CRAFTIIF: Cross-Resolution Analytic Four-Type Interpretable Isolation Forest for Multivariate Time Series Anomaly Detection

AI summary

Overview

Research area: Unsupervised multivariate time series anomaly detection (MTSAD), combining Isolation Forest ensembles, analytic wavelet feature extraction, and benchmark evaluation methodology.

Technical level: Intermediate. Readers should be comfortable with Isolation Forests, wavelet transforms, precision/recall and F1 metrics, and standard benchmark protocol concepts such as point adjustment and VUS-PR.

Scope: The paper introduces CRAFTIIF, an unsupervised detector built from four wavelet families and five type-specific Isolation Forests, and evaluates it on all 19 datasets of the mTSBench benchmark while proposing a diagnostic framework for deciding when a dataset is fundamentally undetectable.

What This Paper Is About

Practitioners monitoring multivariate time series face four structurally different kinds of anomaly — isolated spikes (point), sustained level shifts (distributional), rhythm or frequency changes (temporal), and breakdowns of inter-sensor correlation (collective) — but most existing unsupervised methods target only one or two of them and offer little explanation of why a detection fired. Labels are usually unavailable, so the detector must learn only from normal training data, and when it flags something, the user needs to know which channels, time scales and anomaly type were responsible. CRAFTIIF addresses all four anomaly types at once with a single automatically configured pipeline, and adds a diagnostic framework that separates genuine method failure from datasets no unsupervised signal-statistics method can solve.

Key Contributions

1. CRAFTIIF, a structured unsupervised MTSAD method. Four wavelet families — Morlet, DOG, Haar and Coiflet — each generate K = 500 random analytic feature draws (scale drawn log-uniformly, channel weights from a Dirichlet distribution, feature group A/B/C/D) targeting one anomaly type. Five Isolation Forests are trained independently: one per anomaly type plus a meta-IF over the four-dimensional vector of normalised branch scores that detects compound anomalies requiring multiple branches to agree. All components are auto-configured with no dataset-specific tuning.

2. Adaptive Otsu/MAD hybrid threshold. An unsupervised calibration step computes an Otsu threshold and a bimodality strength β, plus a MAD-based anomaly-rate estimate clipped to [0.015, 0.50]. Depending on β it trusts Otsu fully (β > 0.75), caps Otsu at 2 × MAD (0.40 ≤ β ≤ 0.75), or uses MAD only (β < 0.40), and it disables anti-correlated branches where the Otsu threshold falls below the score median. The paper states this component alone gives a 38% mean F1 improvement over a fixed training-percentile threshold, and that it handles anomaly rates from 0.1% to 69.2%.

3. A diagnostic framework for MTSAD evaluation. Oracle F1 (best F1 over all thresholds, computed post-hoc with labels never used during detection), detectability limits (oracle F1 < 0.05), branch separation ratios (mean score on anomaly windows divided by mean score on normal windows, per branch), and collective attribution (per-channel-pair Pearson correlation shift between flagged and normal windows). This lets users distinguish four outcomes: near-oracle performance, an oracle gap from miscalibration, a feature limit, and a fundamental detectability limit.

4. Comprehensive mTSBench evaluation. All 19 datasets, one configuration, no tuning. CRAFTIIF reaches mean VUS-PR = 0.463 at K = 500, above all 24 methods evaluated in the mTSBench publication, including the previous best PCA (0.329, +40.7%) and raw IsolationForest (0.300, +54.3%). An 11-condition ablation quantifies each architectural component.

Main Findings

• Mean F1 across the benchmark: CRAFTIIF achieves mean F1 = 0.228 over all 19 mTSBench datasets, and F1 = 0.322 on the 13 datasets above the detectability limit, where Table II also gives mean F1_PA = 0.499 and mean VUS-PR = 0.579. Mean VUS-PR across all 19 datasets is 0.463.

• Ranking against baselines: CRAFTIIF ranks first among all 25 evaluated methods and wins on 12 of 19 individual datasets against the best available baseline. The gain over raw IsolationForest is 0.163 (54.3%) in VUS-PR terms, which the paper attributes to structured analytic wavelet features rather than unprocessed multivariate observations.

• **Best-performing datasets (Table

Authors’ abstract

Anomaly detection in multivariate time series is challenged by four structurally distinct anomaly types -- point (isolated spikes), distributional (level shifts), temporal (rhythm changes), and collective (inter-sensor correlation breakdowns) -- each requiring different feature representations. Most unsupervised methods target only one or two types and provide limited interpretability. We present CRAFTIIF (Cross-Resolution Analytic Four-Type Interpretable Isolation Forest), a fully unsupervised framework targeting all four types without dataset-specific tuning. CRAFTIIF generates K=500 random analytic wavelet feature draws across four families (Morlet, DOG, Haar, Coiflet), each targeting a specific anomaly type, feeding five structured Isolation Forests -- one per type plus a meta-IF for compound anomalies. An adaptive Otsu/MAD threshold calibrates detection automatically across anomaly rates from 0.1% to 69.2%. Because each IF is trained exclusively on type-specific features, branch firing provides direct anomaly-type attribution by construction, without post-hoc explanation. Evaluated on all 19 datasets of the mTSBench benchmark (Zhou et al., TMLR 2026), CRAFTIIF achieves mean F1=0.228 (all 19 datasets) and F1=0.322 (13 detectable datasets), ranking first among all 25 evaluated methods on VUS-PR (0.463 vs. previous best 0.329, +40.7%). A diagnostic framework -- oracle F1, detectability limits, and branch separation ratios -- identifies 6 of 19 datasets as fundamentally undetectable by any unsupervised method. Ablation over 11 conditions confirms adaptive thresholding (+38% F1), four-branch structure (+20%), and meta-IF (+23%) are each essential. Code: https://github.com/smitswil/craftiif