🤖 AI

CRAFTIIF: Cross-Resolution Analytic Four-Type Interpretable Isolation Forest for Multivariate Time Series Anomaly Detection

CRAFTIIF is a fully unsupervised framework that achieves state-of-the-art performance and inherent interpretability in multivariate time series anomaly detection by employing cross-resolution analytic wavelet features and a specialized five-branch Isolation Forest architecture to simultaneously identify point, distributional, temporal, and collective anomalies without dataset-specific tuning.

Original authors: William Smits

Published 2026-06-12

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: William Smits

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are the chief security guard for a massive, high-tech factory with hundreds of sensors monitoring everything from temperature to vibration. Your job is to spot when something goes wrong. But "going wrong" isn't just one thing. Sometimes a sensor spikes for a split second (a point anomaly). Sometimes the whole machine starts running at a weirdly high temperature for hours (a distributional anomaly). Sometimes the rhythm of a motor changes, like a heart skipping a beat (a temporal anomaly). And sometimes, two sensors that usually move in perfect sync suddenly start moving in opposite directions, even though each one looks normal on its own (a collective anomaly).

Most existing security systems are like guards who only know how to spot one type of trouble. If you ask a "spike detector" to find a "rhythm change," it gets confused and misses it.

This paper introduces a new system called CRAFTIIF (pronounced like "crafty"). Think of it as a team of five specialized detectives, each with a unique set of tools, working together to solve the mystery of what's wrong.

The Five Detectives (The Architecture)

Instead of using one giant, confused brain to look at all the data, CRAFTIIF splits the work:

The "Spike" Detective: Uses a tool called a DOG wavelet (imagine a magnifying glass that only sees sharp, sudden jumps). This detective looks for instant sensor failures.
The "Level Shift" Detective: Uses a Haar wavelet (like a ruler that measures sudden jumps in height). This one spots when a machine stays at a new, wrong temperature or pressure.
The "Rhythm" Detective: Uses a Morlet wavelet (like a metronome that listens for changes in beat). This one catches when a motor starts humming at the wrong speed.
The "Teamwork" Detective: Uses a Coiflet wavelet and correlation checks. This one looks at pairs of sensors. If two sensors usually dance together but suddenly start fighting, this detective raises the alarm, even if neither sensor looks bad on its own.
The "Team Leader" (Meta-IF): This detective doesn't look at the raw data. Instead, it watches the other four detectives. If the Spike, Level, and Rhythm detectives all whisper, "Something feels off," but none of them are shouting "ALARM!" individually, the Team Leader steps in to say, "Okay, this is a complex problem, let's flag it."

How They See the World (The Features)

To do their job, these detectives don't just look at the raw numbers. They use a special technique called Wavelets.

Imagine you are listening to a song. A standard microphone just records the volume. But a wavelet is like a magical ear that can zoom in to hear a single drum hit (high frequency) or zoom out to hear the whole chorus (low frequency) simultaneously.

CRAFTIIF creates 500 random "ears" for each detective. It's like giving each detective 500 different pairs of glasses with slightly different lenses. Some lenses zoom in on tiny details, others on big trends. By casting a wide net with these random lenses, the system is incredibly good at catching weird patterns without needing to be taught what "weird" looks like beforehand.

The Smart Alarm System (Adaptive Thresholds)

One of the biggest problems in security is setting the alarm sensitivity.

If you set it too high, you get false alarms (the dog barks at a leaf).
If you set it too low, you miss the intruder.

Most systems use a fixed rule (e.g., "If the score is above 90, sound the alarm"). But in the real world, sometimes 1% of the data is bad, and sometimes 70% is bad. A fixed rule fails miserably here.

CRAFTIIF uses a smart, adaptive alarm. It looks at the distribution of scores and asks: "Does this look like two distinct groups (normal vs. bad) or just one big blob?"

If it sees two clear groups, it uses a mathematical trick (Otsu) to find the perfect line between them.
If it sees a messy blob, it uses a different trick (MAD) to find the outliers.
This allows the system to work perfectly whether the anomaly rate is 0.1% or 69%.

The "Truth Detector" (Diagnostic Framework)

The authors realized that sometimes, even the best detective can't solve a case because the clues are missing. They built a diagnostic tool to tell you why the system failed:

The "Oracle" Score: They calculate the best possible score the system could get if it had a magic threshold. If the actual score is close to this, the system is working great.
The "Detectability Limit": If the Oracle score is still terrible, it means the anomaly is statistically invisible.
- Example: In some datasets, the "bad" data looks more normal than the "good" data (like a fake ID that is so perfect it looks more real than a real ID). The paper found that for 6 out of 19 test datasets, no unsupervised method could possibly succeed because the anomalies were camouflaged. This is a crucial finding: it tells engineers, "Stop trying to fix the algorithm; you need human experts or different data."

The Results

The team tested CRAFTIIF on 19 different real-world datasets (from server machines to heart monitors to crowd flow).

No tuning: They used the exact same settings for all 19. No tweaking for specific machines.
The Winner: CRAFTIIF beat every other method tested in the benchmark, including deep learning models that require massive training data.
Interpretability: When CRAFTIIF raises an alarm, it doesn't just say "Error." It says, "The Rhythm Detective found a frequency change," or "The Teamwork Detective found a correlation breakdown." This tells the human operator exactly what kind of problem to look for.

In Summary

CRAFTIIF is a smart, unsupervised security system for time-series data. It uses a team of specialized "detectives" with magical zoom-lenses (wavelets) to spot four different types of trouble. It has a self-adjusting alarm that works whether trouble is rare or common. Most importantly, it tells you why it raised the alarm and honestly admits when a problem is impossible to solve without human help. It proved that you don't need a giant, black-box AI to find anomalies; you just need the right structure and the right tools.

Technical Summary: CRAFTIIF for Multivariate Time Series Anomaly Detection

Problem Statement

Anomaly detection in multivariate time series (MTSAD) faces three fundamental challenges that hinder practical deployment:

Anomaly Type Heterogeneity: Real-world anomalies manifest in four structurally distinct forms: point anomalies (isolated spikes), distributional anomalies (sustained level shifts), temporal anomalies (rhythm/frequency changes), and collective anomalies (inter-sensor correlation breakdowns). Existing unsupervised methods typically target only one or two types and degrade when evaluated across all four simultaneously.
Absence of Labels: Supervised methods require annotated data, which is rarely available at deployment. Fully unsupervised methods learning only from normal data are required but often struggle with the diversity of anomaly types.
Interpretability: Practitioners need to know why an anomaly was flagged (which channels, time scales, and anomaly type). Most deep learning methods offer limited interpretability (e.g., attention weights) that do not clearly map to physical causes or specific anomaly types. Post-hoc feature importance scores often conflate features from different anomaly types, creating ambiguity.

Methodology: CRAFTIIF

The authors propose CRAFTIIF (Cross-Resolution Analytic Four-Type Interpretable Isolation Forest), a fully unsupervised framework designed to detect all four anomaly types simultaneously without dataset-specific tuning.

Core Architecture

The pipeline consists of four stages:

Data Quality Preprocessing: Handles missing values and NaNs using a confidence-tier system (full, soft, suppressed) and auto-configures window length ( $W$ ) and stride ( $s$ ) based on the autocorrelation function (ACF) decay of the training signal.
Random Multiresolution Analytic Feature Extraction:
- Wavelet Families: Four specific wavelet families are selected to maximize discriminability for each anomaly type:
  - Morlet: Targets temporal anomalies (oscillatory rhythm changes).
  - DOG (Mexican Hat): Targets point anomalies (local curvature/extrema).
  - Haar: Targets distributional anomalies (step changes/level shifts).
  - Coiflet: Targets collective anomalies (cross-scale correlation structure).
- Random Draws: For each family, $K=500$ random draws are generated. Each draw samples a scale (log-uniform), a channel weight vector (Dirichlet distribution), and a feature group (Amplitude, Phase, Quantile, or Cross-scale).
- Efficiency: A vectorized FFT-based Continuous Wavelet Transform (CWT) is used, reducing computation to three batched operations regardless of $K$ .
- Collective Features: Pairwise Pearson correlations between all channel pairs are appended to the collective branch features.
Structured Five-Branch Detection:
- Five independent Isolation Forests (IFs) are trained:
  - Four Type-Specific IFs: One for each anomaly type, trained exclusively on features corresponding to that type (e.g., the Point IF uses only DOG features).
  - One Meta-IF: Trained on the normalized score vector of the four type-specific branches to detect compound anomalies where multiple branches show subtle deviations.
- This structure prevents cross-type feature interference and ensures that a detection by a specific branch is directly attributable to that anomaly type.
Adaptive Threshold Calibration:
- Instead of a fixed percentile threshold, CRAFTIIF uses an Otsu/MAD hybrid approach.
- It calculates the bimodality strength ( $\beta$ ) of the test score distribution.
- If $\beta > 0.75$ (strong bimodality), it uses the Otsu threshold.
- If $\beta < 0.40$ (unimodal), it uses a Median Absolute Deviation (MAD) based threshold.
- It automatically detects and disables "anti-correlated" branches where anomalies score lower than normal data.

Diagnostic Framework

The paper introduces a diagnostic suite to distinguish between method failure and fundamental data limitations:

Oracle F1: The maximum achievable F1 by sweeping all thresholds (computed post-hoc).
Detectability Limits: Identifies datasets where $F1_{oracle} < 0.05$ , indicating the anomaly is statistically indistinguishable from normal data in the feature space (e.g., camouflage or flatline anomalies).
Branch Separation Ratios: Quantifies how well each branch discriminates anomalies from normals.
Collective Attribution: Identifies specific channel pairs driving collective anomaly detections.

Key Results

Evaluated on the mTSBench benchmark (19 datasets, 2–72 channels, anomaly rates 0.1%–69.2%) with a single configuration and no tuning:

Performance: CRAFTIIF achieved a mean F1 = 0.228 across all 19 datasets and F1 = 0.322 on the 13 detectable datasets.
Comparison: It outperformed all 24 methods in the mTSBench publication, including the previous best (PCA, 0.329 VUS-PR) and raw Isolation Forest. CRAFTIIF achieved a mean VUS-PR = 0.463, ranking #1.
Ablation Study:
- Adaptive Threshold: Contributed a 38% mean F1 improvement over fixed thresholds.
- Four-Branch Structure: Contributed a 20% improvement over a global IF trained on all features.
- Meta-IF: Contributed a 23% improvement over removing the meta-branch.
Detectability Analysis: The study revealed that 6 of the 19 datasets (e.g., Genesis, GHL, MITDB) fall into the "fundamental detectability limit" category, where no unsupervised signal-statistics method can succeed without domain knowledge or labels.

Significance and Claims

The paper claims CRAFTIIF is significant for several reasons:

Unified Detection: It is the first fully unsupervised method to simultaneously address all four structural anomaly types without dataset-specific tuning.
Intrinsic Interpretability: Unlike post-hoc explanations, the architecture provides direct attribution. If the "Point" branch fires, the anomaly is an isolated spike; if the "Collective" branch fires, it is a correlation breakdown. This is a structural guarantee, not an approximation.
Diagnostic Rigor: The proposed diagnostic framework allows practitioners to distinguish between threshold calibration errors, feature representation limits, and fundamental statistical undetectability. This prevents wasted effort on datasets that are inherently undetectable by generic unsupervised methods.
Benchmark Leadership: By achieving state-of-the-art results on the comprehensive mTSBench benchmark with a single configuration, it demonstrates that structured analytic wavelet features combined with Isolation Forests can outperform complex deep learning approaches in unsupervised settings.

The authors note limitations, including reduced performance on majority-anomaly datasets (where training data is contaminated) and datasets with "camouflage" anomalies (where faults look more normal than normal data). They suggest future work in learned channel mixing and streaming detection.