6. Time Series & Sequential Decision

In the previous sections on vision and structured modeling, we mostly thought about problems in "static" spaces: an image, a record, a piece of text. In real business, however, a large portion of core metrics evolve over time: sales and traffic fluctuate daily, server load and sensor readings change every second, and financial prices and macro indicators continually adjust under the influence of policies and events. The Time Series & Sequential Decision layer focuses on: forecasting the future along the time axis, identifying anomalies, characterizing structural breaks, and on that basis making forward-looking decisions and control actions.

From a product perspective, such capabilities span critical functions like operations, planning, risk control, and scheduling: metric forecasting modules embedded in traditional BI/reporting systems, demand forecasting and safety stock recommendations in financial and supply chain planning tools, macro correlation analysis and causal mining in quantitative research software, traffic and capacity forecasting on e-commerce and mobility platforms, and metric anomaly detection and alerting in AIOps for operations. These are all typical product manifestations of this layer. Below, we elaborate from four directions: classical statistical methods, deep learning time series modeling, anomaly & change point detection, and spatio-temporal sequence modeling.

6.1 Statistical TS Modeling

In many business contexts, "time" is the natural backbone: sales vary by day/week, website traffic fluctuates with campaigns, equipment load follows user behavior, and sensor readings reflect subtle changes in system state. Classical statistical time series modeling leverages relatively interpretable and analyzable statistical models on such temporal structures to answer three core questions: What will happen in the future? How are variables related to each other? What is the current state of the system? Although deep learning has emerged prominently in many scenarios, traditional methods like ARIMA, cointegration analysis, and Kalman filtering still serve long-term roles in finance, supply chain, operations, and risk control, and often act as the "baseline" and interpretation tool for more complex systems.

From an application perspective, classical time series models are widely present in metric forecasting modules of traditional BI/reporting systems, financial and supply chain planning tools, and various quantitative research software. They can provide future prediction intervals for single or multiple time series, analyze co-movement and long-run equilibrium relationships among macro indicators, and estimate trajectories and hidden states through state-space modeling. Below, we organize the typical usage of these methods along three dimensions — scenarios, principles, and models — and then elaborate on each specific direction.

• Scenarios
  • Metric forecasting: Short- to medium-term prediction of numerical values that change over time, such as sales volume, website traffic, CPU load, and sensor readings, used for inventory stocking, capacity planning, and operations scheduling decisions.
  • Macroeconomic and financial analysis: Studying long-run relationships and short-run dynamics among macro and market indicators such as GDP, inflation rate, interest rates, exchange rates, and asset prices, supporting policy research and quantitative strategy development.
  • Process and trajectory estimation: In localization, navigation, target tracking, and equipment monitoring, estimating and smoothing time-varying trajectories, velocities, and states, and recovering the "true process" as much as possible in noisy environments.
• Principles Classical time series methods are generally based on the idea of statistical assumptions + parametric structure:
  • Assuming the time series satisfies certain stationarity or weak stationarity conditions, characterizing "how many past lags determine the current value" through autocorrelation structure (ACF, PACF).
  • In multivariate settings, using cointegration and vector autoregression (VAR) models to characterize long-run equilibrium relationships and short-run deviation corrections among multiple time series.
  • For systems with heavy noise and unobservable states, introducing latent states and observation equations to form state-space models, using Bayesian inference or recursive filtering (such as Kalman filtering) for online estimation and prediction.
• Models The model family for such methods is relatively well-defined and structurally clear, facilitating interpretation and tuning:
  • Univariate and multivariate AR/MA/ARIMA/SARIMA series, used for stationary/seasonal time series modeling — the "resident members" of BI systems and traditional forecasting modules.
  • VAR/cointegration models, used for joint modeling and causality testing of multidimensional macro and financial time series, suitable for correlation analysis at the policy and strategy level.
  • State-space models and Kalman filtering, Hidden Markov Models (HMM), etc., used for trajectory estimation, equipment state estimation, and hidden state inference — foundational tools in engineering control and signal processing.

Taken together, the strengths of classical time series modeling lie in interpretability, diagnosability, and engineering controllability: the modeling workflow, hypothesis testing, and residual analysis all have mature standards, making them easy to integrate into existing BI and planning systems. Below, we elaborate on three directions: univariate/multivariate forecasting, cointegration and causality, and state-space modeling.

6.1.1 Univariate/Multivariate Time Series Forecasting: From ARIMA to VAR

In the most typical business scenarios, the first thing we face is one or several metric curves ordered by time: for example, daily sales of a product, hourly PV of a website, per-minute CPU usage of a server room, or per-second readings from a device sensor. The goal is to provide short- to medium-term forecasts based on historical patterns and to give reasonable confidence intervals. The AR/MA/ARMA/ARIMA/SARIMA family of models is the standard toolkit designed for this purpose.

For univariate series, ARIMA-type models assume that "the current value is linearly determined by past values and random disturbances over a number of lags," and eliminate trends and seasonality by differencing and seasonal differencing to make the series stationary:

• The AR (AutoRegressive) part characterizes "the influence of own lags on the current value";
• The MA (Moving Average) part captures "the influence of historical error terms on the current value";
• The I (Integrated) part is responsible for removing trends;
• Adding seasonal terms yields SARIMA, which can explicitly describe periodic structures such as weekly or monthly patterns.

In engineering practice, one typically first performs stationarity tests (e.g., ADF), examines ACF/PACF plots, and then selects reasonable orders via information criteria (AIC/BIC) and residual diagnostics. For metrics with pronounced seasonality (e.g., e-commerce daily sales, holiday traffic), SARIMA modeling is especially suitable, and incorporating holiday features or exogenous variables can further improve forecasting performance.

When we wish to model multiple related time series jointly, we can introduce multivariate time series models. The representative method is VAR (Vector AutoRegression) and its variants. VAR treats multiple series as a joint vector, using their own and each other's lagged terms to jointly explain current values, thereby capturing mutual influences among different indicators. For example, in macroeconomic analysis, one can include GDP growth, inflation rate, interest rates, and exchange rates in a single VAR model to study impulse responses and transmission pathways; in business operations, VAR can also describe "how traffic changes in one channel affect other channels" or "the dynamic relationship between promotion intensity and sales," providing references for resource allocation.

In terms of product form, this type of univariate/multivariate forecasting capability is typically embedded in forecasting functions of traditional BI/reporting systems, and financial and supply chain planning tools: the user selects one or several time series, and the system automatically completes modeling and forecasting, providing prediction intervals, residual analysis, and model diagnostic reports to support decision-making without requiring the user to deeply understand all the mathematical details behind the decisions.

6.1.2 Cointegration and Causality: Long-Run Equilibrium Among Macro Indicators

In economics and finance, many time series appear to be random walks on the surface, but over longer time scales, there exists some kind of stable long-run equilibrium relationship. Typical examples include exchange rates and interest rate spreads, stock indices and macro earnings, commodity prices and cost indices. Individually, each series may be non-stationary; yet some linear combination oscillates around a stable level in the long run. This phenomenon is called cointegration, and it provides important clues for understanding the structural relationships among macro indicators.

In engineering practice, cointegration analysis typically involves several steps:

1. Perform unit root tests on each time series to confirm they are integrated of the same order (e.g., all I(1));
2. Conduct cointegration tests (such as the Engle-Granger two-step method, Johansen test, etc.) to determine whether there exists a non-trivial linear combination that makes the combination stationary;
3. If a cointegration relationship is found, an Error Correction Model (ECM) can be constructed to characterize "how the system gradually corrects back to equilibrium when it deviates from the long-run equilibrium in the short run."

Related to cointegration is the Granger causality test. It is not causality in the strict philosophical sense, but a statistical definition based on predictive power: if the historical information of variable X can significantly improve the prediction accuracy of variable Y, then "X Granger-causes Y." By comparing prediction errors with and without the lagged terms of a certain variable within a VAR or regression framework, one can assess the directional influence among different macro or market indicators. In quantitative research and macro analysis, this type of test is often used to identify potential leading indicators, construct factors, or validate strategy hypotheses.

From a product perspective, cointegration and causality analysis more often appear in quantitative research software, macroeconomic analysis platforms, and financial research tools. They help researchers extract relatively robust structural relationships from piles of time series and map these relationships to higher-level business concepts (such as "the long-run constraint of interest rates on exchange rates" or "spread mean-reversion among different assets"), serving as an important basis for strategy design and risk management.

6.1.3 State-Space Models and Hidden State Estimation: Kalman Filter & HMM

In many real-world systems, the time series we observe is merely a noise-contaminated surface manifestation, while what we are truly interested in is the underlying "system state" evolving over time: for example, the true position and velocity of a vehicle, the health status of equipment, or the latent behavioral patterns of users. In such cases, if we merely do ARIMA-style modeling on the observed series, it is difficult to fully leverage our understanding of the system structure. State-Space Models are proposed precisely for this kind of "hidden state + noisy observation" problem.

A state-space model typically consists of two parts:

• State transition equation: describes how the hidden state evolves over time, which can be linear or nonlinear;
• Observation equation: describes how the hidden state generates noisy observations.

Under the linear Gaussian assumption, this framework can achieve recursive estimation and prediction of the state through the Kalman Filter and Smoother: each step is divided into two major phases — "prediction" and "update" — combining the state distribution from the previous moment with the current observation to obtain a new state estimate. This is extremely common in navigation and localization (e.g., trajectory estimation, target tracking), financial time series (e.g., volatility estimation), and equipment state estimation (e.g., health monitoring, remaining useful life prediction).

Adjacent to continuous state-space models is the Hidden Markov Model (HMM). HMM assumes that the system transitions over time among a number of discrete hidden states, with different probability distributions for generating observed data under each hidden state. Through the forward-backward algorithm and the Viterbi algorithm, HMM can estimate the hidden state sequence, compute the probability of an observation sequence, and predict the next state and observation. HMM was widely used early on in speech recognition and text tagging, and is also commonly used for simple behavioral pattern recognition and event sequence modeling. It still has advantages in certain industrial and financial scenarios — interpretable structure, stable training, and easy integration with domain experience.

At the system level, state-space modeling, Kalman filtering, and HMM often serve as the underlying modules for trajectory estimation, equipment state estimation, and financial and engineering control systems, encapsulated within larger toolchains. They may not be directly exposed to end users, but behind products in navigation, target tracking, industrial control, and risk measurement, they have long played the role of "invisible engines."

6.2 Deep TS Forecasting

As data scale and scenario complexity continue to rise, classical models that rely solely on linearity and stationarity assumptions increasingly appear "inadequate" in many applications: a large number of nonlinear patterns, long-span dependencies, complex multivariate interactions, sudden behaviors, and period superposition characteristics require more flexible, higher-capacity model structures. Deep learning time series modeling has developed against this backdrop: from RNN/LSTM/GRU, to Temporal CNN/TCN, to time-series-specific Transformers, hybrid and hierarchical models — together they form the main toolkit for modern time series forecasting and modeling.

From an application perspective, deep time series models have been widely deployed in e-commerce traffic & sales forecasting platforms, supply-demand/capacity/scheduling forecasting systems, cloud resource load forecasting and capacity planning tools, used to provide unified and flexible forecasting solutions under complex structures spanning multiple categories, stores, cities, and even business lines. Compared to classical models, they emphasize "end-to-end representation learning" and "global pattern modeling," and are better at handling long sequences, high-dimensional, and multivariate scenarios. Below, we likewise elaborate along three dimensions: scenarios, principles, and models.

• Scenarios
  • Large-scale multi-sequence forecasting: Tens of thousands of sales/traffic series across product, store, and city dimensions need to be modeled jointly under a unified model, with support for cold-start and long-tail series.
  • Complex operations and scheduling: In systems for power/water supply, capacity, and shift scheduling, demand is influenced by multidimensional features (weather, holidays, price, campaigns), and there exist multi-level structures (store/city/national), requiring simultaneous attention to both global patterns and local differences.
  • Cloud resources and infrastructure: Large-scale server clusters, container platforms, network and storage loads exhibit highly nonlinear and multi-peak structures, requiring high-frequency forecasting and capacity planning to support SLOs.
• Principles The core of deep time series models lies in automatically learning multi-scale patterns and long-term dependencies from historical sequences and covariates:
  • RNN/LSTM/GRU explicitly pass "memory" along the time dimension through recurrent structures, suitable for capturing sequential dependencies and local temporal structures.
  • Temporal CNN / TCN use one-dimensional convolution and dilated convolution to expand the receptive field while ensuring causality, enabling parallel training and stable gradient propagation.
  • Time series Transformers and specially designed variants (Informer, Autoformer, TimesNet, etc.) leverage self-attention mechanisms to model complex dependencies and periodic patterns in long-sequence, multivariate settings.
  • Hybrid and hierarchical models further introduce structural assumptions of "global + local" and "multi-level time series," simultaneously learning global patterns and individual characteristics within a unified framework.
• Models In terms of concrete implementation, deep time series modeling has produced a series of representative architectures:
  • Classical deep sequence models: RNN/LSTM/GRU and autoregressive probabilistic forecasting models based on them, such as DeepAR.
  • Integrated decomposition and forecasting models: N‑BEATS and others enhance interpretability through explicit trend/seasonal decomposition modules.
  • Attention-based time series models: Temporal Fusion Transformer (TFT) and others combine attention, gating, and variable selection, suitable for multivariate business scenarios with rich covariates.
  • Long-sequence Transformer models: Informer, Autoformer, TimesNet, PatchTST, etc., with specialized designs around long-sequence efficiency and multi-scale modeling.

Below, we elaborate on three directions: deep sequence models, convolutional and Transformer models, and hybrid and hierarchical modeling.

6.2.1 Deep RNN/LSTM/GRU: From Single Series to DeepAR

In the early days of deep learning entering the time series domain, RNN/LSTM/GRU were the most natural choice. Similar to text and speech modeling, they "remember" historical information by passing hidden states between time steps, allowing the capture of more complex nonlinearities and long-term dependencies than traditional linear models. For a single or a small number of time series, simple LSTM/GRU can achieve decent forecasting results given sufficient data; in large-scale multi-sequence scenarios, one can adopt shared-parameter RNN/LSTM/GRU models, jointly training on all sequences to learn universal temporal patterns.

Building on this, autoregressive probabilistic models like DeepAR provide a standard framework for deep time series modeling: they feed historical observations and covariates into a shared RNN/LSTM/GRU network, output the parameters of the conditional distribution of the series value at each time step (e.g., Gaussian, negative binomial, etc.), and achieve end-to-end probabilistic forecasting through maximum likelihood training. This design enables the model to naturally generate prediction intervals, handle irregular scales and multi-series mixing, and facilitates deployment in scenarios such as e-commerce sales and demand forecasting.

However, RNN-type models have typical problems: gradient decay over long sequences, and inability to fully parallelize during training. Although gating mechanisms (LSTM/GRU) alleviate some of these issues, training and inference efficiency remain factors to weigh for particularly long time spans and high-frequency data. This has also prompted both industry and academia to explore more parallel-friendly structures, such as TCN and Transformer.

6.2.2 Temporal CNN & Transformer: From Local Convolution to Long-Sequence Attention

To address the efficiency and stability issues of RNNs on long sequences, Temporal CNN / TCN introduced one-dimensional convolution and dilated convolution to model temporal dependencies: by stacking multiple layers of causal convolution and progressively expanding the receptive field layer by layer, it achieves modeling of long-range history without breaking temporal causality. Compared to RNNs, TCNs can be highly parallel during training and have shorter gradient propagation paths, thus excelling in training stability and efficiency, making them suitable for high-frequency data and industrial time series forecasting scenarios that require large receptive fields.

At a higher level of complexity, Transformers and time-series-specific structures have become the protagonists of long-sequence, multivariate time series modeling in recent years. Directly using standard Transformers encounters the problem of computational complexity growing quadratically with sequence length, so a series of time-series-oriented adaptations have emerged:

• Informer reduces the computational burden on long sequences through mechanisms such as ProbSparse self-attention and optimizes the structure for forecasting tasks.
• Autoformer incorporates trend and seasonal decomposition into the self-attention framework, aiming to improve interpretability and stability while maintaining long-sequence modeling capability.
• TimesNet enhances the perception of periods and patterns by unfolding in the time-frequency domain or multi-scale representations, better handling complex, multi-period long sequences.
• PatchTST borrows the "patch" idea from Vision Transformer, treating contiguous sub-sequences as patches, improving modeling efficiency and generalization for long sequences.

These models are often particularly well-suited for complex time series scenarios with long sequences, multiple variables, and high-dimensional covariates, such as large-scale cloud resource loads, multi-region energy demand, and multi-channel traffic forecasting. They can simultaneously model multidimensional inputs, static features, and time-dependent variables within a unified architecture, and provide some clues for subsequent interpretation and diagnosis through attention weights.

6.2.3 Hybrid & Hierarchical Models: Global + Local, Multi-Level Time Series

In real business, time series are rarely "isolated": they often have clear hierarchical structures and shared patterns — for example, store/city/region/national sales hierarchies, SKU/category/brand product hierarchies, or business-line/product/channel organizational structures. If one simply models each series individually, it is difficult to leverage this hierarchical structure; while mixing all series together indiscriminately ignores their individual differences. Hybrid and hierarchical models are designed precisely to address such problems.

One common approach is the global + local model: a shared "global model" learns the common patterns of all series (such as overall trends, holiday effects, seasonality), while introducing local parameters or embedding vectors for each series or each sub-group to capture individual characteristics. This structure avoids the data sparsity problem of training separate models for long-tail series while retaining the ability to finely model popular series.

Another category is hierarchical time series (hierarchical TS) modeling: explicitly considering hierarchical constraints during the forecasting process (e.g., the sum of sub-level forecasts should be consistent with the upper-level forecast), and through top-down, bottom-up, or mid-level joint optimization, ensuring that forecasts at all levels are consistent in both value and structure. Under deep time series frameworks, this typically manifests as incorporating hierarchical features in input encoding, designing multi-head outputs for different levels, or training with hierarchical loss functions.

From a product perspective, this type of hybrid and hierarchical modeling is widely applied in e-commerce sales forecasting platforms, supply-demand/capacity/scheduling forecasting systems, and similar scenarios: the system needs to simultaneously provide forecasts at different granularities such as "single store, single product," "city level," and "national total," and maintain consistency between upper and lower levels during resource planning and KPI decomposition. The flexible structure of deep models allows such constraints to be embedded into the modeling process end-to-end, rather than relying entirely on post-hoc corrections.

6.3 Anomaly & Change Point Detection

In time series scenarios, "forecasting the future" is only part of the problem; another equally critical part is: real-time discovery of anomalies and structural changes. Whether it is equipment operation, business metrics, transaction behavior, or operations monitoring, anomaly detection and change point detection are core capabilities for ensuring system stability and identifying risks and opportunities. Traditionally, statistical threshold methods, EWMA, CUSUM, and others have been widely used; as data dimensionality and complexity increase, various machine learning and deep learning methods (Isolation Forest, One‑Class SVM, AutoEncoder/VAE, time series GAN, GNN + time series models) have also begun to play important roles.

In terms of product form, such capabilities are often embedded in equipment fault early-warning systems, business metric anomaly alerting platforms (e.g., sudden conversion rate drops), security attack and fraud detection systems, and operations AIOps alerting engines, automatically flagging suspicious points and structural changes by monitoring multidimensional time series signals in real time, and integrating with rules, knowledge bases, and manual decision-making processes. Below, we continue to elaborate from three angles: scenarios, principles, and models.

• Scenarios
  • Equipment and industrial systems: Monitoring sensor data such as temperature, vibration, current, and pressure to detect faults and degradation trends early, reducing downtime and losses.
  • Business and operations metrics: Monitoring key metrics such as PV/UV, conversion rate, order volume, latency, and error rate to quickly detect sudden drops, spikes, and abnormal fluctuations, providing alerts for operations and technical teams.
  • Security and risk control: Analyzing time series such as login behavior, transaction sequences, and access patterns to identify potential attacks, cheating, and fraud.
• Principles Anomaly and change point detection is essentially about finding significant deviations and structural breaks from "normal patterns":
  • For point anomalies and sequence anomalies, one can use statistical distribution fitting, density estimation, or boundary learning to determine whether the current observation falls outside the "normal region."
  • For change points, the focus is on abrupt changes in the statistical properties of the time series (mean, variance, correlation structure, distribution, etc.) along the time axis, and attempting to locate the time position where the change occurs.
  • In high-dimensional and multi-point networks, it is necessary to incorporate the dependency structure among multiple time series (such as topology, correlation) into the modeling, to avoid confusing local anomalies with overall trends.
• Models From the perspective of method families, they can be roughly divided into statistical methods, one-class/isolation learning methods, reconstruction-based deep models, and graph + time series combination models:
  • Statistical anomaly detection: Threshold, EWMA, CUSUM, etc., extremely efficient for univariate or simple scenarios — the foundation of traditional monitoring systems.
  • Machine learning methods: Isolation Forest, One‑Class SVM, etc., used to characterize the "normal region" in multidimensional feature space and isolate anomalous samples.
  • Deep reconstruction models: AutoEncoder / VAE / time series GAN, which learn to reconstruct normal sequences and flag anomalies when the reconstruction error is large.
  • Graph neural networks + time series models: In scenarios such as sensor networks and microservice metrics, introducing graph structure and time series models to jointly learn normal patterns, enhancing the identification of topology-related anomalies.

Below, we elaborate on three directions: point/sequence anomalies, change point detection, and multidimensional and graph-structured approaches.

6.3.1 Point Anomalies & Sequence Anomalies: From Statistical Thresholds to Reconstruction-Based Models

The most intuitive form of anomaly detection is point anomalies: the observed value at a certain time point is far from the historical normal range (e.g., CPU usage suddenly spikes to 100%, transaction amount is abnormally large, sensor reading jumps instantaneously). In traditional methods, the most common practice is to fit a statistical distribution or sliding statistics (mean, variance, quantiles) to historical normal data, set thresholds or control charts (such as EWMA, CUSUM) on this basis, and issue an alert when the current observation exceeds the acceptable interval. The advantages are simple implementation, low computational cost, and easy interpretability, so they remain widely used in a large number of operations monitoring and industrial systems.

When dimensionality increases or patterns become more complex, one can introduce one-class/isolation learning methods such as Isolation Forest and One‑Class SVM: they learn an aggregated region (or boundary) on "normal samples" and treat points falling outside this region as anomalies. By extracting statistical features (such as window mean, variance, frequency-domain features, etc.) on sliding windows of the series, these methods can also be used to identify local "sequence anomalies" (i.e., behavior deviating from normal patterns over a period of time), suitable for multidimensional metrics and scenarios where the distribution shape is difficult to precisely define.

Under the deep learning framework, methods based on reconstruction error using AutoEncoder / VAE / time series GAN offer more flexible options:

• Train an AutoEncoder or VAE on a large number of normal sequences to learn a "compress–reconstruct" model, enabling it to learn to reconstruct normal patterns;
• During online monitoring, feed new time windows into the model; if the reconstruction error increases significantly, the interval is considered to contain an anomaly;
• Time series GAN-type methods learn to generate normal sequences and look for anomaly signals in the discriminator's judgment results or generation errors.

These methods can adapt to highly nonlinear patterns and complex covariate structures, making them particularly suitable for building unified anomaly detection engines on multidimensional business metrics and complex equipment sensor data.

6.3.2 Change Point Detection: Structural Breaks and Event Activation

Unlike point anomalies and local anomalies, change point detection focuses on structural breaks in time series: for example, the mean jumps from one level to another, volatility changes, or periodicity and correlation structures adjust. Such changes often correspond to some kind of event or state switch in the real world, such as configuration changes, new policy activation, policy adjustments, production process changes, or market regime switches, and are extremely critical for business diagnosis and causal analysis.

Among traditional statistical methods, change point detection often employs techniques such as likelihood ratio tests, CUSUM, and Bayesian Online Change Point Detection (BOCPD):

• By fitting models with different parameters (e.g., different means/variances) before and after different time points, comparing the goodness of fit under the "no change point hypothesis" and the "change point hypothesis";
• In online scenarios, recursively updating the posterior probability of "whether a change point has occurred up to the current segment" at each time point, and triggering an alert once it exceeds a set threshold.

In more complex settings, one can combine deep representation learning with segmentation models, treating change point detection as a sequence segmentation problem: use neural networks to extract features, then find segment boundaries in the feature space, or directly train a model to predict the probability that a given time point is a "change point." This is particularly useful for business metrics that exhibit multiple forms of change (not just mean/variance changes) and are difficult to characterize with simple statistical assumptions.

In product systems, change point detection is typically integrated into business metric analysis platforms, A/B experiment analysis systems, and configuration and policy change monitoring tools: when key metrics show structural changes, the system can automatically flag potential change points and associate them with corresponding change events (such as version releases, parameter adjustments, policy implementations), providing clues for subsequent root cause analysis.

6.3.3 Multidimensional Time Series & Graph Structure: Joint Modeling with GNN + Time Series Models

In modern distributed systems and IoT scenarios, we often face multi-point, multidimensional time series with associated topological structures: for example, multiple measurement points in a sensor network, various service metrics in a microservice architecture, or multiple nodes and edges in a power distribution/transportation network. In such cases, performing anomaly detection on each time series individually and in isolation can easily misjudge local fluctuations or ignore overall patterns — true anomalies are often manifestations of "local-global inconsistency" or "topological structure incoordination."

To this end, a large number of combination methods of Graph Neural Networks (GNN) + time series models have emerged in recent years:

• First, construct a graph structure representing the relationships among multiple points based on the real topology (physical connections, network topology) or a correlation graph estimated from data;
• At each time step, use GNN to perform message passing on node features (the time series values of each point and their local context), learning spatial correlation features;
• Then feed the graph-encoded representations into time series models such as RNN, TCN, or Transformer to capture dynamic patterns in the time dimension;
• Finally, perform anomaly scoring or change point detection on the joint representation, achieving spatio-temporal joint anomaly identification.

This framework is particularly applicable in scenarios such as sensor network monitoring, microservice metric anomaly detection, and spatio-temporal anomaly detection in urban computing: it can distinguish "global changes" (such as an overall system load increase) from "local anomalies" (such as abnormal congestion at a single node), and can also better identify topology-related anomaly patterns (such as link-level problems, regional network failures).

At the engineering level, such methods typically appear as advanced capabilities of operations AIOps alerting systems, security and risk control platforms, and equipment fleet monitoring systems, combining basic statistical monitoring, rule systems, and expert knowledge to provide more intelligent, more context-aware anomaly discovery mechanisms for complex systems.

6.4 Spatio-Temporal Modeling

In many critical business scenarios, modeling only "time" is insufficient: "when" and "where" coexist, and the two are highly coupled. Urban traffic flow is jointly influenced by road network structure and temporal patterns; meteorology and air quality depend on both temporal evolution and geographic proximity and atmospheric flow fields; logistics, bike-sharing, and ride-hailing dispatch need to simultaneously consider the spatio-temporal distribution of demand and road/area structure. Spatio-temporal sequence modeling is precisely the systematic approach for such "time + space" joint modeling problems.

Compared to pure time series models, spatio-temporal models need to explicitly incorporate spatial dependency structure: traffic flow on adjacent road segments, air quality at nearby monitoring stations, and load and status of connected nodes are usually more correlated than points farther apart. To this end, structures such as Graph Neural Networks (GNN) and Convolutional LSTM (ConvLSTM) are widely used to combine feature learning in both spatial and temporal dimensions. At the product level, such capabilities support a large number of critical applications in urban computing platforms (traffic/pedestrian flow forecasting), meteorological/environmental forecasting systems, logistics route planning, and bike-sharing/ride-hailing dispatch platforms.

• Scenarios
  • Traffic flow and pedestrian flow forecasting: On road network or metro network structures, forecast vehicle and pedestrian flow at different time periods to support signal optimization, congestion management, and dispatch decisions.
  • Meteorology and environmental monitoring: On geographic grids or monitoring station networks, forecast the future spatio-temporal distribution of temperature, rainfall, wind, air quality, etc., providing support for forecasting and decision-making.
  • Logistics and mobility dispatch: On urban area or road network structures, forecast order demand, vehicle distribution, and warehouse/station load conditions, providing a basis for route planning, vehicle dispatch, and capacity allocation.
• Principles The core of spatio-temporal sequence modeling is simultaneously learning spatial correlation and temporal dynamics within a unified framework:
  • In the spatial dimension, characterize "who is related to whom" through graph structures or convolutional structures, and perform message passing and feature aggregation based on this;
  • In the temporal dimension, use RNN, TCN, Transformer, or specialized temporal structures to characterize dynamic changes;
  • The two can be connected in series (spatial first, then temporal), or interleaved or simultaneous (such as spatio-temporal convolution, spatio-temporal attention).
• Models Typical spatio-temporal models mostly adopt the combination form of "GNN + time series model" or "convolution + LSTM":
  • Graph neural networks + time series models: ST‑GCN, DCRNN, Graph WaveNet, ST‑Transformer, etc., capturing spatial dependencies through graph convolution or graph attention, and then capturing temporal dynamics through time series structures.
  • Convolutional LSTM-type models: ConvLSTM, Conv‑TT‑LSTM, etc., embedding spatial convolution gating within temporal recurrence to achieve joint modeling of spatio-temporal local features.

Below, we elaborate on three directions: spatio-temporal tasks and data representation, GNN + time series models, and convolutional LSTM and spatio-temporal convolution.

6.5.1 Spatio-Temporal Tasks & Data Representation: From Road Networks to Geographic Grids

Before diving into specific models, the first thing spatio-temporal sequence modeling must address is how to represent spatial structure. Unlike the one-dimensional time axis, spatial structures can be regular grids, irregular graphs, or hybrid forms.

• In traffic scenarios, roads and intersections naturally form a directed or undirected graph: nodes represent road segments or intersections, edges represent road connections and travel directions; each node has a set of features at each time step, such as traffic flow, average speed, congestion index, etc.
• In meteorology and air quality forecasting, one can use regular geographic grids (such as latitude-longitude grids), or construct the adjacency relationships among monitoring stations as a graph structure, defining edge weights based on geographic distance, wind direction, or correlation.
• In logistics and shared mobility scenarios, the city can be divided into grids or area units, each unit having features such as order volume and active vehicle count over time, while being spatially connected through adjacency relationships or actual road distances.

This unified representation of "spatial structure + time series" allows many different scenarios to be modeled as similar problems: given historical spatio-temporal sequences, predict the state of each node or grid cell at several future time steps. Subsequent model designs (whether GNN + time series models, or ConvLSTM) are all developed from this unified perspective.

At the product level, this layer of abstraction is often encapsulated in the data layer and modeling layer of urban computing platforms, meteorological/environmental forecasting systems, and route planning and dispatch platforms: business stakeholders only need to know "we are predicting future traffic/demand on the road network/grid," while the underlying data representation and spatio-temporal fusion are handled uniformly by the modeling framework.

6.5.2 Graph Neural Networks + Time Series Models: ST‑GCN, DCRNN, Graph WaveNet, etc.

For modeling spatio-temporal sequences on graph structures, the current mainstream approach is the combination of Graph Neural Networks (GNN) + time series models. Representative models include ST‑GCN, DCRNN, Graph WaveNet, ST‑Transformer, and their common characteristics are:

• In the spatial dimension, using graph convolution (GCN), graph attention (GAT), or spectral domain convolution methods to perform "neighborhood aggregation" on node features at each time step, thereby capturing spatial dependencies and the influence of topological structure;
• In the temporal dimension, using RNN (such as GRU/LSTM), TCN, or Transformer to perform sequence modeling on node-level features, capturing temporal trends and periodicity;
• Through alternating stacking or joint design, enabling the model to learn local and global patterns at multiple spatio-temporal scales.

For example, DCRNN (Diffusion Convolutional RNN) combines graph convolution with gated recurrent units, using diffusion convolution to simulate the propagation of information on road networks, and then capturing temporal dynamics through RNN, making it very suitable for tasks such as traffic flow forecasting. Graph WaveNet introduces adaptive graph structure learning and multi-scale modeling on top of graph convolution and temporal convolution, improving adaptability to complex road networks and irregular topologies. Models such as ST‑Transformer introduce self-attention mechanisms into spatio-temporal modeling, simultaneously considering correlations between different temporal and spatial positions through spatio-temporal attention modules.

In real systems, this category of GNN + time series models is widely deployed in products such as urban traffic and pedestrian flow forecasting platforms, shared mobility dispatch systems, and complex IoT network monitoring. They typically serve as one of the core forecasting engines, forming a closed loop together with rule systems, simulation models, and business strategies, enabling dispatch and planning to consider both global structure and respond to local changes.

6.5.3 Convolutional LSTM & Spatio-Temporal Convolution: ConvLSTM, Conv‑TT‑LSTM, etc.

Another important route is spatio-temporal modeling based on Convolutional LSTM (ConvLSTM) and its variants. Unlike standard LSTM, which passes one-dimensional vectors between time steps, ConvLSTM uses convolution operators in the gating structure, so that both the hidden state and input remain as multi-dimensional tensors (such as feature maps on a spatial grid). In this way, each time step's state update includes both temporal recurrence and local convolution aggregation in the spatial dimension, achieving natural modeling of spatio-temporal local patterns.

Building on this, improved models such as Conv‑TT‑LSTM attempt to enhance model expressiveness and efficiency through mechanisms such as tensor decomposition, parameter sharing, and multi-scale convolution, adapting to larger-scale, more complex spatio-temporal data. For example, in meteorological forecasting, one can stack multiple layers of ConvLSTM to perform spatio-temporal recurrence on multi-channel meteorological element maps (temperature, humidity, wind direction, etc.), predicting the spatial distribution for the next few hours or days from several historical frames; in traffic and environmental monitoring, one can also map road networks or monitoring points onto regular grids and use models such as ConvLSTM for forecasting.

Compared to GNN + time series models, the ConvLSTM family is more commonly used in scenarios with regular grid structures and pronounced local spatial smoothness, such as meteorological radar echo forecasting, air quality grid forecasting, and video frame-level prediction. Its advantages lie in relatively direct implementation, ease of leveraging existing convolutional network infrastructure for acceleration and deployment, and ease of collaboration with visual models such as CNN/ViT, for example, combining convolutional features and temporal recurrence in remote sensing image spatio-temporal modeling.

In terms of product form, models in this direction are mostly used in meteorological/environmental forecasting systems, remote sensing spatio-temporal analysis platforms, and video and image spatio-temporal forecasting, often exposing their capabilities upstream in the form of "future spatio-temporal scenario forecast maps," serving as important input for business decision-making and visual analysis.