DifNet: Difference-based multi-resolution decomposition for time series anomaly detection

Time series anomaly detection is crucial for Internet of Things (IoT) management and system security. Mainstream methods typically treat time series as an indivisible whole to capture insights into normal patterns. However, time series contain deterministic components such as seasonality, periodicity, and trends. Non-decomposition-based methods often average out these components during training, leading to the over-smoothing of normal time series features. This deviates from the core principle of unsupervised time series anomaly detection: to establish a clear boundary between normal and anomalous patterns. We propose DifNet, a comprehensive unsupervised time series anomaly detection method that effectively mitigates feature over-smoothing (FOS). DifNet adopts the concept of time series decomposition and utilizes Fast Fourier Transform (FFT) to analyze the periodic components of time series, guiding the decomposition and fusion process. Additionally, we design a difference-based multi-resolution decomposition network to thoroughly extract complex periodic dependencies within the time series. For multivariate time series data, DifNet follows the channel independence principle and disregards inter-channel dependencies that introduce redundant information in the data. As a more lightweight alternative, we introduce single-channel autoencoder and cross-channel periodicity adjustment. Meanwhile, DifNet integrates contrastive learning at a fine-grained level to prevent FOS and facilitate the extraction of more distinguishable representations. Extensive experimentation conducted on six multivariate and two univariate time series datasets validates the efficacy of DifNet in time series anomaly detection, DifNet achieved an average improvement in the best F1-score of 14.67% across eight datasets.