From Benchmarks to Production:
Transferring Time Series Anomaly Detection Methods for Electricity Production Monitoring

As mentioned in the previous section, our objective is to identify anomalies in time series, a well-studied problem in the literature for decades [9]. Anomaly detection in this context is framed as an online, last forecasted window detection task, where the objective is to assess whether the most recently observed forecasted value in a series deviates significantly from historical behavior. Unlike retrospective analyses (the most common tackled problem in the literature [9]), the goal is not to detect previously missed events but to identify anomalies as they emerge, thus enabling timely interventions. This real-time requirement aligns with EDF’s operational needs, where undetected anomalies in key indicators could cascade into significant planning errors or missed opportunities.

We call a window the 24-hour profile of a variable $c$ sampled every $\Delta=30$ minutes. Formally, a window $\boldsymbol{C}_{d}$ for a given day $d$ is defined as $\boldsymbol{C}_{d}=\bigl(c_{1},\ldots,c_{M}\bigr)\in\mathbb{R}^{M}$, where $M=48$ and $c_{m}$ denotes the measurements for the $m$-th half-hour interval of day $d$. Therefore, a time series $T$ is an ordered set of windows defined as follows:

with $n$ being the total number of days in the time series $\boldsymbol{T}$. In practice, the daily measurements $\boldsymbol{C}_{d}$ is forecasted from the previous day $d-1$. The primary objective of this work is to perform anomaly detection on such a daily production composing a given time series $\boldsymbol{T}$. An anomaly is defined as the overall intra-day sequence (i.e., window) of points of $\boldsymbol{T}$ itself, which deviates significantly from what is considered normal or expected behavior for EDF’s power generation system for a day. This normality is established based on patterns learned from historical data (including typical intra-day profiles for various day types). In practice, we consider 3 years of historical data. Formally, in our industrial context, we define an anomaly detection function as follows:

The function $\mathcal{A}$ can either correspond to a unique anomaly detection model, denoted by $D$, or to an automatic detection solution, denoted by $\mathcal{M}$, combining multiple detectors $D$. We will describe in the following sections the distinction between a unique detector and an automatic solution. While our problem setting shares core principles with the broader literature on time series anomaly detection, such as the importance of temporal dependencies and seasonality, it presents several practical constraints limiting the applicability of a large panel of existing methods. These constraints are listed below.

• •

  (C1) Scalability: The practical applicability of an anomaly detection system in an industrial context, such as managing energy grids, is heavily dependent on its computational performance. The system must exhibit low execution time to allow for rapid, proactive interventions.

• •

  (C2) Limited hardware: While model training can leverage high-performance computing resources, operational deployment must conform to strict hardware constraints. In our context, anomaly detection must run in near-real-time on standard CPU-based infrastructure, without access to GPUs or specialized accelerators.

• •

  (C3) Interpretability: In an operational context such as energy grid management, the value of an anomaly detection system is tightly coupled with its ability to produce interpretable outputs. Since detected anomalies must be reviewed and acted upon by domain experts (often under tight time constraints) models that function as black boxes are of limited utility.

• •

  (C4) Data Diversity: In our use case, time series are highly heterogeneous in terms of provenance and structure. First, missing values may have semantic meaning. Rather than removing them, one needs to preserve them to maintain data integrity and retrieve relevant knowledge that could indicate potential anomalies. Then, time series provenance (i.e., from diverse domains and measurement types) might lead to severe Out-of-Distribution scenarios, both in terms of trends and anomaly types.

In recent years, significant research has been conducted in the field of time-series anomaly detection. Numerous studies and experimental benchmarks have been written to summarize and analyze state-of-the-art methods [11, 7, 12, 13, 14]. These comprehensive evaluations reveal a diverse landscape of methodologies (i.e., detectors $D$), which can be broadly classified into several foundational families based on their core operating principles [9]. Figure 2 depicts a large panel of methods grouped in process-centric families according to [9].

One major family consists of prediction-based methods, which train a model on a given self-supervised prediction task. An observation is classified as anomalous if it significantly deviates from the model’s prediction, with the anomaly score derived from the prediction error. Such methods can be reconstruction-based [15] or forecasting-based [16].

A second prominent category is distance-based methods, which operate under the assumption that anomalous points are isolated from the bulk of the data. These techniques identify outliers by measuring the distance of a data point to its nearest neighbors, with large distances indicating abnormality [17].

Closely related are density-based methods, which use a representation of the time series (i.e., tree [18] or graph structure [6]) and compute an anomaly score based on some density criteria of the given representation (i.e., depth of the tree, or centrality in the graph).

While prediction-based methods are appealing due to their ability to model temporal dynamics, they often rely on complex architectures with high computational and memory demands, and may be ill-suited for specific use cases on high-velocity data with real-time deployment on constrained hardware requirements (i.e., failing to meet C1 and C2). Additionally, their black-box nature poses challenges for interpretability (i.e., not respecting C3). Conversely, raw-based approaches such as distance- and density-based methods may offer lighter computation, but they struggle to handle data quality issues like missing values (failing to meet C4) and often lack the contextual transparency needed for non time series practitioners (i.e., not fully respecting C3). These limitations underscore the need for methods explicitly designed with industrial constraints in mind.

Feature-based methods offer a promising avenue for addressing the industrial constraints of interpretability, scalability, and robustness to data quality issues. By transforming raw time series into structured feature vectors (often composed of statistical, structural, or domain-specific descriptors), these approaches enable the use of appropriate density-based algorithms in a lower-dimensional, and meaningful space. Unlike raw-based distance- or density-based methods, feature-based techniques allow better handling of missing values through feature design and provide clear interpretability by exposing which characteristics contribute to the anomaly. As such, they strike a balance between operational feasibility and detection performance, making them particularly well-suited for real-world deployment in our industrial contexts.

In practice, the feature-based methodology [19, 20, 21] entails a two-stage process that transforms the complex temporal problem into a more manageable static outlier-detection task. First, a raw time-series window is converted into a fixed-length vector of numerical features. These features can capture a wide range of properties, including basic statistics (mean, variance), frequency-domain information, and entropy measures. In the second stage, a classical outlier-detection algorithm is applied to the feature space to identify feature vectors that are abnormal relative to the rest of the population [22]. Common algorithms used for this purpose include Isolation Forest [18], Local Outlier Factor (LOF) [23], and One-Class SVM [24].

Several tools have been proposed for automatic feature extraction. Among the most widely used are HCTSA [26], TSFresh [21], and Catch22 [27]. HCTSA (Highly Comparative Time Series Analysis) performs massive feature extraction, computing over 7,700 features for each time series. These features span statistical distribution measures (e.g., mean, skewness, outlier ratios), autocorrelation and spectral properties, entropy metrics, and model-based characteristics.

TSFresh extracts 794 time series features by default and includes an automated feature selection process based on hypothesis testing. This framework supports both exploratory analysis and integration into operational pipelines, making it a flexible option for industrial applications.

Catch22 builds upon HCTSA by identifying a compact subset of 22 features that provide strong classification performance across 93 UCR/UEA datasets [28]. These features are selected to minimize redundancy and maximize diversity, but are specifically tuned for z-normalized time series (zero mean and unit variance) and classification tasks.

While each of these libraries provides valuable insights, they present specific limitations in our context: (i) HCTSA and TSFresh produce high-dimensional feature sets, which are impractical for direct use in real-time anomaly detection. Moreover, TSFresh’s selection is not tailored to anomaly-specific tasks, potentially misaligning with our deployment needs. (ii) Catch22, due to its compact size and design for rapid analysis, appears promising for initial exploration. However, its features were optimized for classification, not anomaly detection. Figure 3 depicts the TSFresh and Catch22 features computed on an IOPS [25] time series. TSfresh contains features that allow the detection of anomalies (labeled in red in Figure 3), while Catch22 features are not sufficient for detecting the same anomalies.

Given these constraints, no existing feature set is suitable for our industrial use case, underscoring the need for feature selection and evaluation tailored to our operational context.

Recent benchmarking studies have consistently shown that there is no single anomaly detection algorithm that performs best across highly heterogeneous collections of time series [11, 7, 29, 30]. Instead, the performance of individual methods varies significantly depending on the characteristics of the time series (e.g., stationarity, periodicity) and the nature of the anomalies (e.g., point-wise, contextual, or subsequence).

This observation is particularly important in our context, where we must monitor a diverse set of time series with varying behaviors and noise levels. Furthermore, while most research algorithms produce anomaly scores for each time point, our setting requires a single decision at the last timestamp, introducing an additional mismatch between standard benchmarks and operational needs.

To overcome these limitations, we use several automatic solutions (i.e., meta model and ensembling methods $\mathcal{M}$). Overall, two main strategies have been proposed: ensembling (supervised or unsupervised) and automatic model selection. Figure 4 illustrates these strategies. Ensembling combines the outputs of multiple detectors, typically by averaging or maximizing their scores, to improve robustness. These methods often outperform individual algorithms on public benchmarks [29], but at the cost of higher computational overhead, which is problematic for real-time applications.

On the other hand, recent AutoML-based approaches have explored model selection as an alternative. These methods aim to select the most appropriate detector for each time series by learning a meta-model that maps extracted features to the best-performing method [31, 32, 29]. While promising, these techniques suffer from limited generalization in out-of-distribution settings [29]. The latter is an essential concern for real-world deployment, where new time series may exhibit previously unseen patterns or behaviors.

Given these limitations, we need to adopt an ensembling strategy that prioritizes robustness in out-of-distribution settings while maintaining low computational cost.

The proposed feature set, TAMIS_F, aims to capture the most informative and generalizable characteristics of industrial time series for anomaly detection. The feature extraction pipeline begins by aggregating raw measurements into daily windows, denoted as $\boldsymbol{C}_{d}$, from which a feature vector $\boldsymbol{F}_{d}$ is computed. The final feature set results from the integration of two complementary design strategies: (i) an expert-based feature pool derived from domain knowledge, and (ii) a TSAD-based feature pool identified through synthetic data generation and supervised feature selection.

This section describes the two anomaly detectors that compose the core of the TAMIS ensemble. The choice of using only two base detectors is deliberate, as it significantly reduces computational overhead while maintaining high detection accuracy and scalability in production environments.

Let $H_{i}$ denote the set of historical feature values for a given time series, and let $f_{i}\in\boldsymbol{F}_{d}$ represent the new observation under evaluation. Each detector outputs an anomaly score, which is subsequently combined by the supervised ensemble model described in Section V-C.

The final stage of the proposed approach introduces SEASA (Supervised Ensemble Anomaly Scores Aggregation), a stacking-based ensemble model that integrates the outputs of multiple base anomaly detectors (i.e., KDE and ASHES) into a unified and more accurate prediction. This ensemble mechanism leverages supervised learning to automatically infer optimal weightings and interactions among detector outputs, thereby enhancing overall robustness.

All experiments are conducted on a single node with two Intel Xeon Gold 6234 CPUs at 3.30 GHz. Each node has 16 physical cores and 384 GB of RAM. For reproducibility, we make our implementation publicly available ¹¹ 1 Code Available at: https://github.com/VautierNicolas/TAMIS.

In this section, we evaluate the global performance of TAMIS relative to all baseline configurations. The results are summarized in Table IV and Figure 6.

Figure 7 presents the trade-off between accuracy (AUC-PR) and throughput across the three stages of the TAMIS pipeline: (a) feature computation, (b) detector execution, and (c) weight inference. Three feature sets are compared: TAMIS_F, Catch22, and TsFresh.

To assess the robustness and generalization capability of the proposed approach, we compare its performance under in-distribution (ID) and out-of-distribution (OOD) conditions. A baseline model is trained and tested on JO, representing the ID setting, while OOD performance was evaluated by applying the same model to the HYDRAU and THERM datasets, which differ in operational regimes and signal characteristics. Figure 8 reports the AUC-PR results for three evaluation configurations: (i) in-distribution (trained and tested on JO), (ii) OOD 1 (JO $\rightarrow$ HYDRAU), and (iii) OOD 2 (JO $\rightarrow$ THERM). We include the best-performing individual detectors (KDE and ASHES) as baselines.

The deployment of our proposed approach, TAMIS, provided valuable insights into the human-in-the-loop requirements for industrial anomaly detection:

While TAMIS is designed to address specific industrial constraints (e.g., missing values, heterogeneity), it is crucial to verify that its performance is not solely due to the specificity of our use case and datasets. To assess the generalizability of our approach, we evaluated TAMIS on TSB-UAD [11], a comprehensive, heterogeneous benchmark across domains. We compared TAMIS against the strongest baselines identified in a recent evaluation of model selection for time series anomaly detection [29]. More specifically, we consider the Best Detector (i.e., NormA), the Unsupervised Average Ensemble, and the Best Model Selection (Best MS) strategy identified in [29].

Figure 9 reports the Volume Under the Surface (VUS-PR) accuracy [14] of TAMIS versus the baselines on TSB-UAD. We observe that TAMIS (VUS-PR $\approx$ 0.38) significantly outperforms the Average Ensemble and the Best Detector. Moreover, TAMIS outperforms the Best Model Selection strategy (VUS-PR$\approx$ 0.35). This result confirms that TAMIS captures fundamental anomaly characteristics that generalize well to diverse domains beyond energy production.