Moon: A Modality Conversion-based Efficient Multivariate Time Series Anomaly Detection

Abstract--Multivariate time series (MTS) anomaly detection identifies abnormal patterns where each timestamp contains multiple variables. Existing MTS anomaly detection methods fall into three categories: reconstruction-based, prediction-based, and classifier-based methods. However, these methods face two key challenges: (1) Unsupervised learning methods, such as reconstruction-based and prediction-based methods, rely on error thresholds, which can lead to inaccuracies; (2) Semi-supervised methods mainly model normal data and often underuse anomaly labels, limiting detection of subtle anomalies; (3) Supervised learning methods, such as classifier-based approaches, often fail to capture local relationships, incur high computational costs, and are constrained by the scarcity of labeled data. Finally, a SHAP-based anomaly explainer identifies key variables contributing to anomalies, improving interpretability. Ultivariate time series anomaly detection identifies unusual patterns or behaviors across multiple variables over time. It benefits a wide range of real-life applications, including finance [38], healthcare [3], and industrial monitoring [14], [45], where timely detection of anomalies can lead to significant improvements in decision-making and framework reliability [15], [54]. In recent years, deep learning techniques have been widely applied to time series anomaly detection and achieved superior performance. This paper was produced by the IEEE Publication Technology Group. Gao are with the College of Computer Science, Zhejiang University, Hangzhou 310027, China, E-mail:{yoyoyao, shiyuhan, luchen, zqfang, gaoyj}@zju.edu.cn. Leong Hou U is with the Department of Computer and Information Science, University of Macau, Macau, E-mail:ryanlhu@um.edu.mo. Li and T. Li are with the Department of Computer Science, Aalborg University, Denmark, E-mail:{yusli, tianyi}@cs.aau.dk. In multivariate time series anomaly detection, the scarcity of labeled anomalies and high annotation costs pose major challenges. To address these, unsupervised methods are widely used [5], [12], [13], [26], [39], [43], [50], modeling normal behavior and detecting deviations via prediction or reconstruction errors. However, unsupervised methods typically rely on large amounts of continuous and stable normal data as the basis for modeling.