Detecting Time‑Series Anomalies Without Thresholds Using LSTM and Unsupervised Fusion

Threshold‑free anomaly detection is a critical issue in IT, and we propose a deep‑learning approach that avoids traditional threshold settings.

We introduce a collaborative analysis of time series using an LSTM‑based baseline (LnB) and an unsupervised detection module (UnD) that integrates neural networks with multiple machine‑learning algorithms. The baseline excels with clear periodic patterns, while UnD performs well under high‑efficiency demands and ambiguous periodicity.

Recent AIOps research has explored various ML and DL methods such as K‑means, density‑based clustering, Isolation Forest, MLP, RNN, LSTM, and GRU for anomaly detection. Traditional threshold‑based methods fail to capture dynamic trends and require extensive manual tuning.

Our solution replaces fixed thresholds with adaptive parameters that automatically search a small range to fit diverse monitoring data. LnB generates an adaptive baseline via an LSTM framework that includes a long‑short period identification mechanism with a correction term for more accurate fitting. UnD combines a DL model (GRU) with ML algorithms (IForest, ABOD, CBLOF) using a voting scheme to decide anomalies.

Time series X = (x1, x2, ..., xt) are evaluated to determine whether the next value xt+1 is anomalous. We use a sliding window Xt‑T:t as input rather than the entire history. Figure 1 (below) shows the overall framework with training and online detection stages.

LnB processes longer historical data (e.g., 14 days) to capture long‑term behavior, while UnD uses three short windows (30 min, 60 min, 60 min) covering recent, daily, and weekly contexts, providing complementary perspectives.

Data preprocessing includes K‑NN imputation, smoothing filters, normalization, and logarithmic transformation to ensure consistent input length and accelerate convergence.

The baseline’s upper and lower bounds are derived from a 95% confidence interval and refined via extreme‑point smoothing and Lagrange interpolation.

UnD’s GRU shares the same loss function as LnB but operates on shorter sequences. Anomaly weight (AW) determines whether a prediction is anomalous, calibrated to keep detected anomalies within 1‑3% of data points. The outputs of GRU, IForest, ABOD, and CBLOF are encoded into a one‑hot matrix; a voting mechanism (e.g., threshold n=2) decides the final anomaly label.

During online detection, incoming data are preprocessed and fed simultaneously to LnB and UnD. If either module flags an anomaly, an alert is raised, leveraging the complementary strengths of long‑term baseline analysis and short‑term multi‑model voting to reduce false negatives and false positives.

Experimental results on two real‑world JD Cloud datasets show that the combined LnB+UnD approach achieves the highest F1 scores compared to individual modules and baseline methods (IForest, ABOD, CBLOF), confirming the effectiveness of the parallel, threshold‑free design.