Anomaly detection

As explained in Time Series Forecasting Using Foundation Models

Anomaly detection is the task of identifying observations or patterns that substantially deviate from expected behavior.

Anomaly detection identifies observations or patterns that substantially deviate from expected behavior. In time series, a practical approach forecasts historical values and flags points outside a prediction interval. section 3.8

Forecast-based detection repurposes probabilistic forecasting rather than using a separate anomaly-specific technique. Rolling or historical forecasts produce lower and upper bounds; an actual value outside those bounds receives an anomaly label. section 3.8 section 6.4

A typical implementation proceeds as follows:

• Prepare a time series with timestamps, target values, and—when available—actual anomaly labels for evaluation. section 3.8.1
• Generate historical or rolling forecasts over the period being tested, using windows and a forecast horizon that cover the desired dates. section 5.8 section 6.4
• Compute prediction intervals and flag each actual value below the lower bound or above the upper bound. section 9.5 section 9.5.1
• Measure precision, recall, and F1 score; inspect the trade-off because narrower intervals increase recall but reduce precision. section 3.10 section 6.4

Daily taxi rides

On daily New York City taxi-customer counts from July 2014 through January 2015, TimeGPT used historical forecasts and a 99% prediction interval. It labeled eight points anomalous while four were actual anomalies, illustrating false positives and missed early points. Chronos found all labeled anomalies but achieved only 21% precision; Moirai also found all actual anomalies and achieved the best reported F1 score in that experiment, 0.53. These single-dataset results are comparisons, not comprehensive benchmarks. section 3.8.1 section 5.8 section 6.4

Figure 3.18 Plotting the anomalies detected by TimeGPT. The dotted line shows the historical forecasts. The shaded area represents the 99% prediction interval. If a point falls outside the interval, it is labeled an anomaly. Diamonds indicate predicted anomalies, and dots represent the actual anomalies not detected by TimeGPT. If a detected anomaly and an actual anomaly coincide, meaning that the model identified the anomaly correctly, only a diamond is shown.

Inspect the forecast line, shaded 99% prediction interval, predicted anomaly diamonds, and labeled anomaly dots. section 3.8.1

How Time Series Forecasting Using Foundation Models covers it

How deep it goes

Works through rolling forecasts, interval thresholds, implementation functions, plots, and precision-recall evaluation, but stops short of comprehensive benchmarking.

Examples

Uses daily New York City taxi rides to compare TimeGPT, Chronos, Moirai, Time-LLM, Flan-T5, and Llama-3.2.

What it assumes

Assumes basic Python and time-series handling while demonstrating interval-based labeling, rolling forecasts, and classification metrics.

What you can do after

Apply it via forecasting APIs or Python workflows, then diagnose detections with plots and precision, recall, and F1 score.

How it connects

Connects anomaly detection with time-series forecasting, prediction intervals, cross-validation, conformal prediction, precision, recall, and F1 score.

liveBookmanning.com

Read Time Series Forecasting Using Foundation Models on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Data-Driven CybersecurityAn anomaly is an observation or activity that deviates significantly from an expected pattern or reference value.
• 

  liveBookmanning.com
  Financial AI in PracticeThe identification of observations or patterns that substantially differ from expected behavior, including without labeled training examples.
• 

  liveBookmanning.com
  Cloud Observability in ActionAnomaly detection is the identification of observations or behavior that significantly deviates from an established normal baseline.
• 

  liveBookmanning.com
  Digital Twins in ActionAn anomaly is an observation or condition that deviates from expected system behavior or normal operating patterns.
• 

  liveBookmanning.com
  Machine Learning Algorithms in DepthA technique for identifying observations that differ substantially from established data patterns.
• 

  liveBookmanning.com
  Data Without LabelsAnomaly detection is the identification of observations or behaviors that deviate substantially from an expected pattern.

Compare how 7 books explain anomaly detection →

Related concepts

• fraud detectioncontrasts with · Fraud detection is the process of identifying transactions, activities, or other events suspected of involving intentional deception or unauthorized gain.
• autoencoderaddressed by · An autoencoder is a neural network that encodes input data into an internal representation and decodes it to reconstruct the input or an approximation.
• unsupervised learningused by · Unsupervised learning is a machine-learning approach that discovers patterns, structure, or representations in data without labeled target outputs.
• support vector machineused by · A support vector machine is a supervised-learning model that uses support vectors to determine a maximum-margin decision boundary or regression function, optionally using kernels to model nonlinear relationships.
• prediction intervalconfigured by · A prediction interval is a range computed from a forecasting model that is expected to contain a future or unobserved value at a specified confidence level.

This explainer was generated by Manning's knowledge graph from the text of Time Series Forecasting Using Foundation Models. The section links point to the parts of the book it draws on.