Anomaly Detection in Time Series Data Based on Unthresholded Recurrence Plots

Anomalies in time series, also called “discord,” are the abnormal subsequences. The occurrence of anomalies in time series may indicate that some faults or disease will occur soon. Therefore, development of novel computational approaches for anomaly detection (discord search) in time series is of great significance for state monitoring and early warning of real-time system. Previous studies show that many algorithms were successfully developed and were used for anomaly classification, e.g., health monitoring, traffic detection, and intrusion detection. However, the anomaly detection of time series was not well studied. In this paper, we proposed a long short-term memory- (LSTM-) based anomaly detection method (LSTMAD) for discord search from univariate time series data. LSTMAD learns the structural features from normal (nonanomalous) training data and then performs anomaly detection via a statistical strategy based on the prediction error for observed data. In our experimental evaluation using public ECG datasets and real-world datasets, LSTMAD detects anomalies more accurately than other existing approaches in comparison.

Anomaly detection in time series data is a critical task with numerous applications across various domains.This study presents a comprehensive empirical review that explores the methodologies, evaluation metrics, benchmark datasets, novel techniques, and real-world case studies in anomaly detection.The study begins by examining the different methodologies employed in anomaly detection, including statistical-based methods, machine learning-based approaches, and deep learning-based techniques.Evaluation metrics such as precision, Recall, F1-score, ROC curve, and AUC are discussed, along with commonly used benchmark datasets that serve as standards for evaluating anomaly detection algorithms.Novel techniques and algorithms for anomaly detection in time series data are critically analyzed, including time series decomposition and reconstruction methods, transfer learning and domain adaptation techniques, online and streaming anomaly detection approaches, and ensemble methods.These techniques' strengths, limitations, and potential applications are discussed in detail.Real-world case studies showcase the practical applications of anomaly detection in different domains.These case studies include anomaly detection in network traffic data, energy consumption patterns, and medical sensor data.The mathematical approaches and algorithms employed in these case studies are examined to provide insights into the specific methodologies used for anomaly detection.Future research directions and challenges in anomaly detection are discussed, highlighting the importance of explainable AI and interpretable models, incorporating domain knowledge and context awareness, privacy-preserving techniques, and integrating anomaly detection with other data analysis techniques.This empirical review contributes to the field by comprehensively analyzing anomaly detection techniques in time series data.The study's findings offer valuable insights into the strengths and limitations of different methodologies and highlight emerging trends in the field.Furthermore, future research directions and challenges provide a roadmap for advancing anomaly detection in time series data analysis.

Time series classification is one of the most active research topics in time series data mining, because it covers a broad range of applications in many different domains. Representation for time series is a technique that converts time series to feature vectors representing the characteristics of time series. The performance of classifying time series depends on this representation. Chaotic time series analyses have been well-studied. Moreover, recurrence plotting underlying chaos theory is one of the most robust representation for time series. In this study, we propose a new time series representation utilising the recurrence plot technique. Moving average convergence divergence (MACD) histogram is the acceleration of time that can represent local-variation in time series. Therefore, a recurrence plot that is made from MACD histogram, which is called a MACD-histogram-based recurrence plot (MHRP), can handle time series very well. Recurrence plots are referred to as grey-scale images and we utilise stacked auto-encoders as a classifier for MHRPs. To evaluate the performance of the proposed classifier, experiments using the UCR time series classification archive was conducted. The experimental results showed that the proposed classifier outperforms other methods.

The automated detection of sequential anomalies in time series is an essential task for many applications, such as the monitoring of technical systems, fraud detection in high-frequency trading, or the early detection of disease symptoms. All these applications require the detection to find all sequential anomalies possibly fast on potentially very large time series. In other words, the detection needs to be effective, efficient and scalable w.r.t. the input size. Series2Graph is an effective solution based on graph embeddings that are robust against re-occurring anomalies and can discover sequential anomalies of arbitrary length and works without training data. Yet, Series2Graph is no t scalable due to its single-threaded approach; it cannot, in particular, process arbitrarily large sequences due to the memory constraints of a single machine. In this paper, we propose our distributed anomaly detection system, short DADS, which is an efficient and scalable adaptation of Series2Graph. Based on the actor programming model, DADS distributes the input time sequence, intermediate state and the computation to all processors of a cluster in a way that minimizes communication costs and synchronization barriers. Our evaluation shows that DADS is orders of magnitude faster than S2G, scales almost linearly with the number of processors in the cluster and can process much larger input sequences due to its scale-out property.

The article considers the problem of detecting anomalies in the time series of media content metrics obtained from Telegram channels. The task of detecting anomalies is relevant in the context of combating disinformation and analyzing the dynamics of content distribution in social networks. Anomalies in metrics, such as the number of views, shares, comments, and reactions, may indicate manipulative actions, including the use of bots, falsification of reach, or the spread of disinformation. A dataset obtained through the official Telegram API was used for the analysis. A feature of the data is the lack of retrospective values of metrics, which complicates the analysis of their dynamics. This problem was partially solved by collecting data at fixed time intervals after the publication of each post. The collected data was grouped by the channels of origin of the posts and time intervals after publication to ensure the accuracy of the analysis. Since the data were unlabeled, manual processing was used to remove outliers and ensure the reliability of the modeling. The article analyzes the functionality of five Python libraries for detecting anomalies in time series: PyOD, TODS, PySAD, Darts, and Prophet. Their compliance with the requirements was assessed, in particular, with respect to working with time series, processing incomplete data, real-time support, seasonality, and computational efficiency. A comparison was made based on tables and graphs that demonstrate the results of using each library. In particular, the PyOD library is a well-known tool for detecting anomalies, but does not support direct work with time series. TODS has the potential to detect anomalies in streaming data, but its development has been discontinued. PySAD specializes in streaming data analysis, but requires a fixed frequency of input data, which limits its application. The Darts library offers a wide set of algorithms for time series analysis, but requires pre-filling of missing values, which creates an additional load on the model. The best results were achieved using the Prophet model, which is able to work with irregular time series without the need for additional data augmentation. The experiments conducted showed that Prophet provides the best balance between forecast accuracy and computational efficiency. The choice of the amount of historical data for modeling is crucial, since excessive data increases processing time, and insufficient data reduces forecast accuracy.The results of the study indicate that none of the considered libraries is a universal solution for all tasks.However, Prophet showed the greatest potential for detecting anomalies in the time series of Telegram metrics, which makes it the best candidate for further development and adaptation in media content monitoring tasks.

Unsupervised anomaly detection by densely contrastive learning for time series data

Anomaly detection in time series data (e.g., sensor data) is becoming a fundamental research problem that has various applications. Due to the complex inter-sensor relationships, it is challenging to detect anomalous events such as system faults and attacks hidden the high-dimensional time series. Recent advancements in deep learning approaches such as Graph Neural Networks (GNN) have greatly improved anomaly detection performance in time series data. However, existing methods usually use separate components to capture spatial and temporal dependence relationship and ignore the heterogeneities in spatial-temporal data which motivates us to capture them together. In this paper, we propose a novel approach STGDNN (short for Spatial-Temporal Graph Deviation Neural Networks) that learns the spatial-temporal dependence relationship together in structure learning of graph neural networks. In addition, we use the learned spatial-temporal graph structure and attention weights to explain the detected anomalies. The experiments on three real world datasets show our superiority in detection accuracy, anomaly diagnosis, and model interpretation compared with state-of-the-art methods.

Time series consists of a sequence of data points or observations collected in chronological order. Anomalies in time series often indicate potential issues such as human operational errors, equipment failures, performance degradation, or environmental disturbances. Considering the characteristics of time series, namely high dimensionality, unboundedness, and dynamic evolution. This paper proposes an incremental relevant subspace-global and local outlier detection method based on incremental learning. Historical data are analyzed to identify relevant subspaces and construct an initial model. The model serves as a reliable reference for subsequent online anomaly detection. As new data arrive continuously, the method employs a sliding window technique to process them in real time and determines anomalies based on the pre-trained model. To adapt to the dynamic nature of time series, an incremental learning strategy is incorporated to continuously update model parameters by dynamically adjusting clustering centers and feature histograms used in the histogram-based outlier score. This design overcomes the limitations of traditional methods such as local outlier factor and histogram-based outlier score, which are incapable of online learning. The proposed approach not only enables dynamic model updates but also significantly enhances adaptability to complex and evolving time series. Experimental results demonstrate that, with the support of incremental learning, the proposal achieves superior performance in dynamic anomaly detection tasks with strong robustness and adaptability.

The ability to accurately and consistently discover anomalies in time series is important in many applications. Fields such as finance (fraud detection), information security (intrusion detection), healthcare, and others all benefit from anomaly detection. Intuitively, anomalies in time series are time points or sequences of time points that deviate from normal behavior characterized by periodic oscillations and long-term trends. For example, the typical activity on e-commerce websites exhibits weekly periodicity and grows steadily before holidays. Similarly, domestic usage of electricity exhibits daily and weekly oscillations combined with long-term season-dependent trends. How can we accurately detect anomalies in such domains while simultaneously learning a model for normal behavior? We propose a robust offline unsupervised framework for anomaly detection in seasonal multivariate time series, called AURORA. A key innovation in our framework is a general background behavior model that unifies periodicity and long-term trends. To this end, we leverage a Ramanujan periodic dictionary and a spline-based dictionary to capture both seasonal and trend patterns. We conduct experiments on both synthetic and real-world datasets and demonstrate the effectiveness of our method. AURORA has significant advantages over existing models for anomaly detection, including high accuracy (AUC of up to 0.98), interpretability of recovered normal behavior (100% accuracy in period detection), and the ability to detect both point and contextual anomalies. In addition, AURORA is orders of magnitude faster than baselines.

Detecting and removing anomalies in the time series describing physical phenomena is a big challenge faced by scientists from many fields. The aim of the article is to present the assumptions of a tool for the detection of anomalies related to any issue. The proposed universal solution based on fuzzy logic and multicriteria can be applied to any time series. Through the use of aggregation of various approaches, a universal tool based on expert knowledge was obtained. The framework was tested on the energy consumption logs received from a telecommunications company and historical data from the records from the parish registers.

Anomaly detection in time series data is a known problem, but recent growth in the number of units that can produce data require models that work on unlabelled and diverse types of data. We propose to adapt the neural network introduced by Simonyan and Zisserman in 2015 called VGG16 and used to detect and classify objects in images. We show that the VGG16 architecture with 2-dimensional convolutions replaced with 1-dimensional version could be a building block of an autoencoder approach to detect anomalies. Additionally we show that the proposed model achieves results that are similar or better than of classical anomaly detection methods.

In this paper, we have proposed a new algorithm to train neural network, called Class-Constrained Extreme Learning Machine (C\(^{2}\)ELM), which is based on Extreme Learning Machine (ELM). In C\(^{2}\)ELM, we use class information to constrain different parts of connection weights between input layer and hidden layer using Extreme Learning Machine Auto Encoder (ELM-AE). In this way, we add class information to the connection weights and make the features in the hidden layer which are learned from input space be more discriminative than other methods based on ELM. Meanwhile, C\(^{2}\)ELM can retain the advantages of ELM. The experiments shown that C\(^{2}\)ELM is effective and efficient and can achieve a higher performance in contrast to other ELM based methods.

Analysis of large data sets is increasingly important in business and scientific research. One of the challenges in such analysis stems from uncertainty in data, which can produce anomalous results. In this paper, we propose a method of anomaly detection in time series data using a Support Vector Machine. Three different kernels of the Support Vector Machine are analyzed to predict anomalies in the UCR public data set. Comparison of the three kernels shows that the defined parameter values of the RBF kernel are critical for improving the validity and accuracy in anomaly detection. Our results show that the RBF kernel of the Support Vector Machine can be used to advantage in detecting anomalies.

Fraud detection is of great importance to financial institutions. This paper is concerned with the problem of finding outliers in time series financial data using Peer Group Analysis (PGA), which is an unsupervised technique for fraud detection. The objective of PGA is to characterize the expected pattern of behavior around the target sequence in terms of the behavior of similar objects, and then to detect any difference in evolution between the expected pattern and the target. The tool has been applied to the stock market data, which has been collected from Bangladesh Stock Exchange to assess its performance in stock fraud detection. We observed PGA can detect those brokers who suddenly start selling the stock in a different way to other brokers to whom they were previously similar. We also applied t-statistics to find the deviations effectively.

Recently, OT (operational technology) networks of industrial control systems have been combined with IT networks. Therefore, OT networks have inherited the vulnerabilities and attack paths existing in IT networks. Consequently, attacks on industrial control systems are increasing, and research on technologies combined with artificial intelligence for detecting attacks is active. Current research focuses on detecting attacks and improving the detection accuracy. Few studies exist on metrics that interpret anomaly detection results. Different analysis metrics are required depending on the characteristics of the industrial control system data used for anomaly detection and the type of attack they contain. We focused on the fact that industrial control system data are time series data. The accuracy and F1-score are used as metrics for interpreting anomaly detection results. However, these metrics are not suitable for evaluating anomaly detection in time series data. Because it is not possible to accurately determine the start and end of an attack, range-based performance metrics must be used. Therefore, in this study, when evaluating anomaly detection performed on time series data, we propose a range-based performance metric with an improved algorithm. The previously studied range-based performance metric time-series aware precision and recall (TaPR) evaluated all attacks equally. In this study, improved performance metrics were studied by deriving ambiguous instances according to the characteristics of each attack and redefining the algorithm of the TaPR metric. This study provides accurate assessments when performing anomaly detection on time series data and allows predictions to be evaluated based on the characteristics of the attack.