The research, conducted by Lucas Correia, Thomas Bäck and Anna V. Kononova of the Leiden Institute of Advanced Computer Science at Leiden University in the Netherlands, together with Jan-Christoph Goos of Mercedes-Benz AG in Stuttgart, introduces a novel technique called the dissimilarity-based query strategy, or DQS. Rather than labelling data blindly and exhaustively—an approach whose cost balloons prohibitively in big data settings—the method borrows a page from the active learning playbook: it asks a human or automated oracle to label only a small, carefully chosen subset of samples, selected to be maximally informative. The result, according to the authors, is a threshold-refinement procedure that improves detection performance even when the labelling budget is tiny, and even when some of the labels handed over by the oracle are simply wrong.

To appreciate why threshold selection matters so much, it helps to understand how modern anomaly detection actually works. Most data-driven approaches to monitoring multivariate time series—streams of synchronized measurements from many sensors—train a model to capture the statistical signature of normal behaviour. A temporal variational autoencoder, or TeVAE, of the kind used in this study, learns a compressed representation of healthy operating patterns and then assigns each new observation an anomaly score, a number that quantifies how badly the observation deviates from what the model considers routine. But a score alone does not an alarm make. The system still needs a cutoff: above the threshold, declare an anomaly; below it, stay silent. Choose the threshold too low and the system drowns its operators in false alarms, a failure mode so corrosive that many industrial anomaly detection deployments have been abandoned for exactly this reason. Choose it too high and genuine faults slip through unnoticed. Setting that cutoff well is arguably the single most consequential decision in the entire pipeline, and it is precisely the step where purportedly unsupervised methods most often reach for labelled data.

The traditional unsupervised alternative is to set the threshold using statistical properties of the anomaly scores themselves—typically by assuming that the vast majority of points are normal and picking a high quantile of the score distribution. This works tolerably well when the underlying assumptions hold, but real-world data rarely cooperates. Contamination of the training data with anomalies, skewed score distributions, and distributional shifts between training and deployment conditions all conspire to make the quantile heuristic unreliable. What practitioners really want is a way to calibrate the threshold against ground truth, but ground truth labels are expensive. Labelling every recorded data point by hand, especially in a big data environment where millions of multivariate observations accumulate, is simply not feasible. This is the gap that active learning is designed to fill: instead of labelling everything, label strategically.

Active learning frames the labelling problem as a dialogue between a learner and an oracle. The learner nominates a handful of samples; the oracle—a human expert, a maintenance log, a simulation—returns their labels. The art lies in the nomination. Correia and colleagues compared three families of query strategies for selecting which time series segments to send to the oracle. The random-based query strategy, RQS, is the blunt instrument: pick samples at random, without any intelligence about what might be informative. The top-based query strategy, TQS, goes to the opposite extreme, selecting the samples with the highest anomaly scores on the theory that these are the points whose true nature will most constrain the threshold. The uncertainty-based query strategy, UQS, hedges its bets by picking samples whose labels the system is least sure about. And then there is the newcomer: DQS, the dissimilarity-based query strategy, which takes a different philosophical tack entirely.

The insight behind DQS is that diversity, not extremity, may be the key to efficient learning. If a query strategy picks a batch of samples that all look alike—say, a cluster of high-scoring segments that all stem from the same type of operational state—the oracle’s answers, however accurate, convey redundant information. DQS combats this redundancy by explicitly measuring how similar candidate samples are to one another and selecting a batch that is as heterogeneous as possible. The technical tool it uses for measuring similarity is dynamic time warping, or DTW, a classic algorithm from the time series analysis literature. DTW computes an alignment between two sequences that may be stretched or compressed in time relative to one another, allowing the algorithm to recognize that two sensor traces describing the same underlying phenomenon may unfold at different speeds. Applied here to anomaly score sequences rather than raw signals, DTW gives DQS a principled distance metric: two segments whose anomaly score curves can be aligned with low warping cost are considered similar, and the strategy avoids querying both. The aim, in the authors’ words, is to maximise the diversity of queried samples, so that every precious label carries new information.

The experimental evaluation probed two questions that matter enormously in practice but are unevenly treated in the literature. The first is the straightforward one: does querying the oracle actually improve detection performance compared with a purely unsupervised threshold? The answer was an emphatic yes, and—crucially—the advantage held across all four query strategies, not just DQS. Even a small budget of queried labels, used to refine the threshold rather than to retrain the detector, delivered better anomaly detection than the unsupervised baseline. The second question is thornier and has been conspicuously underexplored: what happens when the oracle makes mistakes? Human labellers are fallible, and even automated oracles such as maintenance databases can misattribute causes. The researchers therefore deliberately injected mislabelling into their experiments, corrupting a fraction of the oracle’s answers to see how fragile each strategy would prove.

The results paint a nuanced picture. DQS, it turns out, performs best in small-budget scenarios—exactly the regime where active learning is most needed and where every label matters most. When the number of queries is severely limited, maximising diversity appears to squeeze the most value out of each interaction with the oracle. However, the other strategies showed greater robustness when mislabelling entered the picture. There is a plausible intuition here: a strategy that aggressively seeks out diverse, unusual samples may also be more exposed to the consequences of any single wrong label, whereas random sampling dilutes the damage of individual errors across a broad, statistically representative selection. The practical lesson is not that DQS is universally superior, but that the choice of query strategy should be conditioned on two budgetary realities: how many labels can be afforded, and how trustworthy the oracle is likely to be.

Perhaps the most important conclusion of the study is one of framing. Once labels are queried, the system is no longer truly unsupervised—the authors are refreshingly candid about this. But their findings show that the strict unsupervised ideal, in which no labels touch the threshold at any point, is a standard that most published methods fail to meet anyway, and one that costs real performance to maintain. The pragmatic position emerging from this work is that whenever it is feasible to consult an oracle at all, an active learning-based threshold should be preferred to the unsupervised alternative, because the performance gains survive even imperfect labelling. For industries drowning in unlabelled sensor data—automotive engineering, where co-author Goos’s affiliation with Mercedes-Benz AG is suggestive, along with manufacturing, energy and process control—this amounts to an actionable recipe: train your detector unsupervised, then spend a tiny, intelligently allocated labelling budget calibrating the alarm.

The study also makes a quieter but valuable contribution to scientific candour in the field. By systematically exploring mislabelling—a topic the authors describe as underexplored—they highlight how fragile the benchmark culture of anomaly detection research can be. Papers frequently report results under the assumption of perfect labels, an assumption that dissolves on contact with real deployment. Demonstrating that active thresholding degrades gracefully rather than catastrophically under label noise is the kind of unglamorous robustness evidence that separates methods that work in the laboratory from methods that work in the factory.

The work, which received no dedicated funding, is published open access, and the authors note that the shared version is a citable, peer-reviewed accepted manuscript carrying a permanent DOI, subject to final editorial formatting. As anomaly detection systems continue their migration from academic benchmarks into safety-critical infrastructure, the questions this team has asked—how few labels are enough, which samples deserve them, and how much error can be tolerated—will only grow in importance. DQS offers one compelling answer to the second of those questions: when the budget is tight, spend it on difference, not on more of the same.Subject of Research: Active learning-based threshold selection for unsupervised anomaly detection in multivariate time series, introducing the dissimilarity-based query strategy (DQS) using dynamic time warping.

A multivariate time series is a sequence of measurements recorded over time across several channels. A smart factory might simultaneously track temperature, vibration, pressure, motor current and production speed. A hospital monitoring system could follow heart rate, blood pressure, oxygen saturation and respiratory signals. In each case, the variables are not independent: a rise in temperature may be meaningful only when accompanied by increased vibration, while a small change in one sensor may become important when it breaks the usual relationship with several others. Anomaly detection therefore requires more than checking whether a single number is unusually high or low. The system must learn the normal temporal and cross-variable structure of the data, then identify deviations from it. Deep-learning models have increasingly become the dominant tools for this task because they can represent nonlinear relationships and long-range dependencies that conventional statistical methods may miss. Yet their growing diversity has also made it harder to tell exactly what one model is doing differently from another.

The taxonomy developed by Bruna Alves, Armando J. Pinho and Sónia Gouveia, all affiliated with IEETA, the Institute of Electronics and Informatics Engineering of the University of Aveiro in Portugal, is designed to address that problem. Rather than classifying methods according to a single feature, the framework examines the entire detection pipeline. The input dimensions describe how information enters a model, including the form of the time series and the way observations are arranged or prepared. The output dimensions concern what the method produces when it identifies a potential anomaly, such as a system-level warning, a variable-specific indication or a more detailed localization in time. The model dimensions capture the underlying deep-learning strategy. Together, these categories allow researchers to distinguish methods that may appear similar at first glance but differ in the data they use, the kind of anomaly they seek and the mechanism through which they learn normal behavior.

That distinction matters because “anomaly” is not a single, universal phenomenon. A point anomaly is an individual observation that lies far outside the expected range. A contextual anomaly may be normal in one situation but abnormal in another—for example, a high temperature during operation but not when a machine is switched off. A collective anomaly emerges only when a sequence or combination of observations becomes unusual, even though each measurement might look acceptable in isolation. In multivariate systems, anomalies can also arise from broken relationships between variables. Two sensors may each report plausible values, yet their readings may no longer evolve together as they normally do. A useful taxonomy must accommodate these different forms of abnormality and clarify whether an algorithm detects, scores, classifies or localizes them. The authors’ eleven-dimensional structure is intended to provide precisely that vocabulary, making it easier to compare the scope and assumptions of competing approaches.

The researchers established the dimensions through a two-stage process. First, they conducted a comprehensive analysis of methodological studies in MTSAD, examining how existing techniques define their inputs, outputs and model designs. They then incorporated insights from review papers, which offer a broader view of recurring categories and research trends. To test whether the framework could work beyond the literature used to construct it, the authors validated the taxonomy against an additional collection of recent publications. This step is important: a classification system that describes only the papers from which it was derived would have limited value. The validation instead sought to determine whether newer deep-learning approaches could be placed within the proposed structure and whether the dimensions remained flexible enough to accommodate ongoing changes. The authors present the result as an expandable framework, allowing future categories or dimensions to be added as researchers develop new approaches.

One of the clearest trends revealed by the analysis is the field’s movement toward Transformer-based models. Originally developed for sequence-processing tasks, Transformers use attention mechanisms to estimate which parts of an input are most relevant to one another. In a time series, attention can help a model connect measurements that are separated by long intervals or identify interactions among variables that change over time. This can be valuable when an early warning signal is subtle and its consequences appear only later. Unlike traditional recurrent architectures, which process sequences step by step, Transformers can examine relationships across a sequence more directly and can be adapted to model complex dependencies among multiple channels. Their growing presence in MTSAD reflects the broader expansion of attention-based methods across artificial intelligence. The taxonomy does not claim that Transformers are universally superior, but it makes their rise visible as part of a larger shift in the design of anomaly-detection systems.

The study also identifies reconstruction models as a dominant direction. These systems are trained to reproduce data that are considered normal. An input time series is passed through a model that compresses or transforms it and then attempts to reconstruct the original signal. If the model has learned the structure of normal operation, it should reconstruct familiar patterns accurately. When an unusual event appears, the reconstruction may be poor, producing a larger error. That error can then serve as an anomaly score. Reconstruction-based detection is attractive because it can work without extensive collections of labeled failures, which are often rare, expensive or impossible to generate safely. However, the approach depends on how well the training data represent normal conditions. A model that is too flexible might reconstruct abnormal patterns as well, reducing the contrast between normal and anomalous behavior. By placing reconstruction strategies within a shared taxonomy, the framework helps expose how they differ in their inputs, error calculations and final outputs.

The authors describe the field as converging on these Transformer and reconstruction approaches while also pointing toward emerging adaptive and generative trends. Adaptive systems are intended to respond when the normal behavior of a monitored process changes. This is essential in real-world environments, where a machine ages, a patient’s baseline shifts, a network’s traffic evolves or seasonal conditions alter sensor readings. A detector trained on yesterday’s normality may generate a flood of false alarms if it cannot distinguish genuine failures from gradual changes in operating conditions. Generative methods, meanwhile, use models capable of learning a distribution of data and producing or estimating plausible observations. In anomaly detection, such models may help characterize what normal multivariate behavior looks like or identify observations that are statistically unlikely. These directions remain part of a developing landscape, but the taxonomy gives researchers a way to describe them without forcing new techniques into outdated categories.

The framework could also improve how future studies are evaluated. Researchers often compare models using different datasets, definitions of anomalies and performance measures, making direct conclusions difficult. A method may appear effective because it is tested on one type of event, while another is designed to locate the affected variable or the precise moment when a failure begins. Separating those objectives is crucial for practical deployment. An operator investigating an industrial breakdown may need to know not only that something is wrong but which component is responsible. A cybersecurity analyst may care about the start and duration of an intrusion. A clinical monitoring system may require conservative thresholds to avoid overwhelming staff with false alerts. The taxonomy’s input, output and model dimensions cannot solve these application-specific challenges on their own, but they can make the differences explicit. That transparency may help researchers design fairer comparisons and identify unanswered questions rather than simply producing another isolated model.

The Portuguese team presents the taxonomy as a reference point rather than a final verdict on the field. Its purpose is to consolidate scattered knowledge, establish common terms and remain open to future developments in deep learning for multivariate time series. The work was supported by IEETA through funding from Portugal’s Foundation for Science and Technology, and the authors report no conflict of interest. As anomaly detection becomes increasingly important for automated infrastructure, healthcare, transportation, manufacturing and digital security, the ability to classify methods may be nearly as important as inventing them. A shared framework can reveal whether progress comes from genuinely new modeling ideas, improved data handling, better definitions of anomalies or more reliable evaluation. In a field where a hidden pattern can represent either a harmless fluctuation or the first sign of a serious failure, the new taxonomy offers researchers a clearer way to tell what their systems are seeing—and what they may still be missing.