\sum _{i=1}^N\sum _{j=1}^N{\alpha }_i^1{\alpha }_j^{2}K(x_i^1,x_j^2)$$

(17)

To normalize the direction vector, we define:

$$\overline{v}={\displaystyle \frac{c}{M}}\sum \left(v_i\right)$$

(18)

For anomaly scoring, we use the von Mises-Fisher (vMF) distribution[51] to model directional features. The distribution function is:

$$M_p\left(v_i\right|c_p,k)=c_p\left(k\right)e^{k{c}_p^T{v}_i}$$

(19)

The normalization constant is:

$$c_p\left(k\right)={\displaystyle \frac{k^{p/2-1}}{{\left(2\pi \right)}^{p/2}{I}_{p/2-1}\left(k\right)}}$$

(20)

where $I_{p/2-1}(·)$ is the modified Bessel function of the first kind.

Assume R is the mean length of the principal direction vectors, then the concentration parameter k is:

$$k={\displaystyle \frac{R_p-R^3}{1-R^2}}$$

(21)

To detect anomalies, compare the cumulative distribution value under the vMF model with a threshold $\epsilon$. If:

$$p={\int }_{-\infty }^{-\eta }{c}_p\left(k\right)e^{k\theta }d\theta +{\int }_{\eta }^{\infty }{c}_p\left(k\right)e^{k\theta }d\theta <\epsilon$$

(22)

then the data is considered anomalous.

5. Simulation Study

5.1. Simulation Setup

To verify the advantages of the proposed anomaly detection method for time series data, we compare it with the sliding window method in[4] and the binary feature method in[5]. Experiments were implemented on a deep learning platform using the TensorFlow framework, with a simulation period of 800ms.

The experiments are divided into two parts: time series classification and anomaly detection. The time series dataset contains 12,463 sequences, of which 6,792 are used for training and 5,671 for testing. Two evaluation metrics were used: Root Mean Square Error (RMSE) and Mean Absolute Error (MAE). RMSE measures the square root of the average squared difference between predicted and actual values; MAE measures the average absolute error.

$$RMSE=\sqrt{{\displaystyle \frac{1}{m}}\sum _{i=1}^m{(y_i-f_i)}^2}$$

(23)

$$MAE={\displaystyle \frac{1}{m}}\sum _{i=1}^m|y_i-f_i|$$

(24)

where $y_i$ and $f_i$ denote the true and predicted values of time series data at time i.

5.2. Time Series Classification Results

As shown in Figure 2, when the training sample size increases from 400 to 3200, the accuracy of the sliding window method improves from 76% to 93%, and the binary feature method improves from 78% to 94%. The proposed method increases from 88% to 96%. The results demonstrate that the proposed method performs better across varying sample sizes.

5.3. Time Series Anomaly Detection Analysis

Table 1 shows that the proposed method consistently achieves lower RMSE and MAE compared to the other two methods, especially under small sample sizes, indicating superior detection robustness.

Figure 3 illustrates the average time consumption for anomaly detection. The proposed method consistently exhibits the lowest detection time compared to others, showcasing both accuracy and efficiency.

6. Conclusion

To address the shortcomings of traditional anomaly detection in time series data, this paper proposes a cross-modal deep metric learning method. By constructing a cross-modal deep metric learning model and combining it with kernel principal component analysis, the method effectively evaluates feature vector anomalies and detects abnormal data.

Experimental results demonstrate that this method not only achieves high classification accuracy across various types of time series data, but also offers efficient anomaly detection and robustness. Future research will explore the impact of kernel function selection on detection performance and further improve the model.