{"id":"a8495480-5ff9-49c7-80ce-e944eb883067","arxiv_id":"2412.20512","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A survey of time-series anomaly detection that proposes a process-centric taxonomy and a meta-analysis of a decade of literature.","lead":"This paper reviews a decade of time-series anomaly detection research and organizes methods into a process-centric taxonomy with three families: distance-based, density-based, and prediction-based. It also surveys benchmarks and evaluation measures, and analyzes how publication trends have shifted over time.","discovery_kind":"review","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The Section 9 meta-analysis is not reproducible: the corpus and per-method coding are unreleased and some Table 3 codings are demonstrably wrong, so the 'LSTM/autoencoder-driven growth' trend rests on an unverifiable dataset.","rationale":"I read the paper as a survey whose two advertised contributions are the process-centric taxonomy (Section 3) and the meta-analysis of trends (Section 9). The taxonomy is internally coherent and useful; I do not see a fatal flaw there. The meta-analysis, however, is the only place where the paper makes a falsifiable, quantitative statement about the field, and that statement depends entirely on an undocumented corpus and on the authors' manual coding of each method. The reader's weakest_assumption correctly identifies this as the central risk. My own review strengthens the concern by finding concrete coding errors in the published tables: DeepAnT is not LSTM-based, and MSCRED is not univariate. These are not matters of taste; they are the exact fields (prototype, dimensionality) that feed the trend plots. If two such errors appear in the visible table, the hidden coding likely contains more. Whether the trends survive correction is unknown, and the manuscript provides no way to check. Therefore I agree with the reader's CONDITIONAL verdict: the survey is acceptable in substance, but the meta-analysis should not be trusted as a standalone research claim until the corpus and coding are made available and independently verified. My recommendation is UNCHANGED because the reader already conditioned acceptance on exactly this kind of reproducibility fix; my concern reinforces that condition rather than moving the verdict.","tokens_in":51894,"tokens_out":3573,"duration_ms":39122,"concrete_test":"Release the full method-level coding (method ID, year, first- and second-level category, prototype, dimensionality, supervision, inclusion decision) and run an independent re-coding study: two annotators re-code each method from Tables 1-3 using only the original papers, computing inter-annotator agreement. Then recompute Figures 20-21 from a systematic DBLP/Scopus search using explicit inclusion criteria. If the re-coding changes DeepAnT from LSTM to CNN, or MSCRED from univariate to multivariate, or the systematic corpus changes the post-2016 prediction-based share by more than 10 percentage points, the Section 9 trend claim is not robust.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central empirical claim is in Section 9: 'the significant increase in methods proposed is caused mainly by the prediction-based approach and, more specifically, by LSTM and autoencoder-based approaches' (Figure 20). This claim is computed from the methods listed in Tables 1-3, but the manuscript never states the search strategy, inclusion/exclusion criteria, or coding protocol used to build that corpus. No data file is released. The text only says 'we collected a comprehensive range of algorithms' (Section 1), which is not a falsifiable selection rule. Worse, internal evidence shows the coding itself is unreliable: Table 3 lists DeepAnT [167] with prototype 'LSTM', but DeepAnT's published architecture is a convolutional neural network, not an LSTM; the same table lists MSCRED [265] as 'I' (univariate), although MSCRED is explicitly designed for multivariate time series. If prototype and dimensionality are mis-coded in visible rows, the aggregate counts behind Figures 20-21 can shift materially. Since the meta-analysis is the part of the paper that claims to reveal a field-wide trend, this unreproducible corpus selection and coding is the load-bearing weakness: without it, the 'LSTM/autoencoder-driven growth' statement is an unsupported summary of an unavailable dataset.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This survey proposes a process-centric taxonomy for time-series anomaly detection, dividing detection methods into distance-based, density-based, and prediction-based families with nine second-level categories, and catalogues roughly one hundred methods in Tables 1–3 and Figure 8. It also reports a meta-analysis of temporal trends in the literature (Section 9, Figures 20–21), reviews existing benchmarks (Table 4), and discusses threshold-based and threshold-independent evaluation measures, including range-based and volume-based metrics. The paper’s central empirical claim is that the post-2016 growth in anomaly-detection methods is driven mainly by prediction-based approaches, in particular LSTM and autoencoder methods.","tokens_in":52213,"tokens_out":6619,"duration_ms":65581,"significance":"If the taxonomy is accepted as a working map, the survey is a useful reference: it connects statistical, distance-based, and deep-learning strands of the field, provides compact method tables with supervision/dimensionality/streaming attributes, and offers a knowledgeable discussion of benchmark limitations and evaluation metrics, especially the VUS family. The meta-analysis is the part that would make the survey more than an annotated catalogue, and it is currently the weakest link because the underlying corpus and coding are not released and because visible rows in the tables contain demonstrable coding errors. The taxonomy and the evaluation-metric discussion can stand if these issues are addressed locally; the trend claims require either a reproducible coding protocol or a substantially weakened formulation.","major_comments":[{"comment":"The meta-analysis supporting the central empirical claim is not reproducible as reported. The text states only that the authors “collected a comprehensive range of algorithms” (Section 1) and never specifies the search strategy, inclusion/exclusion criteria, or coding protocol behind Tables 1–3, and no corpus or per-method coding file is released. Because the aggregate counts behind Figures 20 and 21 are computed from these tables, claims such as the LSTM/autoencoder-driven increase and the 65%/50% supervision numbers cannot be checked by a reader. I request that the authors release the corpus and coding or state explicitly which public sources and rules were used; otherwise Section 9 should be confined to descriptive statements about the listed methods.","section":"Section 9, Figures 20–21"},{"comment":"The table coding is demonstrably unreliable in visible rows. Table 3 classifies DeepAnT [167] as “LSTM” even though the published DeepAnT architecture is a convolutional neural network, and it codes MSCRED [265] as “I” (univariate) although MSCRED is designed for multivariate time series. Table 1 also lists TARZAN [115] as “S” (supervised), while TARZAN is an unsupervised surprising-pattern discovery method. Since the Section 9 trend analysis is computed from these codings, the authors should correct these entries and audit the full tables against the original papers.","section":"Table 3 and Table 1"},{"comment":"The isolation-forest average path length is written as c(n)=H(n-1)-2(n-1)/n, but the standard expression is c(n)=2H(n-1)-2(n-1)/n. The displayed anomaly-score formula above Eq. (7) is also difficult to parse as typeset. For a survey that readers will use as a reference, the formula should be corrected and the anomaly score should be presented cleanly.","section":"Section 7.3, Eq. (7)"}],"minor_comments":[{"comment":"The TSB-AD row reports 1070 curated time series while the text says the benchmark “comprises 1,000 rigorously curated” series; the numbers should be reconciled.","section":"Section 10.1, Table 4"},{"comment":"ARIMA is cited to reference [211], which is Rousseeuw and Leroy’s “Robust Regression and Outlier Detection”; this citation does not introduce ARIMA models and should be replaced by an appropriate time-series reference.","section":"Section 8.1.2"},{"comment":"The text refers to “AD-ITL” while Table 3 lists “AD-LTI”; the same name should be used throughout.","section":"Section 8.1.4 vs Table 3"},{"comment":"There are several small presentation errors: “SupriseEncode” and “GranmmarViz” in Table 2, and “Telemanon★” in Table 3 has a star but no accompanying footnote.","section":"Table 2 and Table 3"},{"comment":"The title announces “A Decade Review” but the corpus spans from 1980 to 2023; the paper should clarify in the introduction why the “decade” framing is used, or adjust the title to reflect the full time span.","section":"Title and Section 4"}],"recommendation":"major_revision","confidential_remarks":"I am not recommending rejection: the taxonomy and evaluation-metric discussion are substantive, and the problems are localizable. However, I would insist that the meta-analysis become reproducible before the trend claims are published. The authors’ extensive use of their own TSB-UAD/TSB-AD/VUS work is not circular in the taxonomy, but the Section 9 analysis should not inherit unstated assumptions from that work, and the corpus should be released or the claims withdrawn."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Paul,\n\nHere's my read on the Boniol et al. survey. It's a genuinely useful piece of work: the three-way process-centric taxonomy (distance-, density-, prediction-based) is clean, the method tables are a handy reference, and the discussion of benchmarks and evaluation metrics—especially VUS and the point-adjustment critique—is careful and current. If you need a starting point for someone new to time-series anomaly detection, this is a reasonable place to point them.\n\nThe main soft spot is the meta-analysis in Section 9. The paper claims the recent growth in methods is driven mainly by LSTM and autoencoder approaches, but the corpus behind that claim is not described (no search strategy, inclusion/exclusion criteria, or coding protocol) and no data is released. Worse, visible rows of Table 3 are mis-coded: DeepAnT is listed as LSTM even though the original method is convolutional, and MSCRED is marked univariate though its title and design target multivariate series. If the visible coding has errors like that, the aggregate counts behind Figures 20-21 can shift materially, so the LSTM/autoencoder-driven-growth statement is an unsupported summary of an unavailable dataset. That's not fatal to the survey as a whole, because the taxonomy and method descriptions stand on their own, but it does mean the meta-analysis should be revised or removed until the corpus and coding are made reproducible.\n\nThere's also a small technical error in Section 7.3: Eq. 7 gives c(n) = H(n-1) - 2(n-1)/n for the Isolation Forest average path length, missing the factor 2. That's minor, but it should be fixed since people copy these formulas.\n\nOverall, the paper is a solid, if not deeply novel, survey. It deserves a serious referee—send it to someone who knows the field and will require the meta-analysis to be backed by a released, reproducible dataset. With those fixes, it would be a reasonable reference for the community.\n\nRecommendation: accept with major revisions, contingent on the meta-analysis being made reproducible and the coding errors corrected.","headline":"Useful survey of time-series anomaly detection with a sound taxonomy and benchmark rundown, but the meta-analysis's trend claim is undermined by unreleased corpus and visible coding errors.","tokens_in":52696,"tokens_out":3091,"would_cite":true,"duration_ms":29010,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A decade of time-series anomaly detection can be sorted into one process-centric taxonomy, and the field's recent growth is driven by prediction-based deep models.","keywords":["time-series anomaly detection","survey","process-centric taxonomy","distance-based methods","density-based methods","prediction-based methods","meta-analysis","benchmarks"],"falsifier":"Independently assemble a reproducible corpus of time-series anomaly detection papers from 1980 to 2023, code each method into the paper's three families, and check two numbers: whether new-method counts are roughly flat before 2016 and sharply higher after, and whether prediction-based methods, especially LSTM and autoencoder models, make up about half of new methods in 2020–2023; if either check fails on a comparable or larger corpus, the meta-analysis claim is undermined.","tokens_in":51716,"feed_emoji":"📈","tokens_out":9202,"duration_ms":79189,"temperature":0.7,"pith_summary":"This survey tries to give the time-series anomaly detection literature a single organizing structure. It groups methods into a process-centric taxonomy: distance-based methods score subsequences by similarity or distance; density-based methods build distributions, graphs, trees, or encodings and flag what is isolated; prediction-based methods learn to forecast or reconstruct normal behavior and use the error as the anomaly score. Its meta-analysis of the collected methods shows that after 2016 the number of new methods rises sharply, and that this surge is driven mainly by prediction-based approaches, specifically LSTM and autoencoder models, which account for almost half of new methods between 2020 and 2023. The survey also catalogs existing benchmarks and evaluation measures, recommending threshold-independent, range-aware measures such as VUS-ROC for comparing detectors. The point of the taxonomy and the recommendations is to let a fragmented field compare methods on a common basis.","feed_headline":"Deep predictors drive the surge in anomaly detection papers","feed_subtitle":"A decade-long review sorts methods into three families and shows LSTM/autoencoder models drove most post-2016 growth.","key_machinery":"The machinery is the process-centric taxonomy itself. It classifies a detector by its core operation on time-series subsequences: comparing distances between subsequences (distance-based), measuring density over a learned representation such as a distribution, graph, tree, or symbol encoding (density-based), or training a model that forecasts the next point or reconstructs an input and scores by prediction or reconstruction error (prediction-based). A companion four-stage pipeline—pre-processing, detection method, scoring, post-processing—connects each algorithm to the taxonomy by showing where in the process a method acts. The taxonomy is what makes the survey's meta-analysis possible: methods are counted by family and publication date, which produces the trend figures and the conclusion that prediction-based approaches drove the recent growth.","core_discovery":"The central claim is that the entire recent literature on time-series anomaly detection can be organized by what the detection step does with the series, and that this organization reveals a clear historical trend. The taxonomy has three first-level families: distance-based (proximity, clustering, discord detection), density-based (distribution, graph, tree, encoding), and prediction-based (forecasting, reconstruction), with the second-level categories not mutually exclusive. Applied to a collected set of methods, the taxonomy yields the paper's main empirical finding: between 2020 and 2023, prediction-based methods—particularly LSTM and autoencoder variants—make up almost half of newly proposed detectors, and this growth explains most of the post-2016 increase in publication volume. The paper further argues that no single detector wins on all data, and therefore the field should evaluate on shared benchmarks such as NAB, Yahoo, Exathlon, KDD21, TODS, TimeEval, TSB-UAD, and TSB-AD, using threshold-independent measures, with VUS-ROC singled out as preferred.","pith_inferences":["The taxonomy suggests a design space the paper does not develop: prediction-based error signals could be fed into distance- or density-based scorers as input features, blending families at the scoring stage rather than at the detection stage.","The meta-analysis's univariate/multivariate split implies that the recent drift toward univariate subsequence detection may reflect how easy the problem is to define and benchmark, not its practical importance; multivariate subsequence benchmarks would be a natural test of that reading.","A testable extension of the paper's evaluation claim would be to select one representative method per taxonomy leaf and run the full set on TSB-AD and TimeEval; if the taxonomy's families fail to separate in performance, the categories would be organizing history rather than behavior."],"forward_implications":["If the taxonomy is adopted, every new method can be placed in a family and subcategory, which makes choosing competitive baselines from the other families a standard requirement.","Because the measured growth is concentrated in LSTM and autoencoder methods, evaluations that omit distance- and density-based baselines are likely missing the strongest existing comparators.","The recommendation of VUS-ROC implies that published point-wise AUC results on subsequence anomalies should be re-examined, since they can be inflated by threshold artifacts and labeling conventions.","The listed benchmarks, from NAB through TSB-AD, give the field a concrete shared testbed; if the survey's argument holds, new methods should report results across these rather than on private datasets.","The observation that no single method wins on all datasets points toward model selection, ensembling, and AutoML as more productive research directions than further isolated architecture proposals."],"supporting_citations":[{"why":"Defines the local outlier factor, the prototype of proximity-based distance methods, and anchors that leaf of the taxonomy.","marker":"[35]"},{"why":"Introduces the matrix profile, which the survey uses as the canonical discord-based detection machinery.","marker":"[261]"},{"why":"Introduces LSTM-AD, the forecasting-based prototype whose LSTM family the meta-analysis identifies as a main driver of recent growth.","marker":"[153]"},{"why":"Introduces EncDec-AD, the autoencoder reconstruction prototype behind the reconstruction-based family counted in the meta-analysis.","marker":"[152]"},{"why":"Supplies the TSB-UAD benchmark suite that the survey presents as common evaluation ground for univariate time-series anomaly detection.","marker":"[185]"},{"why":"Supplies the TimeEval benchmark and the large-scale evaluation result, cited as evidence that no single detector wins on all datasets.","marker":"[216]"},{"why":"Defines VUS-ROC, the threshold-independent, range-aware measure the survey recommends as the evaluation measure of preference.","marker":"[180]"},{"why":"Supplies TSB-AD, the largest curated benchmark listed, covering both univariate and multivariate time series.","marker":"[142]"}],"fun_headline_variants":["Prediction models drive half of new anomaly detectors","LSTM and autoencoders fuel anomaly detection boom","Decade review: three families, one big trend","Anomaly detection shifts to prediction-based methods","Survey: prediction-based anomaly detectors rise"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The meta-analysis assumes that the authors' chosen collection of methods and their classification of each method by date, family, univariate or multivariate setting, and supervision level represents the literature as a whole; if that corpus or coding is biased, the reported trends, such as prediction-based methods being half of new proposals in 2020–2023, could be artifacts of selection.","fun_headline_variants_meta":{"raw":{"variants":["Prediction models drive half of new anomaly detectors","LSTM and autoencoders fuel anomaly detection boom","Decade review: three families, one big trend","Anomaly detection shifts to prediction-based methods","Survey: prediction-based anomaly detectors rise"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000193,"raw_usage":{"total_tokens":1321,"prompt_tokens":887,"completion_tokens":434,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":503,"completion_tokens_details":{"reasoning_tokens":363}},"tokens_in":503,"tokens_out":434,"duration_ms":4593,"temperature":1.0,"reasoning_tokens":363,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T23:18:26.524375+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Independently assemble a reproducible corpus of time-series anomaly detection papers from 1980 to 2023, code each method into the paper's three families, and check two numbers: whether new-method counts are roughly flat before 2016 and sharply higher after, and whether prediction-based methods, especially LSTM and autoencoder models, make up about half of new methods in 2020–2023; if either check fails on a comparable or larger corpus, the meta-analysis claim is undermined.","supporting_citations":[],"review_version":1}