TShape: Shapelet-Based TS Anomaly Detection

• TShape is a time series anomaly detection framework that identifies shapelet anomalies via patch-based modeling, multi-scale convolution, and dual attention mechanisms.
• It captures both local shapelet features and global temporal dependencies to robustly detect complex deviations in industrial time series data.
• Empirical results demonstrate an average F1 of 0.9330 and over 10% improvement in Event F1 compared to state-of-the-art baselines.

TShape is a framework for time series anomaly detection (TSAD) designed for industrial settings in which anomalous events often appear as complex shape deviations within subsequences rather than as isolated point anomalies. It was introduced to address “shapelet anomalies,” defined as anomalous sub-sequences whose local shapes or contextual relationships deviate from normal, and it does so by combining patch-based modeling, multi-scale convolution, patch-wise positional encoding, and a patch-wise dual attention mechanism with learnable gating. Across five benchmarks, the reported results show the best average F1 of 0.9330, the best Event F1 of 0.8170, and an average improvement of more than 10% over the strongest prior baseline in Event F1 (Cui et al., 1 Oct 2025).

1. Problem setting and motivation

Time series anomaly detection is presented as critical for maintaining the reliability of modern IT infrastructures, especially in highly dynamic environments where failures and outages can have significant impacts. The motivating claim behind TShape is that many practically important anomalies are not well characterized at the point level. Instead, they manifest as complex shape deviations within subsequences that appear obvious to human experts but remain difficult for machine learning models centered on point-wise modeling (Cui et al., 1 Oct 2025).

The framework is positioned against methods such as AnomalyTransformer, FCVAE, and TimesNet, which are described as predominantly focused on point-level modeling or simple local relationships. In this framing, the central limitation is not merely insufficient temporal context, but a failure to model both inter-shapelet and intra-shapelet relationships. This places TShape within a broader shift in TSAD from isolated-point scoring toward subsequence-structured representation learning (Cui et al., 1 Oct 2025).

A plausible implication is that TShape targets a regime in which anomaly semantics are encoded in morphology, order, and periodic consistency rather than in amplitude outliers alone. That interpretation is consistent with the paper’s emphasis on local shape features, global contextual dependencies, and the visual obviousness of many anomalies to experts.

2. Shapelet anomalies as the target phenomenon

TShape formalizes its target by focusing on “shapelet anomalies,” defined as anomalous sub-sequences—patches, motifs, or shapelets—whose local shapes or contextual relationships deviate from normal. Three components of this notion are distinguished: shapelet recognition, short-term relationship, and long-term relationship. Shapelet recognition concerns identifying recurring motifs such as peaks or dips; short-term relationship concerns the interplay of shapelets within a local window, including subtle amplitude differences or sequence order; long-term relationship concerns comparison with previous cycles and period motif consistency (Cui et al., 1 Oct 2025).

The framework identifies three main challenges in detecting such anomalies. The first is diversity of shapelets: real-world data exhibits highly diverse local patterns, so a unified model must capture a wide variety of normal and anomalous shapes. The second is local and global dependency modeling: short-term nuances and long-range context must both be represented. The third is robustness to noise: industrial data is often non-stationary with varying distributions and noise levels (Cui et al., 1 Oct 2025).

This problem formulation distinguishes TShape from classical shapelet literature in which shapelets are typically treated as subsequences used for feature extraction. In the generalized shapelet transform, for example, a time series is described by its similarity to a collection of shapelets, with extensions to irregularly-sampled, partially-observed, multivariate time series, differentiable shapelet lengths, and a learned pseudometric (Kidger et al., 2020). TShape instead treats shapelets operationally as patch-level units inside an end-to-end anomaly detector, with the modeling burden carried by convolution and attention (Cui et al., 1 Oct 2025).

3. Architectural organization

TShape addresses the stated challenges through four components: patch-based modeling, multi-scale convolution, patch-wise positional encoding, and a patch-wise dual attention mechanism with adaptive fusion. The framework divides the time series into patches so that the model operates at the shapelet level rather than exclusively at the point level. This is the structural premise on which the remaining modules are built (Cui et al., 1 Oct 2025).

The multi-scale convolution module processes each patch $P_i$ using parallel 1D convolutions with varying kernel sizes $K=\{k_1,k_2,\ldots,k_m\}$:

$$h^{(k)} = \text{Conv1D}_{k}(P_i) \in \mathbb{R}^{C_m \times s}$$

The resulting features are pooled and concatenated:

$$z^{(k)}_i = \text{GAP}(h^{(k)}) \in \mathbb{R}^{C_m}$$

$$Z_i = \left[z^{(k_1)}_i, z^{(k_2)}_i, \ldots, z^{(k_m)}_i\right] \in \mathbb{R}^{C}$$

Aggregated patch features are then batch-normalized and activated:

$U_j = \text{GELU}(\text{BN}([Z_1, \ldots, Z_p]^T))$

This module is described as enabling the model to capture both abrupt and gradual temporal variations (Cui et al., 1 Oct 2025).

Patch-wise positional encoding is then applied through learnable positional embeddings:

$V = U + E$

Its stated role is to preserve the order of shapelets, since patch representations would otherwise be permutation-invariant. That step makes temporal ordering explicit before attention is applied (Cui et al., 1 Oct 2025).

The central modeling block is the patch-wise dual attention mechanism. Local attention is defined as

$L = \text{MHA}_{local}(V^T, V^T, V^T)^T + V$

and global attention as

$G = \text{MHA}_{global}(V, V, V) + V$

The two streams are fused by a learnable gate:

$g = \sigma([L; G]W_g + b_g)$

$K=\{k_1,k_2,\ldots,k_m\}$0

In the paper’s interpretation, the gate adaptively selects how much emphasis to place on local versus global information, depending on the input’s characteristics. This is the mechanism by which TShape balances fine-grained local shape features with global contextual dependencies (Cui et al., 1 Oct 2025).

4. Benchmarks, baselines, and reported performance

The empirical evaluation is conducted on five TSAD benchmarks: AIOPS, WSD, UCR, TODS, and NAB. These are described respectively as IT logs and metrics from five major web companies, web service KPIs with high-frequency bursty events, 203 datasets from diverse domains, synthetic datasets with controllable anomalies, and real and synthetic AWS cloud or IoT metrics (Cui et al., 1 Oct 2025).

The comparison includes 16 state-of-the-art methods, explicitly including FCVAE, TimesNet, OFA, TranAD, and AnomalyTransformer. The reported metrics are best F1 and Event F1, with Event F1 emphasized because it mitigates biases due to artificially inflated point-wise anomaly count in prolonged events (Cui et al., 1 Oct 2025).

The headline quantitative results are specific. TShape achieves the best average F1 of 0.9330 and the best Event F1 of 0.8170. The paper further reports more than 10% improvement over the best prior method in Event F1, using FCVAE Event F1 of 0.7161 as the comparison point. It also reports a consistent first-place ranking in Event F1 across all datasets, whereas the cited baselines fluctuate across domains (Cui et al., 1 Oct 2025).

A dataset-specific robustness claim is made for AIOPS, characterized as noisy and non-stationary. On that benchmark, TShape reaches Event F1 of 0.8049, compared with 0.7671 for LSTMAD and 0.7364 for FCVAE. In the paper’s framing, this supports the claim that the model retains performance under noise and domain shift characteristic of industrial monitoring data (Cui et al., 1 Oct 2025).

5. Ablation results, attention visualization, and robustness claims

The ablation studies are used to isolate the contributions of the major components. For multi-scale convolution, the reported result is that removing convolutions or replacing them with simple sliding window pooling substantially degrades performance, especially on TODS and UCR. The corresponding conclusion is explicit: learned multi-scale filters are critical for capturing rich, discriminative patch features and outperform hand-crafted or naive pooling (Cui et al., 1 Oct 2025).

For the dual attention block, several ablations are described. A model without local attention and using global attention only performs well on simple anomaly types but misses local shape nuances. A model without global attention and using local attention only captures detailed features but misses period or motif violations. A CNN encoder in the style of TimesNet fails to match the flexibility of dual attention. The full model is reported to require both attention streams for consistently strong performance, and the architecture is said to robustly adapt to different anomaly complexities (Cui et al., 1 Oct 2025).

The attention visualizations on UCR provide a qualitative interpretation of the mechanism. The dual-attention module assigns high weights to non-adjacent patches with correlated anomalous structure, interpreted as global context, and focused attention to patches directly overlapping the anomaly, interpreted as local shapelets. The attention profile is also reported to decay smoothly across distant patches. The paper treats these observations as evidence for coherent integration of local detail and global context (Cui et al., 1 Oct 2025).

The robustness and adaptability claims are correspondingly framed at the dataset level. TShape is described as displaying stable, state-of-the-art performance across all five benchmarks, in contrast to competitors that often degrade unpredictably when faced with new domains or noisy data. Its patch-wise dual attention and multi-scale convolution are identified as the principal mechanisms supporting that adaptability (Cui et al., 1 Oct 2025).

6. Relation to shapelet research and nomenclature

Within the broader literature on time-series shape analysis, TShape occupies a distinct place. Generalized interpretable shapelets treat the shapelet transform as a form of feature extraction in which a time series is represented by its similarity to learned shapelets, extended to continuous time so as to handle irregularly-sampled, partially-observed, multivariate time series. That framework also introduces differentiable shapelet lengths, a learned pseudometric, and a regularization term to preserve interpretability (Kidger et al., 2020). TShape, by contrast, is not organized around an explicit minimum-distance transform; it is organized around patches, multi-scale convolution, positional encoding, and dual attention for anomaly detection (Cui et al., 1 Oct 2025).

This suggests a methodological distinction between explicit shapelet-based similarity modeling and neural patch-level representation learning. The former emphasizes interpretable shapelet objects and learned discrepancies; the latter emphasizes anomaly-sensitive feature extraction and contextual interaction at the patch level. Both approaches are concerned with sub-sequence structure, but they instantiate that concern differently (Kidger et al., 2020).

The name “TShape” also has a separate usage in recent topology and sheaf theory, where it denotes the image of a functor from constructible sets to a derived sheaf category in a sheaf-theoretic construction of the “space of all shapes” (Arya et al., 2022). In the machine-learning literature, however, TShape refers specifically to the TSAD framework for complex shapelet anomalies introduced in 2025 (Cui et al., 1 Oct 2025).

TShape’s reported contribution, in that machine-learning sense, is therefore twofold: a reformulation of industrial anomaly detection around shapelet-level deviations, and an architecture in which multi-scale convolution and dual attention are explicitly coupled to represent both local morphology and global temporal consistency. The implementation is reported as publicly available through the project repository linked by the authors (Cui et al., 1 Oct 2025).