Research map / Probabilistic and scientific modeling / Molecules and proteins
Conformal Anomaly Detection in Event Sequences
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes CADES, a conformal inference test for anomaly detection in event sequences that combines two time-rescaling-based KL-divergence non-conformity scores with a Bonferroni-corrected two-sided p-value, giving finite-sample FPR control.
Problem
Anomaly detection in continuous-time event sequences lacks guarantees on false positive rate; existing test statistics (KS, 3S, Q+/Q-, NLL) suffer from non-identifiability and insensitivity to event count or uniform spacings.
Approach
Two new non-conformity scores from the time-rescaling theorem (KL divergence of normalized arrival times vs. uniform, and of inter-event times vs. exponential, via KDE) are combined with two-sided conformal p-values and Bonferroni correction, with calibration-conditional FPR guarantees.
Key results
- On LOGS and STEAD real-world datasets, CADES achieves the best average rank (1.50) in AUROC across eight scenarios, versus 3.00 for the next best (MultiAD-Q-).
- On STEAD - Helmet, CA at alpha=0.05, CADES attains 98.38% TPR versus 69.20% for 3S statistic and 6.50% for MultiAD-Q+.
- The 3S statistic and MultiAD-Q+ exceed the target FPR level on LOGS, while CADES's FPR stays bounded by alpha on average.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use CADES instead of MultiAD-Q− | OOD detection on LOGS - Packet corruption (1%) · LOGS - Packet corruption (1%) | AUROC (%): 96.61 -> 96.48 | Hurt |
| Use CADES instead of Log-likelihood | OOD detection on LOGS - Packet delay (frontend) · LOGS - Packet delay (frontend) | AUROC (%): 99.55 -> 98.15 | Hurt |
| Use CADES instead of MultiAD-Q+ | OOD detection on LOGS - Packet delay (all services) · LOGS - Packet delay (all services) | AUROC (%): 99.59 -> 99.33 | Hurt |
| Use CADES instead of 3S statistic | OOD detection on LOGS - Packet duplication (1%) · LOGS - Packet duplication (1%) | AUROC (%): 91.46 -> 92.88 | Helped |
| Use CADES instead of MultiAD-Q− | OOD detection on STEAD - Helmet, CA · STEAD - Helmet, CA | TPR (%): 69.20 -> 98.38 | Helped |
| Combine sarr and sint instead of using either score alone (ablation) | CADES · GOF test for SPP: Stopping and RenewalA | AUROC | Helped |
| Use the sarr score alone instead of combining sarr and sint (ablation) | CADES · GOF test for SPP: Stopping | AUROC | Mixed |
| Use the sint score alone instead of combining sarr and sint (ablation) | CADES · GOF test for SPP: RenewalA | AUROC | Mixed |
| Use a right-sided p-value instead of a two-sided p-value (ablation) | CADES-arr · GOF test for SPP: RenewalA and SelfCorrecting | AUROC | Hurt |
Surprising findings
- The 3S statistic cannot distinguish the Uniform OOD scenario from the SPP because its value equals 2 for equally spaced OOD sequences.
- The right-sided p-value variant (CADES-arr-r) performs poorly in RenewalA and SelfCorrecting scenarios because small scores indicate OOD there.
Limitations
- Calibration-conditional FPR guarantee requires a sufficiently large calibration set, and a large epsilon makes detection conservative for small calibration sets.
- Marginal FPR guarantee is used in the GOF experiments because the sample size is limited, setting epsilon=0.
- Validity relies on exchangeability and continuous score distributions.
Experimental setup
Datasets: ServerStop ServerOverload Latency SpikeTrains LOGS STEAD
Benchmarks: ServerStop ServerOverload Latency SpikeTrains LOGS STEAD GOF test for SPP under nine alternatives
Metrics: AUROC TPR FPR average rank
Baselines: KS arrival KS inter-event Chi-squared statistic Log-likelihood 3S statistic MultiAD-Q+ MultiAD-Q-
Builds on: inductive conformal inference 3S statistic time-rescaling theorem LogNormMix neural TPP
Closest papers by meaning
- Adaptive Conformal Anomaly Detection with Time Series Foundation Models for Signal Monitoring. (ICLR 2026 · similarity 0.87)
- Detecting Anomalous Event Sequences with Temporal Point Processes (NeurIPS 2021 · similarity 0.85)
- Free Point-wise Anomaly Detection via Fold-bifurcation (ICLR 2026 · similarity 0.84)
- Supervision Recovery for Time Series Anomaly Detection via Counterfactual Pairing (NeurIPS 2026 · similarity 0.84)
- The Elephant in the Room: Towards A Reliable Time-Series Anomaly Detection Benchmark (NeurIPS 2024 · similarity 0.84)
- AR-Pro: Counterfactual Explanations for Anomaly Repair with Formal Properties (NeurIPS 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.