Dual-Score Association-Discrepancy Enhancement for Early-Warning Multivariate Time-Series Anomaly Detection

1. Introduction

Multivariate time-series anomaly detection is a key task in server monitoring, cyber-physical systems, industrial safety, and intelligent operation and maintenance [1,2,3,4]. Modern monitoring platforms collect correlated variables such as CPU utilization, network traffic, memory usage, disk input/output, and status indicators. Faults, attacks, or performance degradation often appear as continuous abnormal segments or association changes rather than isolated points.

Deep models have improved anomaly detection by learning nonlinear temporal and cross-variable patterns [11,12,13,14,15,16,17,18,19,20]. Among them, Anomaly Transformer is relevant because it uses association discrepancy between learned series associations and prior associations as an anomaly-related signal [21]. This mechanism can reflect not only large reconstruction errors but also disruptions in temporal association.

Despite these advances, evaluation remains a practical challenge. Point-wise precision, recall, and F1 require exact alignment between predictions and labels. Point adjustment, which is widely used in time-series anomaly detection, marks an anomalous segment as correctly detected once at least one point inside the segment is hit [21,22]. This protocol improves comparability with prior work, but it may hide late alarms. In early-warning applications, a method that detects an anomaly near the end of its segment is less useful than one that fires near the beginning.

This paper addresses this issue from the score-construction perspective. Instead of redesigning the backbone, we propose a lightweight association-discrepancy-enhanced dual-score module for Anomaly Transformer. The module keeps the original multiplicative score and adds two window-normalized terms: reconstruction error and association discrepancy. Reconstruction error reflects numerical deviation, while association discrepancy reflects structural mismatch; combining them at the score level strengthens early responses to weak abnormal signals.

The main contributions are as follows:

• A dual-score enhancement module is proposed for Anomaly Transformer. It combines the original score, reconstruction deviation, and association discrepancy without extra supervision.
• An early-warning-oriented evaluation is used, including PA-P, PA-R, PA-F1, event-level precision, event-level recall, mean detection delay, partial-hit score, AUPRC, Affiliation-F1, PATE-style F1, Range-AUC, and VUS-style metrics.
• Experiments on SMD, PSM, SMAP, and MSL show that the proposed method consistently improves event recall and reduces detection delay, while AUPRC and point-adjusted scores reveal the expected trade-off between early warning and point-wise precision.

2. Related Work

2.1. Multivariate Time-Series Anomaly Detection

Anomaly detection has been extensively studied in data mining and machine learning [1,4]. Time-series anomaly detection is more difficult because observations are temporally dependent and anomalies often cover intervals rather than individual samples [2,3]. Classical one-class or density-based methods, including One-Class SVM, support vector data description, local outlier factor, and Isolation Forest, provide useful baselines but are limited in high-dimensional temporal dependency modeling [26,27,28,31].

Deep learning methods learn temporal representations directly from data. LSTM encoder–decoder models, dynamic thresholding, prediction models, stochastic models, signature-matrix methods, adversarial models, mixture models, and memory-augmented autoencoders have been used for anomaly detection [11,12,13,14,15,16,17,23,24,25]. Graph-based methods further emphasize cross-variable dependency modeling [18,19,32].

2.2. Transformer Models and Evaluation Protocols

Transformer models have become important in sequence and time-series modeling since the introduction of self-attention [5]. Informer, Autoformer, TimesNet, Temporal Fusion Transformer, PatchTST, and DeepAR-related forecasting models show the effectiveness of attention and temporal representation learning [6,7,8,9,10,29,30]. For anomaly detection, TranAD applies Transformer networks to multivariate sequences [20], while Anomaly Transformer introduces association discrepancy for anomaly scoring [21].

Evaluation protocols are equally important. Point-adjusted F1 is useful for segment-level hit assessment, but it does not directly measure how early the first alarm occurs [21,22]. Recent studies further point out that range-aware, proximity-aware, and volume-based criteria are needed for continuous time-series anomalies [33,34,35,36]. For monitoring systems, event-level recall, detection delay, partial-hit, AUPRC, Affiliation-style F1, PATE-style F1, Range-AUC, and VUS-style scores provide a more informative view of early-warning performance. This paper therefore reports both conventional PA metrics and early-warning-oriented metrics.

3. Materials and Methods

3.1. Problem Definition

Let a multivariate time series be

$$X={\left\{x_t\right\}}_{t=1}^T,x_t\in {\mathbb{R}}^C,$$

(1)

where T is the sequence length and C is the number of variables. In unsupervised anomaly detection, only normal training data are used to learn the model. During testing, each time point receives an anomaly score $S\left(t\right)$, and a binary prediction is obtained by

$${\widehat{y}}_t=\left\{\begin{array}{cc}1,\hfill & S\left(t\right)>\tau ,\hfill \\ 0,\hfill & S\left(t\right)\le \tau ,\hfill \end{array}\right.$$

(2)

where $\tau$ is the threshold.

The model uses sliding windows. For window length w, the input ending at time t is

$$X_t^{\left(w\right)}=[x_{t-w+1},x_{t-w+2},\dots ,x_t]\in {\mathbb{R}}^{w\times C}.$$

(3)

In the SMD experiments, $w=100$ and $C=38$, so each batch has the shape $B\times 100\times 38$.

3.2. Base Score and Enhanced Dual Score

Anomaly Transformer reconstructs the input window and produces attention association matrices. Let ${\widehat{x}}_t$ be the reconstruction of $x_t$. The reconstruction error is

$$E_t={\displaystyle \frac{1}{C}}{\displaystyle \sum _{c=1}^C}{(x_{t,c}-{\widehat{x}}_{t,c})}^2.$$

(4)

Let $Q_t^{(\ell )}$ and $P_t^{(\ell )}$ denote the learned series association and the normalized prior association at layer ℓ. The association discrepancy is computed by a symmetric KL form:

$$D_t={\displaystyle \sum _{\ell =1}^L}\left[KL(Q_t^{(\ell )}\parallel P_t^{(\ell )})+KL(P_t^{(\ell )}\parallel Q_t^{(\ell )})\right].$$

(5)

The original multiplicative score is

$$S_{\mathrm{base}}\left(t\right)={\left[softmax(-D)\right]}_t{E}_t.$$

(6)

To strengthen early abnormal responses, the proposed method normalizes both $E_t$ and $D_t$ inside the current window. For a quantity $u_t$, window normalization is

$$z_W\left(u_t\right)={\displaystyle \frac{u_t-{\mu }_W\left(u\right)}{{\sigma }_W\left(u\right)+ϵ}},$$

(7)

where ${\mu }_W\left(u\right)$ and ${\sigma }_W\left(u\right)$ are the window mean and standard deviation, and $ϵ$ prevents numerical instability. The enhanced score is

$$S_{\mathrm{enh}}\left(t\right)=S_{\mathrm{base}}\left(t\right)+z_W\left(E_t\right)+\lambda z_W\left(D_t\right),$$

(8)

where $\lambda$ controls the contribution of association discrepancy. The main experiments use $\lambda =0.3$.

3.3. Relation to Anomaly Transformer

The proposed method does not replace Anomaly Transformer. It uses the same trained backbone, the same reconstruction output, and the same association matrices. The difference lies in the construction and use of the anomaly score. The original Anomaly Transformer score multiplies reconstruction error by a softmax-transformed association-discrepancy term. This is effective for point-wise scoring, but weak onset deviations may still be suppressed when the multiplicative term is small. The proposed dual-score module explicitly re-injects the local standardized reconstruction error and association discrepancy into the final score. Therefore, the contribution is a post-training, score-level early-warning enhancement rather than a new network architecture. This design is useful in deployment scenarios where retraining or changing the backbone is costly, but the alarm policy can be adjusted.

3.4. Union Early-Warning Mode and Thresholding

For high-recall warning scenarios, this paper also uses a union mode:

$${\widehat{y}}_t^{\mathrm{union}}=\mathbb{I}(S_{\mathrm{base}}\left(t\right)>{\tau }_{\mathrm{base}})\vee \mathbb{I}(S_{\mathrm{enh}}\left(t\right)>{\tau }_{\mathrm{enh}}).$$

(9)

This mode usually improves anomalous segment coverage and reduces delay, but may reduce precision.

To keep the protocol consistent with Anomaly Transformer, the threshold is selected by an anomaly-ratio rule:

$$\tau =Percentile(\{S_{\mathrm{train}},S_{\mathrm{test}}\},100-r).$$

(10)

The SMD experiments use $r=0.5$. In union mode, the base and enhanced scores are thresholded separately.

3.5. Workflow

Figure 1 summarizes the method. The input series is segmented into sliding windows and passed into Anomaly Transformer. Reconstruction output and association matrices are then used to compute $E_t$, $D_t$, $S_{\mathrm{base}}\left(t\right)$, and $S_{\mathrm{enh}}\left(t\right)$. The final prediction is obtained by thresholding the selected score or by using union mode.

4. Experiments

4.1. Dataset and Settings

The experiments use four public multivariate time-series anomaly detection benchmarks: SMD, PSM, SMAP, and MSL. SMD is a server monitoring benchmark released with OmniAnomaly [14]. SMAP and MSL are spacecraft telemetry benchmarks [12]. PSM is a server-machine monitoring benchmark commonly used in the Anomaly Transformer protocol [21]. These datasets cover different domains and variable dimensions, which helps evaluate whether the score-level enhancement generalizes beyond a single benchmark.

Table 1. Datasets used in the revised experiments.

Dataset	Domain	Variables	Anomaly ratio used for thresholding
SMD	Server monitoring	38	0.5
PSM	Server monitoring	25	1.0
SMAP	Spacecraft telemetry	25	1.0
MSL	Spacecraft telemetry	55	1.0

Table 1. Datasets used in the revised experiments.

Dataset	Domain	Variables	Anomaly ratio used for thresholding
SMD	Server monitoring	38	0.5
PSM	Server monitoring	25	1.0
SMAP	Spacecraft telemetry	25	1.0
MSL	Spacecraft telemetry	55	1.0

The compared methods are the original Anomaly Transformer score, the proposed dual-score module, and the union early-warning mode. All methods use the same Anomaly Transformer backbone. The batch size is 256, the learning rate is $1\times {10}^{-4}$, the maximum number of epochs is 10, early-stopping patience is 3, and the score temperature is 50.0. The window length is 100. Main results are averaged over seeds 2025, 2026, and 2027. For SMD, the sampling interval is approximately one minute, so one delay step corresponds to about one minute; for the other datasets, delay is reported in benchmark time steps.

4.2. Evaluation Metrics

Point-level precision, recall, and F1 are

$$P={\displaystyle \frac{TP}{TP+FP}},R={\displaystyle \frac{TP}{TP+FN}},F1={\displaystyle \frac{2PR}{P+R}}.$$

(11)

PA-P, PA-R, and PA-F1 are computed after point adjustment. For event-level evaluation, let $\mathcal{G}$ be the set of ground-truth anomalous segments and $\mathcal{P}$ be the set of predicted anomalous segments:

$$P_{\mathrm{event}}={\displaystyle \frac{\left|\right\{P_i:\exists G_j,P_i\cap G_j\ne ⌀\left\}\right|}{\left|\mathcal{P}\right|}},$$

(12)

$$R_{\mathrm{event}}={\displaystyle \frac{\left|\right\{G_j:\exists t\in G_j,{\widehat{y}}_t=1\left\}\right|}{\left|\mathcal{G}\right|}},F{1}_{\mathrm{event}}={\displaystyle \frac{2P_{\mathrm{event}}{R}_{\mathrm{event}}}{P_{\mathrm{event}}+R_{\mathrm{event}}}}.$$

(13)

For a detected anomalous segment $G_j=[a_j,b_j)$, the delay is ${\delta }_j=min\{t-a_j:t\in [a_j,b_j),{\widehat{y}}_t=1\}$. The mean delay and partial-hit score are

$${\mathrm{Delay}}_{\mathrm{mean}}={\displaystyle \frac{1}{\left|\mathcal{D}\right|}}\sum _{j\in \mathcal{D}}{\delta }_j,$$

(14)

$$\mathrm{PartialHit}={\displaystyle \frac{1}{\left|\mathcal{G}\right|}}{\displaystyle \sum _{j=1}^{\left|\mathcal{G}\right|}}\left\{\begin{array}{cc}exp(-{\delta }_j/|G_j\left|\right),\hfill & G_j\mathrm{is}\mathrm{detected},\hfill \\ 0,\hfill & G_j\mathrm{is}\mathrm{not}\mathrm{detected}.\hfill \end{array}\right.$$

(15)

AUPRC measures the area under the precision–recall curve of anomaly scores.

To address reviewer concerns about range- and proximity-aware evaluation, we additionally report Affiliation-style F1, PATE-style F1, Range-AUC, and VUS-style metrics [33,34,35,36]. Affiliation-style precision and recall evaluate the overlap between predicted ranges and ground-truth ranges rather than isolated points. PATE-style F1 gives partial credit to predictions close to an anomalous range, so near-boundary early alarms are not treated the same as distant false alarms. Range-PR-AUC and Range-ROC-AUC integrate range-aware precision–recall and ROC behavior over thresholds. VUS-style scores further average range-AUC values over different tolerance buffer sizes. These metrics are reported as supplementary evidence because the main goal of this paper is early warning rather than only point-wise matching.

4.3. Main Results

Table 2 reports the main results. The proposed method improves early-warning behavior on all four datasets. Compared with the baseline, the union mode increases Raw Event Recall by 0.3435, 0.2408, 0.0995, and 0.0278 on SMD, PSM, SMAP, and MSL, respectively. The corresponding mean-delay reductions are 53.66%, 49.97%, 52.69%, and 39.74%. Dual-score alone is especially effective on SMD and also improves event-level behavior on PSM. On SMAP and MSL, union mode is more robust because it preserves baseline hits while adding enhanced-score hits. AUPRC is dataset-dependent: it improves clearly on SMD, but does not improve on every dataset. Therefore, the main advantage of the proposed method should be interpreted as early-warning improvement rather than universal point-wise ranking improvement.

4.4. Range- and Proximity-Aware Metrics

Table 3 reports supplementary range- and proximity-aware metrics. The enhanced scores improve Range-AUC and VUS-style scores on all datasets because the raw score distribution becomes more sensitive to anomalous regions. Union mode changes the binary prediction but uses the same enhanced score for threshold-swept metrics; therefore, its Range-AUC and VUS values are close to those of dual-score.

4.5. Parameter Sensitivity

Table 4 reports the sensitivity of $\lambda$ on SMD and PSM. On SMD, a larger value such as $\lambda =0.7$ gives the lowest delay and the highest event recall. On PSM, however, larger values increase delay substantially, while $\lambda =0.1$–0.3 gives a better early-warning trade-off. Therefore, $\lambda =0.3$ is used as the main cross-dataset setting because it is stable across both datasets rather than over-tuned to SMD.

4.6. Case-Style Early-Warning Visualization

Figure 2 provides a compact visual comparison of the early-warning effect. The union mode improves event recall and reduces delay on all four datasets. This visual result is consistent with Table 2: the method sacrifices some point-adjusted precision in several datasets, but it detects more anomalous segments and triggers alarms earlier.

5. Discussion

The results show that PA-F1 and early-warning metrics can lead to different interpretations. The baseline often obtains strong PA-F1 because point adjustment rewards any hit inside an anomaly range. However, this does not guarantee that the alarm appears early. In contrast, the proposed score-level enhancement is designed to improve raw event coverage and reduce first-hit delay. This explains why union mode improves Event-R and Delay on all four datasets, even when PA-F1 or AUPRC does not always improve.

The method is lightweight because it uses reconstruction error and association discrepancy already produced by Anomaly Transformer and changes only the anomaly score. It is therefore different from architectural methods that redesign patch encoders, memory modules, graph structures, or online adaptation mechanisms. The benefit is deployment simplicity: an existing trained backbone can be reused, and only the score construction and alarm policy need to be modified.

There are still limitations. First, the threshold follows the fixed anomaly-ratio protocol used in Anomaly Transformer to maintain benchmark comparability. This does not fully address distribution shift in streaming environments. Second, the range- and proximity-aware metrics used here are dependency-free implementations for supplementary analysis; future work should also integrate official benchmark toolkits when available. Third, union mode increases recall by design and may introduce more false alarms. In practice, it should be selected for risk-sensitive scenarios where early warning is more valuable than maximum point-wise precision.

6. Conclusions

This paper proposed a dual-score association-discrepancy enhancement for early-warning multivariate time-series anomaly detection. By combining the original Anomaly Transformer score with normalized reconstruction error and association discrepancy, the method improves early abnormal responses without additional supervision or backbone modification. Experiments on SMD, PSM, SMAP, and MSL show that the union early-warning mode consistently improves Raw Event Recall and reduces mean detection delay. The improvements are especially clear on SMD and PSM, and range/proximity-aware metrics further support the early-warning benefit. AUPRC shows dataset-dependent behavior, indicating that early-warning performance and point-wise ranking performance should be analyzed separately. These results support score-level enhancement as a practical complement to Transformer-based anomaly detectors in early-warning scenarios.