Time Series Anomaly Detection: Methods and Workflow

What is time series anomaly detection?什么是时间序列异常检测？

Place this specific workflow in context with the anomaly detection and root cause analysis guide, which connects the definitions, alternatives, validation steps, and related implementation guides.

可通过异常检测与根因分析指南理解本专题在整体流程中的位置；该指南串联了定义、替代方案、验证步骤与相关实施文章。

Time series anomaly detection identifies observations or intervals that depart from expected time-dependent behavior. A useful detector first models normal trend, seasonality, autocorrelation, calendar effects, and uncertainty; it then scores residual deviations, applies an operational threshold, and sends only actionable events for review.

时间序列异常检测用于识别偏离预期时序行为的观测点或时间区间。可靠的检测器先建模正常趋势、季节性、自相关、日历效应和不确定性，再对残差偏离进行评分，应用可运营的阈值，并只把可执行事件送入复核。

This is different from static outlier detection because the same value can be normal at one timestamp and anomalous at another. A traffic peak during a scheduled campaign may be expected; the same peak on a quiet holiday may be contextual evidence worth investigating. Detection is also not root-cause analysis: a score says where and when behavior became unusual, not why.

它不同于静态异常值检测，因为同一个数值在某个时刻可能正常，在另一个时刻却异常。营销活动期间的流量峰值可能符合预期，而安静节假日出现相同峰值则可能值得调查。检测也不等同于根因分析：异常分数说明行为在何时何处变得异常，却不能直接解释原因。

Define the anomaly before choosing an algorithm选择算法前先定义异常

Point anomaly点异常

One observation is surprising relative to a local baseline, such as a sudden latency spike.

单个观测相对局部基线明显异常，例如延迟突然升高。

Contextual anomaly语境异常

A value is unusual only given time, season, regime, or operating condition.

某个数值只在特定时间、季节、状态或运行条件下才异常。

Collective anomaly区间异常

A sequence forms an unusual pattern even when no single point crosses a limit.

一段序列整体形成异常模式，即使单点都未越过阈值。

Change point变点

The generating process shifts persistently. Repeated alerts may indicate a new regime that needs a new baseline.

数据生成过程发生持续变化；反复告警可能意味着进入需要新基线的新状态。

Also decide whether the detector evaluates one signal or relationships among many signals, whether it runs in batch or online, and whether labels exist. A multivariate time series anomaly can occur when each feature looks plausible alone but their combination is inconsistent—for example, power draw increases while throughput falls. This calls for aligned timestamps, carefully chosen features, and an explanation layer that can show which signals contributed to the score.

还要确定检测器针对单变量还是多变量关系、离线批处理还是在线流式运行，以及是否有标签。多变量时间序列异常可能表现为每个特征单独看都合理，但组合关系不一致，例如功耗上升而产量下降。这要求时间戳对齐、谨慎选择特征，并提供能够显示各信号分数贡献的解释层。

Prepare time series data without leaking the future准备时序数据，同时防止未来信息泄漏

Start with a timestamp, one or more measurements, stable entity identifiers, sampling cadence, units, timezone, and known operating context. Keep maintenance windows, deployments, holidays, promotions, sensor changes, and confirmed incidents as separate event data. They help distinguish expected shifts from unexplained behavior.

至少准备时间戳、一个或多个测量值、稳定实体标识、采样频率、单位、时区和已知运行语境。将维护窗口、发布记录、节假日、促销、传感器变更和已确认事故作为独立事件数据保留，用于区分预期变化与未解释行为。

Regularize carefully. Resampling can make methods easier to apply, but never silently invent measurements. Preserve missingness indicators and distinguish “zero” from “not observed.”谨慎统一采样。重采样便于应用方法，但不能无声制造观测；应保留缺失标记，并区分“零值”和“未观测”。
Split by time. Fit and tune on earlier periods, validate on later periods, and leave a final forward holdout. Random row splits leak future patterns into training.按时间切分。在较早时段拟合和调参，在较晚时段验证，并保留最终向前留出集；随机行切分会把未来模式泄漏到训练中。
Protect the baseline. Exclude known outages from “normal” training when appropriate, but document every exclusion. A contaminated baseline can normalize the failure you need to find.保护基线。在适当情况下从“正常”训练集排除已知故障，但必须记录每次排除；受污染的基线可能把真正故障当成正常。
Represent context. Add calendar features, operating mode, load, location, product mix, or weather only when available at scoring time and legitimately relevant.表示语境。仅在评分时可获得且确实相关时，加入日历特征、运行模式、负载、位置、产品组合或天气。

Not suitable yet: if clocks are unsynchronized, units change without a version marker, missing periods cannot be distinguished from real zeros, or the monitored process changes definition repeatedly, repair observability first. A sophisticated model cannot recover trustworthy semantics from ambiguous telemetry.

暂不适合建模：如果时钟未同步、单位变化却没有版本标记、缺失区间无法与真实零值区分，或监控对象定义频繁变化，应先修复可观测性。再复杂的模型也无法从语义含糊的遥测中恢复可信结论。

Time series anomaly detection methods compared时间序列异常检测方法比较

Choose the simplest method that captures the normal structure you actually observe选择能够表达真实正常结构的最简单方法
Method方法	Good fit适用情况	Strength优势	Main caution主要注意点
Rolling median + MAD滚动中位数 + MAD	Stable local level; robust baseline局部水平稳定；需要稳健基线	Transparent and fast透明且快速	Window size defines what “local” means窗口大小决定“局部”的含义
STL + residual scoreSTL + 残差评分	Clear recurring seasonality and gradual trend季节性清晰、趋势缓慢变化	Interpretable components分量可解释	Period and smoothing must match the process周期和光滑参数必须匹配过程
Forecast residuals预测残差	Predictable dynamics with covariates动态可预测且存在协变量	Natural uncertainty intervals可产生自然的不确定区间	Forecast error and anomaly are not identical预测误差并不等同于异常
Isolation Forest on lag features滞后特征上的隔离森林	Nonlinear multivariate screening非线性多变量筛查	Few distribution assumptions分布假设较少	Feature engineering and contamination affect ranking特征工程和污染率会影响排序
Autoencoder / sequence model自编码器 / 序列模型	Complex high-dimensional patterns at scale大规模复杂高维模式	Can model nonlinear dependencies可建模非线性依赖	Needs representative data, tuning, and explanation需要代表性数据、调优和解释机制
Matrix profile / discord search矩阵轮廓 / discord 搜索	Unusual subsequences or repeated motifs异常子序列或重复模式	Targets shape anomalies directly直接针对形状异常	Subsequence length is a consequential choice子序列长度是关键选择

Use control charts when the process is stable and limits have an operational interpretation. Use a decomposition or forecast baseline when trend and seasonality dominate. Use multivariate machine learning only after simpler baselines show a real gap. Deep learning is not automatically superior: it increases data, compute, tuning, and interpretability demands, and reconstruction models may sometimes reconstruct anomalies well.

当过程稳定且控制限具有业务含义时，可使用控制图；当趋势和季节性占主导时，使用分解或预测基线；只有在简单基线确实存在能力缺口后，才使用多变量机器学习。深度学习并非天然更优：它提高了数据、计算、调参与可解释性要求，而且重构模型有时也会很好地重构异常。

How to detect anomalies in time series: a repeatable workflow如何检测时间序列异常：可重复执行的流程

Write the event definition and response写清事件定义和响应动作Specify the entity, signal, anomaly duration, severity, latency budget, and who acts. If nobody can respond, the alert is not yet an operational requirement.明确实体、信号、异常持续时间、严重度、延迟预算和响应人员。如果无人能够响应，该告警就尚未形成运营需求。
Build a time-respecting baseline建立遵守时间顺序的基线Start with a seasonal naive forecast, rolling median/MAD, or STL. Plot observed, expected, residual, and missingness before adding complexity.从季节朴素预测、滚动中位数/MAD 或 STL 开始；增加复杂度前先绘制观测值、期望值、残差和缺失情况。
Convert deviations into a score把偏离转换为分数Use a robust standardized residual, tail probability, forecast interval exceedance, distance, isolation depth, or reconstruction error. Preserve direction and raw magnitude alongside the normalized score.可使用稳健标准化残差、尾部概率、预测区间越界、距离、隔离深度或重构误差；同时保留偏离方向、原始量级和标准化分数。
Choose threshold and event logic together联合设计阈值与事件逻辑Tune not only the cutoff but persistence, cooldown, grouping, minimum duration, and severity tiers. A pointwise threshold without event logic often creates alert storms.不仅要调整截断值，还要设计持续性、冷却期、聚合、最短持续时间和严重度等级。只有单点阈值而没有事件逻辑，往往会造成告警风暴。
Backtest chronologically按时间顺序回测Replay complete periods that include quiet operation, peaks, maintenance, holidays, drift, and confirmed incidents. Fit each fold using only earlier data.重放包含平稳期、峰值、维护、节假日、漂移和确认事故的完整时段；每个折都只能使用更早数据拟合。
Deploy with feedback and drift monitoring带反馈和漂移监控上线Log model version, features, expected value, score, threshold, event grouping, reviewer decision, and action. Monitor data freshness, alert rate, score distribution, and time-to-acknowledge.记录模型版本、特征、期望值、分数、阈值、事件聚合、复核决定和动作；监控数据新鲜度、告警率、分数分布和确认耗时。

Set thresholds from operational cost, not a magic sigma依据运营成本设阈值，而不是迷信固定 Sigma

For an additive baseline, write the observation as expected behavior plus residual. A robust local score can use the rolling median of residuals and median absolute deviation (MAD):

对于加性基线，可把观测写成期望行为加残差。稳健局部分数可以使用残差的滚动中位数和中位绝对偏差（MAD）：

score(t) = | residual(t) − median(residual window) | / (1.4826 × MAD(residual window))

The constant scales MAD toward standard deviation under a normal reference; it does not make the data normal or make one cutoff universally valid. Select thresholds using the acceptable review volume and the relative cost of false negatives versus false positives. Calibrate separate thresholds by entity or operating mode only when sample size and governance support that segmentation.

该常数在正态参考下把 MAD 缩放到接近标准差，但不会让数据变成正态，也不会使某个截断值普遍有效。应依据可接受的复核量，以及漏报与误报的相对成本选择阈值。只有样本量和治理允许时，才按实体或运行模式分别校准。

For real-time anomaly detection, calculate every feature from information available at that timestamp, bound processing delay, and define behavior for late or corrected events. Adaptive thresholds help with drift but can also learn a slowly developing failure. Use guardrails: minimum and maximum limits, freeze rules during incidents, and a reviewed schedule for retraining.

对于实时异常检测，每个特征都必须只使用当时可获得的信息，限制处理延迟，并定义迟到或修正事件的处理方式。自适应阈值能应对漂移，也可能逐渐学会正在发展的故障，因此需设置上下限、事故期间冻结规则和经过审核的再训练计划。

Example: seasonal equipment telemetry示例：具有季节性的设备遥测

Hypothetical example: a team monitors five-minute vibration measurements for a pump. The series has a daily operating schedule, planned weekend shutdowns, and a gradual level change with load. The goal is to surface sustained deviations for maintenance review within 20 minutes—not to diagnose the mechanical cause automatically.

假设示例：团队监控某水泵每五分钟一次的振动测量。序列具有每日运行计划、周末计划停机，并随负载发生缓慢水平变化。目标是在 20 分钟内发现持续偏离并交给维护复核，而不是自动诊断机械根因。

Illustrative decisions; numbers are examples, not product benchmarks示意性决策；数字仅为示例，不是产品基准
Decision决策	Example choice示例选择	Verification验证
Baseline基线	Robust STL by operating mode按运行模式进行稳健 STL 分解	Residual plots show no remaining daily pattern残差图中不再存在明显日周期
Score分数	Robust residual magnitude稳健残差幅度	Direction and raw vibration retained保留方向和原始振动值
Event rule事件规则	Four of five consecutive points exceed the review threshold连续五点中至少四点超过复核阈值	Single measurement spikes do not page staff单次测量尖峰不会通知人员
Backtest回测	Walk forward across eight hypothetical weeks在假设的八周数据上向前滚动	Review alert burden and known maintenance events复核告警负担和已知维护事件

If the detector repeatedly flags the new post-maintenance level, the team investigates whether the sensor calibration, operating regime, or equipment state changed. It does not simply widen the threshold. Once the change is confirmed and documented, the baseline can be versioned and retrained. This preserves evidence instead of teaching the model to ignore an unexplained shift.

如果检测器反复标记维护后的新水平，团队应调查传感器校准、运行状态或设备状态是否变化，而不是简单放宽阈值。变化被确认并记录后，才对基线进行版本化和再训练。这样能够保留证据，避免教会模型忽略尚未解释的变化。

Validate alerts, not just point predictions验证告警事件，而不只是单点预测

Point precision and recall can mislead when one real incident produces hundreds of flagged timestamps. Evaluate at the event level where possible: whether an incident was detected, detection delay, event precision and recall, duplicate notifications, alert duration, and review effort. Report results by entity, operating mode, severity, and time period so average performance does not hide a failing subgroup.

当一次真实事故产生数百个被标记时间点时，单点精确率和召回率会误导。应尽可能按事件评估：事故是否被检测、检测延迟、事件级精确率与召回率、重复通知、告警持续时间和复核工作量。按实体、运行模式、严重度和时段报告结果，避免平均性能掩盖失败子群。

With labels: preserve time-based splits and define matching tolerance between a predicted event and a labeled incident before scoring.有标签：保留时间切分，并在评分前定义预测事件与已标注事故之间的匹配容差。
With partial labels: treat unreviewed alerts as unknown, not automatically false. Measure precision on reviewed samples and report selection bias.标签不完整：把未复核告警视为未知，而不是自动判为误报；在已复核样本上计算精确率并说明选择偏差。
Without labels: review a stratified sample of high, medium, and low scores; test sensitivity to windows and thresholds; compare against incident records; and inject controlled faults only to test pipeline mechanics, not to claim real-world accuracy.无标签：分层复核高、中、低分样本，测试窗口和阈值敏感性，与事故记录对照；受控注入故障只能验证管道机制，不能据此声称真实准确率。

Monitor the detector after launch. Data freshness, missingness, feature ranges, residual distribution, alert rate, reviewer agreement, acknowledgement time, and model version are operational metrics. A detector can keep producing scores while its input pipeline is stale or its baseline is obsolete.

上线后还要持续监控检测器。数据新鲜度、缺失率、特征范围、残差分布、告警率、复核一致性、确认耗时和模型版本都是运营指标。即使输入管道已过期或基线已失效，检测器仍可能继续输出分数。

Operate time series anomaly detection in production在生产环境运行时间序列异常检测

A detector is a monitored decision system, not a model file that can be deployed and forgotten. Production design must cover data freshness, score behavior, alert routing, feedback, recalibration, and rollback. Keep the raw observation, expected value, interval, anomaly score, threshold version, model version, feature version, and decision together so an operator can reconstruct why an alert fired.

检测器是需要持续监控的决策系统，不是部署后即可遗忘的模型文件。生产设计必须覆盖数据新鲜度、分数行为、告警路由、反馈、重新校准和回滚。应把原始观测、期望值、区间、异常分数、阈值版本、模型版本、特征版本和决策保存在一起，使运维人员能够重建告警原因。

Monitor the input stream监控输入流

Track missingness, late arrival, duplicate timestamps, clock drift, sampling interval, unit changes, clipping, sensor resets, and category mix. A broken feed can look like a real anomaly or hide one. Route data-quality failures separately from domain anomalies and define which missing intervals suppress alerts.

监测缺失、迟到、重复时间戳、时钟漂移、采样间隔、单位变化、截断、传感器重置和类别构成。损坏的数据流既可能伪装成真实异常，也可能掩盖异常。数据质量故障应与业务异常分开路由，并定义哪些缺失区间需要抑制告警。

Monitor score and alert drift监控分数与告警漂移

Compare score distributions, alert rate, duration, severity, acknowledgement time, and alert concentration across assets or segments. A stable average can hide one failing subgroup. Use control limits and review triggers, but do not automatically retrain merely because a drift statistic moved; first identify whether the change is legitimate seasonality, a new operating regime, or corrupted data.

比较不同资产或分群的分数分布、告警率、持续时间、严重度、确认时间和告警集中度。稳定均值可能掩盖某个失效分组。可设置控制限和复核触发器，但不要仅因漂移统计量变化就自动重训；先判断它是合理季节性、新运行状态还是数据损坏。

Capture outcome feedback收集结果反馈

Let reviewers label confirmed incident, benign change, duplicate, data issue, uncertain, or missed event, and retain the rationale. Measure feedback coverage because labels from only the easiest alerts create selection bias. Join alerts to tickets, maintenance, deployments, weather, promotions, or other operational events using stable identifiers and governed time windows.

允许复核者标记已确认事件、正常变化、重复告警、数据问题、不确定或漏报，并保留理由。应衡量反馈覆盖率，因为只标注最容易判断的告警会产生选择偏差。使用稳定标识符和受控时间窗口，把告警连接到工单、维护、发布、天气、促销或其他运营事件。

Recalibrate with time-aware evidence使用时间感知证据重新校准

Re-estimate thresholds or retrain only on data available at each historical decision point. Use rolling-origin backtests that include quiet periods, known incidents, holidays, regime changes, and recent operating conditions. Compare the candidate with the deployed version on event precision, event recall, detection delay, alert burden, and cost—not only forecast error.

重新估计阈值或重训时，只使用各历史决策时点可获得的数据。采用滚动起点回测，覆盖平静期、已知事件、节假日、状态切换和近期运行条件；按事件精确率、事件召回率、检测延迟、告警负担和成本比较候选版本与在线版本，而不只看预测误差。

Version, stage, and roll back版本化、分阶段与回滚

Version preprocessing, features, model, threshold, suppression, and routing rules as one release. Shadow the candidate before it pages operators, then canary it on a bounded segment with explicit success and abort criteria. Preserve the prior decision path for rollback. A rollback must restore compatible features and thresholds, not just an older model binary.

把预处理、特征、模型、阈值、抑制和路由规则作为一个版本发布。候选版本在通知运维人员前先进行影子运行，再在边界明确的分群上灰度，并设定成功与中止标准。保留之前的决策路径以便回滚；回滚必须恢复兼容的特征与阈值，而不只是旧模型文件。

Audit multivariate explanations审计多变量解释

For multivariate detectors, show which variables, lags, residuals, or relationships contributed to the score, while stating that attribution is not causation. Check whether correlated sensors duplicate the same signal and whether explanations remain stable under small perturbations. Use the ranked evidence to guide investigation, then verify causes with domain records and intervention results.

对多变量检测器展示哪些变量、滞后、残差或关系贡献了分数，同时明确归因不等于因果。检查相关传感器是否重复同一信号，以及解释在小扰动下是否稳定。用排序证据引导调查，再结合领域记录和干预结果验证原因。

Define ownership for every layer: data producer, detector owner, alert recipient, domain reviewer, incident manager, and change approver. Review service objectives for scoring latency, freshness, availability, and maximum tolerable alert backlog. If no qualified person can act on an alert, the right response may be better aggregation, a lower-priority queue, or no alert at all—not a more sensitive threshold.

为每一层明确负责人：数据生产者、检测器所有者、告警接收者、领域复核者、事件经理和变更批准者。复核评分延迟、数据新鲜度、可用性及最大可容忍告警积压等服务目标。如果没有合格人员能够处理告警，正确方案可能是更好的聚合、较低优先级队列或不告警，而不是更敏感的阈值。

Treat cold starts, intermittent demand, irregular timestamps, and newly commissioned assets as separate operating modes. A model with too little history cannot reliably learn long seasonal cycles, and zero-heavy series may need occurrence and magnitude modeled separately. For irregular observations, decide whether resampling is scientifically defensible; forward filling can manufacture long flat segments and false recovery. Use conservative thresholds, peer-group baselines, or a review-only mode until enough representative history exists, and label that limited-evidence state in every alert.

冷启动、间歇需求、不规则时间戳和新投运资产应作为独立运行模式处理。历史太少时，模型无法可靠学习长季节周期；大量零值序列可能需要分别建模发生概率和幅度。对不规则观测，应判断重采样是否在科学上成立；前向填充可能人为制造长平段和虚假恢复。在积累足够代表性历史前，可使用保守阈值、同类资产基线或仅复核模式，并在每条告警中标明证据有限状态。

Common failures and how to prevent them常见失败及预防方法

Global three-sigma rule全局三 Sigma 规则

It ignores changing level and seasonality. Model local expected behavior and verify residual assumptions.

它忽略水平变化和季节性；应建模局部预期行为并检查残差假设。

Random train/test split随机训练测试切分

It leaks future regimes. Use chronological holdouts and walk-forward evaluation.

它会泄漏未来状态；应使用按时间留出和向前滚动评估。

One threshold for every entity所有实体共用同一阈值

Scale and noise differ. Normalize defensibly or calibrate by stable cohorts with enough data.

不同实体尺度和噪声不同；应合理标准化，或在样本充足的稳定群组内分别校准。

Alert equals root cause把告警当成根因

Correlation and timing narrow investigation but do not establish causality. Link alerts to logs, deployments, topology, and expert review.

相关性和时间关系只能缩小调查范围，不能建立因果；应关联日志、发布、拓扑和专家复核。

Other limits include rare regimes absent from training, adversarial or coordinated behavior, irregular sampling, delayed labels, multiple seasonalities, and feedback loops in which operators change the process after alerts. Record these conditions in the model card or operating procedure. For safety-, medical-, financial-, or regulatory-critical decisions, anomaly scores must not replace domain controls and accountable human judgment.

其他局限包括训练中缺失的罕见状态、对抗性或协同行为、不规则采样、标签延迟、多重季节性，以及操作人员响应告警后改变过程形成的反馈回路。应把这些条件写入模型卡或操作规程。对于安全、医疗、金融或监管关键决策，异常分数不能替代领域控制与可问责的人类判断。

Explore prepared time series with related operational evidence把准备好的时间序列与相关运营证据联合分析

Before opening the workspace, prepare timestamped data with stable IDs and units, a data dictionary, known event windows, permission to use the data, and a concrete question such as “Which signals changed before this incident?” InfiniSynapse is an AI-powered data analysis workspace for joint analysis across databases, files, documents, audio, and video. Use it to explore prepared time series alongside incident tables, logs, maintenance notes, or other connected evidence. This page does not present the product as a dedicated always-on monitoring service, automatic alerting system, or autonomous root-cause engine.

打开工作区前，请准备带时间戳、稳定 ID 和单位的数据、数据字典、已知事件窗口、数据使用权限，以及“这次事故前哪些信号发生变化”等具体问题。InfiniSynapse 是一个可联合分析数据库、文件、文档、音频和视频的 AI 数据分析工作区，可用于把准备好的时间序列与事故表、日志、维护记录或其他连接证据一起探索。本页不会把该产品描述为专用常驻监控服务、自动告警系统或自主根因引擎。

Open the InfiniSynapse AI data analysis workspace打开 InfiniSynapse AI 数据分析工作区

Time series anomaly detection FAQ时间序列异常检测常见问题

How do you detect anomalies in time series data?如何检测时间序列数据中的异常？

Establish a time-aware baseline, score the difference between observed and expected behavior, apply a threshold, group related flags into incidents, and validate alerts on representative historical periods.

建立时间感知基线，对观测与期望行为之间的差异评分，应用阈值，把相关标记聚合成事件，并在具有代表性的历史时段验证告警。

Which algorithm is best for time series anomaly detection?哪种时间序列异常检测算法最好？

No algorithm is universally best. Rolling robust statistics suit stable local behavior, STL suits clear seasonality, forecasting residuals suit predictable dynamics, and multivariate or reconstruction models help when relationships among signals matter.

不存在普遍最优算法。稳健滚动统计适合局部行为稳定的序列，STL 适合季节性清晰的序列，预测残差适合动态可预测的过程，多变量或重构模型则适合信号关系很重要的情况。

How can I detect seasonal anomalies without labels?没有标签时如何检测季节性异常？

Estimate the seasonal baseline using only appropriate historical data, score robust residuals, review the highest-scoring events, and backtest threshold stability across multiple seasonal cycles.

只使用适当的历史数据估计季节性基线，对稳健残差评分，复核得分最高的事件，并在多个季节周期上回测阈值稳定性。

What is the difference between an anomaly and a change point?异常与变点有什么区别？

An anomaly is an unusual observation or interval relative to expected behavior. A change point is a persistent shift in the generating process; it may require updating the baseline rather than repeatedly alerting on the new regime.

异常是相对预期行为而言不寻常的观测或区间。变点是生成过程发生持续变化，可能需要更新基线，而不是持续对新状态重复告警。

How do I validate anomaly detection without complete labels?标签不完整时如何验证异常检测？

Use partial incident records, injected anomalies for pipeline tests, expert review of ranked alerts, stability checks, alert-rate monitoring, and time-based backtests while keeping unlabeled results explicitly uncertain.

可使用部分事故记录、仅用于管道测试的注入异常、专家对排序告警的复核、稳定性检查、告警率监控和基于时间的回测，同时明确保留未标注结果的不确定性。

Official sources and verification notes官方来源与验证说明

These sources support the decomposition, residual scoring, and Isolation Forest behavior described here. Method implementations and defaults can change; record library versions and verify current documentation. All numbers in the worked example are hypothetical, not customer data, benchmark results, or product performance claims.

这些来源支持本文描述的分解、残差评分和隔离森林行为。方法实现与默认值可能变化，应记录库版本并核对当前文档。案例中的全部数字均为假设，不代表客户数据、基准结果或产品性能声明。

InfiniSynapse

Technical content reviewed against official statistical and machine-learning documentation.

技术内容已依据官方统计与机器学习文档复核。