Advances on TSLies: Time Series AnomaLIES, an efficient machine learning based anomaly detection framework

The automated detection of sequential anomalies in time series is an essential task for many applications, such as the monitoring of technical systems, fraud detection in high-frequency trading, or the early detection of disease symptoms. All these applications require the detection to find all sequential anomalies possibly fast on potentially very large time series. In other words, the detection needs to be effective, efficient and scalable w.r.t. the input size. Series2Graph is an effective solution based on graph embeddings that are robust against re-occurring anomalies and can discover sequential anomalies of arbitrary length and works without training data. Yet, Series2Graph is no t scalable due to its single-threaded approach; it cannot, in particular, process arbitrarily large sequences due to the memory constraints of a single machine. In this paper, we propose our distributed anomaly detection system, short DADS, which is an efficient and scalable adaptation of Series2Graph. Based on the actor programming model, DADS distributes the input time sequence, intermediate state and the computation to all processors of a cluster in a way that minimizes communication costs and synchronization barriers. Our evaluation shows that DADS is orders of magnitude faster than S2G, scales almost linearly with the number of processors in the cluster and can process much larger input sequences due to its scale-out property.

The article considers the problem of detecting anomalies in the time series of media content metrics obtained from Telegram channels. The task of detecting anomalies is relevant in the context of combating disinformation and analyzing the dynamics of content distribution in social networks. Anomalies in metrics, such as the number of views, shares, comments, and reactions, may indicate manipulative actions, including the use of bots, falsification of reach, or the spread of disinformation. A dataset obtained through the official Telegram API was used for the analysis. A feature of the data is the lack of retrospective values of metrics, which complicates the analysis of their dynamics. This problem was partially solved by collecting data at fixed time intervals after the publication of each post. The collected data was grouped by the channels of origin of the posts and time intervals after publication to ensure the accuracy of the analysis. Since the data were unlabeled, manual processing was used to remove outliers and ensure the reliability of the modeling. The article analyzes the functionality of five Python libraries for detecting anomalies in time series: PyOD, TODS, PySAD, Darts, and Prophet. Their compliance with the requirements was assessed, in particular, with respect to working with time series, processing incomplete data, real-time support, seasonality, and computational efficiency. A comparison was made based on tables and graphs that demonstrate the results of using each library. In particular, the PyOD library is a well-known tool for detecting anomalies, but does not support direct work with time series. TODS has the potential to detect anomalies in streaming data, but its development has been discontinued. PySAD specializes in streaming data analysis, but requires a fixed frequency of input data, which limits its application. The Darts library offers a wide set of algorithms for time series analysis, but requires pre-filling of missing values, which creates an additional load on the model. The best results were achieved using the Prophet model, which is able to work with irregular time series without the need for additional data augmentation. The experiments conducted showed that Prophet provides the best balance between forecast accuracy and computational efficiency. The choice of the amount of historical data for modeling is crucial, since excessive data increases processing time, and insufficient data reduces forecast accuracy.The results of the study indicate that none of the considered libraries is a universal solution for all tasks.However, Prophet showed the greatest potential for detecting anomalies in the time series of Telegram metrics, which makes it the best candidate for further development and adaptation in media content monitoring tasks.

Anomalies in time series, also called “discord,” are the abnormal subsequences. The occurrence of anomalies in time series may indicate that some faults or disease will occur soon. Therefore, development of novel computational approaches for anomaly detection (discord search) in time series is of great significance for state monitoring and early warning of real-time system. Previous studies show that many algorithms were successfully developed and were used for anomaly classification, e.g., health monitoring, traffic detection, and intrusion detection. However, the anomaly detection of time series was not well studied. In this paper, we proposed a long short-term memory- (LSTM-) based anomaly detection method (LSTMAD) for discord search from univariate time series data. LSTMAD learns the structural features from normal (nonanomalous) training data and then performs anomaly detection via a statistical strategy based on the prediction error for observed data. In our experimental evaluation using public ECG datasets and real-world datasets, LSTMAD detects anomalies more accurately than other existing approaches in comparison.

The ability to accurately and consistently discover anomalies in time series is important in many applications. Fields such as finance (fraud detection), information security (intrusion detection), healthcare, and others all benefit from anomaly detection. Intuitively, anomalies in time series are time points or sequences of time points that deviate from normal behavior characterized by periodic oscillations and long-term trends. For example, the typical activity on e-commerce websites exhibits weekly periodicity and grows steadily before holidays. Similarly, domestic usage of electricity exhibits daily and weekly oscillations combined with long-term season-dependent trends. How can we accurately detect anomalies in such domains while simultaneously learning a model for normal behavior? We propose a robust offline unsupervised framework for anomaly detection in seasonal multivariate time series, called AURORA. A key innovation in our framework is a general background behavior model that unifies periodicity and long-term trends. To this end, we leverage a Ramanujan periodic dictionary and a spline-based dictionary to capture both seasonal and trend patterns. We conduct experiments on both synthetic and real-world datasets and demonstrate the effectiveness of our method. AURORA has significant advantages over existing models for anomaly detection, including high accuracy (AUC of up to 0.98), interpretability of recovered normal behavior (100% accuracy in period detection), and the ability to detect both point and contextual anomalies. In addition, AURORA is orders of magnitude faster than baselines.

Detecting and removing anomalies in the time series describing physical phenomena is a big challenge faced by scientists from many fields. The aim of the article is to present the assumptions of a tool for the detection of anomalies related to any issue. The proposed universal solution based on fuzzy logic and multicriteria can be applied to any time series. Through the use of aggregation of various approaches, a universal tool based on expert knowledge was obtained. The framework was tested on the energy consumption logs received from a telecommunications company and historical data from the records from the parish registers.

<p>Although modern gravity satellites monitor glacier and snow (GS) on a global scale, the contemporary Gravity Recovery and Climate Experiment (GRACE) and GRACE Follow−On (GRACE−FO) missions are only able to do so at coarse spatial resolutions and are restricted by their limited observation periods. Moreover, because of the complex mechanism behind a glacier’s mass balance, existing reconstruction methods for GRACE-like mass anomalies, including machine learning approaches and statistical models, cannot be applied to High mountain glaciers (HMGs). Here, we propose a precipitation and temperature data-driven statistical model combining hydrology and GS processes to reconstruct GRACE-like mass anomalies of HMGs, from which the hydrological and GS signals can be further separated. We reconstruct and evaluate the HMG mass anomaly time series in 14 representative high mountain regions. This method's prediction and reconstruction performance were consistent the GRACE/GRACE−FO observations (the median correlation coefficient/Nash-Sutcliffe efficiency: ~0.92/0.85). Additionally, the separated GS signals agreed with the independent satellite altimetry data used for comparison. Compared with the existing method for reconstructing GRACE-like time series of HMG mass anomalies based on machine learning, this method better reconstructed the long-term trend of GRACE-like mass anomalies, and the result from satellite laser range supports our conclusion. Our study provides an acceptable method for reconstructing and separating GRACE-like HMG mass anomaly time series, thereby assisting in the sustainable management and protection of water resources in their downstream areas.</p>

The problem of detecting anomalies in time series has attracted much attention recently due to its numerous applications. In this paper, we proposed a novel framework based on nonlinear methods. Firstly, we use time-dependent URP (Unthreholded Recurrence Plots) to represent time series, so as to capture the nonlinear characteristic of time series. Secondly, we present ELM-AE (Extreme Learning Machine Auto-Encoder) based algorithm to learn the main features of URPs. Finally, we compute residual errors as anomaly score for each time series points. This framework can perform well on complex nonlinear systems using unlabeled datasets.

The presence of anomalies in time series, i.e., data points that deviate from the expected behavior, can be a symptom of an incoming failure that may lead to costly repair. Thus, the detection of anomalous data by means of diagnostic methodologies can both reduce maintenance actions and asset unscheduled stops. To tackle this challenge, for the first time in the literature, we exploit the capabilities of Convolutional Neural Networks (CNNs), by feeding them with images obtained from multivariate time series data, transformed by means of two different approaches, namely, Gramian Angular Summation Field (GASF) and Markov Transition Field (MTF). Two CNN architectures are investigated, i.e., VGG-19 and SqueezeNet. The performance of both CNNs fed with images is compared to that of i) a Temporal Convolutional Network (TCN) fed with time series data and ii) a Support Vector Machine (SVM) model. In this paper, we present the comprehensive framework, which starts from time series transformation, goes through CNN development and ends with anomaly detection. The framework is applied to field data taken during normal operation of ten SGT-800 gas turbines, operated in combined cycle, running at base load, and located in two different regions. The normal data covers 150 days of operation. Spike faults are implanted in two out of the twenty available measured variables, i.e., compressor discharge temperature and compressor discharge pressure, by considering nine combinations of maximum fault magnitude and number of implanted spikes in each time series. The analyses carried out in this paper demonstrate that both CNNs fed with images achieve significantly higher classification accuracy than both a TCN model fed with time series data and an SVM model. Moreover, the MTF method always proves more robust than GASF method, and also allows higher accuracy values, in the range from 0.85 to 0.99.

Anomalies in time series can be a symptom of an incoming failure. Thus, the detection of anomalous data can both reduce maintenance actions and asset unscheduled stops. To tackle this challenge, we exploit the capabilities of convolutional neural networks (CNNs), fed with images obtained from multivariate time series data, transformed by means of two different approaches. Two CNN architectures are investigated, i.e., VGG-19 and SqueezeNet. The performance of both CNNs fed with images is compared to that of (i) a temporal convolutional network (TCN) fed with time series data and (ii) a support vector machine (SVM) model. In this paper, we present the comprehensive framework, which starts from time series transformation, goes through CNN development and ends with anomaly detection. The framework is applied to field data taken during normal operation of ten SGT-800 gas turbines, located in two different regions. The normal data covers 150 days of operation. Spike faults are implanted in two out of the 20 available measured variables, i.e., compressor discharge temperature and compressor discharge pressure, by considering different combinations of maximum fault magnitude and number of implanted spikes in each time series. The results demonstrate that both CNNs fed with images achieve significantly higher classification accuracy than both a TCN model fed with time series data and an SVM model. Moreover, the Markov transition field (MTF) method always proves more robust than Gramian angular summation field (GASF) method, and also allows higher accuracy values, in the range from 0.85 to 0.99.

Time series consists of a sequence of data points or observations collected in chronological order. Anomalies in time series often indicate potential issues such as human operational errors, equipment failures, performance degradation, or environmental disturbances. Considering the characteristics of time series, namely high dimensionality, unboundedness, and dynamic evolution. This paper proposes an incremental relevant subspace-global and local outlier detection method based on incremental learning. Historical data are analyzed to identify relevant subspaces and construct an initial model. The model serves as a reliable reference for subsequent online anomaly detection. As new data arrive continuously, the method employs a sliding window technique to process them in real time and determines anomalies based on the pre-trained model. To adapt to the dynamic nature of time series, an incremental learning strategy is incorporated to continuously update model parameters by dynamically adjusting clustering centers and feature histograms used in the histogram-based outlier score. This design overcomes the limitations of traditional methods such as local outlier factor and histogram-based outlier score, which are incapable of online learning. The proposed approach not only enables dynamic model updates but also significantly enhances adaptability to complex and evolving time series. Experimental results demonstrate that, with the support of incremental learning, the proposal achieves superior performance in dynamic anomaly detection tasks with strong robustness and adaptability.

Sinkholes are sudden disasters that are usually small in size and occur at unexpected locations. They may cause serious damage to life and property. Sinkhole-prone areas can be monitored using Interferometric Synthetic Aperture Radar (InSAR) time series. Defining a pattern using InSAR-derived spatio-temporal deformations, this study presents a sinkhole pattern detector, called the Sinkhole Scanner. The Sinkhole Scanner includes a spatio-temporal mathematical model such as a 2-dimensional time evolving Gaussian function as a kernel, which moves over the study area using a sliding window approach. The scanner attempts to fit the model over deformation time series of Constantly Coherent Scatterers (CCS) intersected by the window and returns the posterior variance as a measure of goodness of fit. In this way, the scanner searches for subsiding regions resembling sinkhole shapes over a sinkhole prone area. It is designed to detect large sinkholes with a high efficiency, and small sinkholes with a lower efficiency. It is tested at four different spatial scales, and on a simulated and real set of deformation data. Real data were obtained from Sentinel-1A SLC data in IW mode, over Ireland where a large sinkhole occurred on 24 September 2018. The Sinkhole Scanner was able to identify a pattern of low posterior variance zones consistent with the simulated set. In case of the real data, it is able to identify significantly low posterior variance zones near the sinkhole area with the lowest value being 51.1% of the maximum value. The results from Sinkhole Scanner over the real sinkhole site were compared with Multiple Hypothesis Testing (MHT), which identifies Breakpoint and Heaviside temporal anomalies in the deformation time series of CCS. MHT was able to identify high likelihood for Heaviside anomalies in deformation time series of CCS near the sinkhole site about 10 epochs before the sinkhole occurrence. We show that the Sinkhole Scanner is efficient in monitoring a large area and search for sinkholes and that MHT can be used successively to identify temporal anomalies in the vicinity of areas detected by the Sinkhole Scanner. Future research may address other Sinkhole shapes whereas the underlying stochastic model may be adjusted. We conclude that the Sinkhole Scanner is important to be applied at different levels of scale to converge on potential sinkhole centers.

The change point detection in periodic time series is much desirable in many practical usages. We present a novel algorithm for this task, which includes two phases: 1) anomaly measure- on the basis of a typical regression model, we propose a new computation method to measure anomalies in time series which does not require any reference data from other measurement(s); 2) change detection- we introduce a new martingale test for detection which can be operated in an unsupervised and nonparametric way. We have conducted extensive experiments to systematically test our algorithm. The results make us believe that our algorithm can be directly applicable in many real-world change-point-detection applications.

The normal operation of a device can be characterized in different temporal states. To identify these states, we introduce a segmentation algorithm called Gecko that can determine a reasonable number of segments using our proposed L method. We then use the RIPPER classification algorithm to describe these states in logical rules. Finally, transitional logic between the states is added to create a finite state automaton. Our empirical results, on data obtained from the NASA shuttle program, indicate that the Gecko segmentation algorithm is comparable to a human expert in identifying states, and our L method performs better than the existing permutation tests method when determining the number of segments to return in segmentation algorithms. Empirical results have also shown that our overall system can track normal behavior and detect anomalies.

In this paper, we examine pre-earthquake ionospheric anomalies in time series and perform a statistical test by using total electron content (TEC) derived from global ionosphere maps (GIM). The normalized GIM-TEC (GIM-TEC*), which is computed based on 15 days backward running mean of GIM-TEC, have been investigated for minimizing possible confounding effects of consecutive earthquakes and identify the abnormal signals. Meanwhile, to reduce the effect of strong geomagnetic activities such as geomagnetic storms, a criterion for removing the GIM-TEC data have been adapted; that is Dst index exceeds -60nT. Temporal variations of GIM-TEC* for large and destructive earthquakes in Japan have been studied; which are the 2004 mid-Niigata Prefecture Earthquake (M6.8), its aftershock (M6.1), the 2007 offshore mid-Niigata Earthquake (M6.8), and the 2008 Iwate-Miyagi Nairiku Earthquake (M7.2). Although there are some positive and negative TEC anomalies before and after the four earthquakes, there is a tendency that positive TEC anomalies appear 1-5 days before all the above earthquakes even in the quiet geomagnetic condition. Superposed epoch analysis has been performed for statistical analysis of TEC anomalies associated with M ≥ 6.0 Earthquakes during the 12-year period of May 1998-May 2010. The statistical result indicates the significance of the positive TEC anomalies 1-5 days before earthquakes within 1000 km from the epicenter around Japan.

The problem of detecting anomalies in time series from network measurements has been widely studied and is a topic of fundamental importance. Many anomaly detection methods are based on packet inspection collected at the network core routers, with consequent disadvantages in terms of computational cost and privacy. We propose an alternative method in which packet header inspection is not needed. The method is based on the extraction of a normal subspace obtained by the tensor decomposition technique considering the correlation between different metrics. We propose a new approach for online tensor decomposition where changes in the normal subspace can be tracked efficiently. Another advantage of our proposal is the interpretability of the obtained models. The flexibility of the method is illustrated by applying it to two distinct examples, both using actual data collected on residential routers.