Paper deep dive
What Streaming Anomaly Detection Finds (and Misses) in Industrial Time Series
Magali Parrino, Antoine Ajenjo, Emmanuel Remy, Pierre Stephan, Paul Boniol
Intelligence
Status: not_run | Model: - | Prompt: - | Confidence: 0%
Entities (0)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:EDF relies on continuous monitoring of its power plants to detect anomalies as soon as they occur. Given the absence of a universally optimal streaming method in unsupervised settings, we compare streaming methods with state-of-the-art TSAD models deployed online on a real nuclear power plant dataset. This work also evaluates Automated Anomaly Detection in a streaming context. Results show higher consistency for online TSAD and strong robustness from ensembling strategies.
Tags
Links
- Source: https://arxiv.org/abs/2609.39232v1
- Canonical: https://arxiv.org/abs/2609.39232v1
Trouble viewing inline? Open PDF directly â
Full Text
11,788 characters extracted from source content.
Expand or collapse full text
What Streaming Anomaly Detection Finds (and Misses) in Industrial Time Series Magali Parrino 1,2 , Antoine Ajenjo 1 , Emmanuel Remy 1 , Pierre Stephan 1 , and Paul Boniol 2 1 EDF R&D, France, first.name@edf.fr 2 Inria, ENS, CNRS, PSL, France, first.name@inria.fr Abstract. EDF relies on continuous monitoring of its power plants to detect anomalies as soon as they occur. Given the absence of a universally optimal streaming method in unsupervised settings, we compare stream- ing methods with state-of-the-art TSAD models deployed online on a real nuclear power plant dataset. This work also evaluates Automated Anomaly Detection in a streaming context. Results show higher consis- tency for online TSAD and strong robustness from ensembling strategies. 1 Introduction EDF, as the main French electric utility company, operates numerous types of power plants (e.g., dams, wind farms and nuclear power stations). Such facilities are continuously monitored in order to detect anomalies as soon as possible, to prevent further degradation. To avoid developing case-specific supervised al- gorithms requiring expert knowledge, unsupervised streaming algorithms are of high interest as to facilitate their industrial use on a wide range of plants. Time Series Anomaly Detection (TSAD) is a widely studied field, with nu- merous methods developed over time [3]. Overall, recent works [6] have offered several takeaways, notably that there is no universal best method. A similar conclusion is reached in the Streaming TSAD field [4], which has focused on de- veloping fast and adaptable outlier detection methods. However, concerns were raised [7] over the suitability of these methods for real-world applications, as anomalies might manifest as anomalous sub-sequences, which outliers-focused methods struggle to correctly detect. Therefore, pursuing a universal unsuper- vised streaming anomaly detector might be unrealistic. Automated Anomaly Detection (AutoAD) [1], comprising of ensembling strate- gies and model selection, has emerged as a promising solution. It has, however, not yet been much explored in a streaming context [1]. In this paper, we assess the relevance of AutoAD on one nuclear power plant mon- itoring, comparing Streaming and TSAD methods with basic AutoAD strategies. 2 Our Use-Case: Nuclear Power Plants Clogging Issue Nuclear power plants require water (from seas or rivers) to cool down their systems. The water is pumped through filters that can be clogged by foreign arXiv:2609.39232v1 [cs.LG] 30 Sep 2026 2M. Parrino et al. bodies. This clogging can prompt a scram (automatic reactor shutdown). Each scram involves generation downtime, restart delays and specialized teams for onsite intervention. Early clogging detection is therefore a high stakes task. The data labelled by EDF comes from the Blayais nuclear power plants site, comprised of four units of 900MWe each. As it is located at the confluence of the Dordogne river, the Garonne river and the Atlantic ocean, studies have shown [5] that the main clogging agents are decaying tree leaves carried by the rivers. High river flows carry the scraped clogging agents to the power plantsâ surroundings, and low tide with high tidal coefficients finish routing them to the water intakes. Studied Data: The time series studied comes from both the pumping stationsâ sensors and external environment parameters. For each reactor i â 1,..., 4, the pressure differential after the filter drums (âP_i) and the number of times a threshold Ï was exceeded (âP > Ï_i) are monitored. In addition, we retrieved the wind speed, the water level at 2 different distances from the site, and the river flow of both the Dordogne and the Garonne, resulting in a total of 13 dimensions. The data spans from April 1996 to June 2021, with one point per hour, generating a time series of 223k points. In total, 20 events (grouped in 6 periods) that triggered a scram were reported, as shown in Figure 1 (a). Objective: We aim to evaluate on the use-case described above the real-time performance of Online methods (TSAD literature put in a streaming context) to Streaming ones (from the Streaming TSAD literature). 3 Bridging TSAD and Streaming Literatures We apply 29 methods on the time series, 19 Online methods and 10 Streaming methods (implementations and references are available in the StrAD repository). Online Methods: Assume access to an (unlabelled) initial batch for model training. Afterward, internal parameters are fixed, and inference occurs on in- coming data without updates. The 19 TSAD methods used Online balance vetted machine learning models and recent deep learning architectures. Streaming Methods: Process the time series sequentially and allow model up- dates over time. The 10 Streaming models evaluated in this work cover different update and forgetting strategies proposed in the literature. TSAD Relevance for Streaming: A recent work [7] shows that TSAD meth- ods applied in an Online context perform overall better than methods from the streaming literature, even though these have update and forgetting mechanisms. Thus, TSAD methods may perform better than the streaming ones, while their slower inference is of no consequence in our use-case, as the stream velocity is low (one hour between each point). The behavior of Online models over streams with distribution shifts is studied in depth in a companion benchmark [7]. 4 Experimental Evaluation on our Use-Case In this study, we use VUS-PR [2] accuracy measure with a left-buffer of 72 points (i.e., 3 days). We ignore the right-buffer to favor only early detection. Moreover, Streaming Anomaly Detection in Industrial Time Series3 0 0 22 21 10 17 14 2 Number of Methods (out of 29) 6 2 23 11/09/200820/07/2009 28/06/2012 03/05/2013 Clogging Explainableevents Unexplainedevents 1 0 Î P > í _1 04/03/2012 15/07/2012 28/06/2012 KNN Score ASNR report: Reactor1ten-yearly outagefromthe 02/03/2012 to the 20/07/2012 Î P > í _3 1 0 Î P > í _1 26/04/2013 06/05/2013 03/05/2013 MCOD Score ASNR report: Reactor1 maintenance fromthe 20/04/2013 to the 04/07/2013 Î P > í _2 20/03/2007-Highesttidal coefficient of the year (116)[*] 05/03/2007-High Dordogne and Garonne flow: combinedflow at ~2300m3/s, whenthe interannual mean(1982-2006) is1300m3/s at thisperiod[*] Dordogne Flow Tidal Coef 01/2007 12/2007 1 0 OCSVM Score 120 20 1 6 2 3 45 06/03/1996 09/03/1996 10/02/2000 19/03/2003 23/03/2003 12/02/2009 02/03/2009 27/02/202123/03/2013 3 events 1 event6 events 8 events 1 event 1 event Dordogne Flow Î P > í _3 Top 15 PerformingMethods and EnsemblingTop Results (c) Events Most RepresentedAmongstthe Top 6 Score Peaksof the Methods (a) Visualisation of 2 Parametersof the Time Series(TS) 0.346 0.294 0.269 0.264 0.262 0.229 0.196 0.167 0.161 0.161 0.161 0.155 0.153 0.139 0.107 0.353 0.335 0.313 0.294 0.234 LODA CNN MCD SVM RSH MCOD MemS HBOS KNN CBLOF AE LSTMAD TranAD KMeans LEAP MeanT4OnT4Str MeanT4On MeanT4Str MeanT15 Mean 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 Rank Method VUS-PR Methodsâ Performance per Category (b) General Results 06/03/1996 09/03/1996 10/02/2000 19/03/2003 23/03/2003 23/03/2013 12/02/2009 02/03/2009 27/02/2021 20/03/2007 OnlineStreaming Ensembling Fig. 1. (a) Partial Visualisation of the Data; (b) Performances of Online, Streaming, and Ensembling Strategies; (c) Consensus Amongst Top 6 Score Peaks of the 29 Models, Explanation of Some False Positives ([*]: Ifremer data) we train on the first 25% of the time series, where the training set contains 2 clusters of anomalies. Finally, if needed for the model, we apply z-normalization, with the mean and standard deviation computed on the training batch only. 4.1 Online vs. Streaming vs. Ensembling An analysis of the distributions presented in Figure 1 (b) reveals a notable dis- crepancy between mean and median performance metrics. While the mean per- formance (represented by the dotted line) is comparable across both categories, the Online median (solid line) is significantly higher than that of the Streaming group. This statistical divergence is driven by specific outliers: although LODA, a streaming method, achieves the highest individual performance, the Online models demonstrate superior collective consistency. By aggregating the anomaly scores of the 29 methods, we evaluate ensembling strategies ranging from unsupervised to supervised. Mean denotes the simple average across all 29 models. MeanTktype denotes the average over the top k models within a category (Online or Streaming); when no type is specified, selection is across the combined pool. The results underline the robustness of aggregation strategies. Unsupervised Mean reaches the top-six ranking, while basic supervised top-k selections secure top-two ranking and, in one instance, outperform the best-performing individual model. These findings suggest that AutoAD ensures high performance stability through ensemble agreement, as individual model weaknesses are compensated across the pool. 4M. Parrino et al. 4.2 Phenomenological Insights The advantages of ensembling are further illustrated by the consensus analysis in Figure 1 (c). Overall, we observe that (1) obvious anomaly clusters (3, 4) are identified by a large majority of models and isolated anomalies (clusters 2, 5, 6) are rarely captured; (2) certain False Positives (FP) are highly recurrent across the model pool. Analysis using data from Ifremer (oceanographic research institute) and ASNR (French Nuclear Safety Authority) provides potential ex- planations for these consensual FP: 20/03/2007 FP: A high river flow followed by a peak spring tide are highly con- ducive to clogging. The model consensus suggests an anomaly, though perhaps mitigated by preemptive on-site intervention, preventing a scram. 20/07/2012 and 04/07/2013 FP: These coincide with scheduled reactor 1 shutdowns. In an unsupervised setting, the resulting variance in operational parameters is flagged by the models as a deviation from the statistical norm. 5 Conclusion and Implications for Operational Reliability Our study highlights two critical considerations for the deployment of unsuper- vised anomaly detection in industrial settings: (1) anomaly detectors flag any deviation from a perceived normal behavior, so rare events may be detected alongside the anomaly of interest; (2) ensembling provides a reliable proxy for the physical reality of an event, even if exhaustive recall is not achieved. Therefore, AutoAD is a promising approach toward autonomous monitoring in industrial applications. For now, none of the evaluated methods are operationally deployed at EDF. The primary remaining challenge is the development of unsu- pervised streaming top-k selection mechanisms. References 1. Bahri, M., et al.: AutoML: state of the art with a focus on anomaly detection, challenges, and research directions. Int. J. Data Sci. Anal. 14(2), 113â126 (2022) 2. Boniol, P., et al.: VUS: Effective and Efficient Accuracy Measures for Time-Series Anomaly Detection. VLDB J. 34(3), 32 (2025) 3. Boniol, P., et al.: Dive into Time-Series Anomaly Detection: A Decade Review. CoRR (2024) 4. Cao, Y., et al.: Revisiting streaming anomaly detection:benchmark and evaluation. Artif. Intell. Rev. 58(1), 8 (2025) 5. Fuentes Cid, A.: Etude pluridisciplinaire dâune perturbation industrielle dans lâestuaire de la Gironde: implications du transport et de la dynamique de dĂ©gra- dation des dĂ©bris vĂ©gĂ©taux sur le fonctionnement de la source froide du CNPE du Blayais. Thesis (2014) 6. Liu, Q., et al.: The Elephant in the Room: Towards A Reliable Time-Series Anomaly Detection Benchmark. NeurIPS 2024 (2024) 7. Parrino, M., et al.: In a Streaming World, Should You Stand Still? A Comprehensive Benchmark of Anomaly Detection in Streams, KDD â26 (2026)