Advances on TSLies: Time Series AnomaLIES, an efficient machine learning based anomaly detection framework

Detecting anomalies in time-varying multivariate data is crucial in various industries for the predictive maintenance of equipment. Numerous machine learning (ML) algorithms have been proposed to support automated anomaly identification. However, a significant amount of human knowledge is still required to interpret, analyze, and calibrate the results of automated analysis. This paper investigates current practices used to detect and investigate anomalies in time series data in industrial contexts and identifies corresponding needs. Through iterative design and working with nine experts from two industry domains (aerospace and energy), we characterize six design elements required for a successful visualization system that supports effective detection, investigation, and annotation of time series anomalies. We summarize an ideal human-AI collaboration workflow that streamlines the process and supports efficient and collaborative analysis. We introduce MTV (MultivariateTime SeriesVisualization), a visual analytics system to support such workflow. The system incorporates a set of novel visualization and interaction designs to support multi-faceted time series exploration, efficient in-situ anomaly annotation, and insight communication. Two user studies, one with 6 spacecraft experts (with routine anomaly analysis tasks) and one with 25 general end-users (without such tasks), are conducted to demonstrate the effectiveness and usefulness of MTV.

Automatic detection of subsequence anomalies (i.e., an abnormal waveform denoted by a sequence of data points) in time series is critical in a wide variety of domains. However, most existing methods for subsequence anomaly detection often require knowing the length and the total number of anomalies in time series. Some methods fail to capture recurrent subsequence anomalies due to using only local or neighborhood information for anomaly detection. To address these limitations, in this paper, we propose a novel graph-represented time series (GraphTS) method for discovering subsequence anomalies. In GraphTS, we provide a new concept of time series graph representation model, which represents both recurrent and rare patterns in a time series. Particularly, in GraphTS, we develop a new 2D time series visualization (2Dviz) method, which compacts all 1D time series patterns into a 2D spatial temporal space. The 2Dviz method transfers time series patterns into a higher-resolution plot for easier sequence anomaly recognition (or detecting subsequence anomalies). Then, a Graph is constructed based on the 2D spatial temporal space of time series to capture recurrent and rare subsequence patterns effectively. The represented Graph also can be used to discover single and recurrent subsequence anomalies with arbitrary lengths. Experimental results demonstrate that the proposed method outperforms the state-of-the-art methods in terms of accuracy and efficiency.

Time series arise frequently in many sciences and engineering application, including finance, digital audio, motion capture, network security, and transportation. In this work, we propose a technique for discovering anomalies in time series that takes advantages of the Symbolic Aggregate approXimation (SAX) technique and inspiration from a motif discovery algorithm. We use SAX to reduce the dimension of the time series and apply the idea of motif discovery to detect anomalies. We consider recessive sequences instead of frequent sequences similar to motif finding. We evaluate the algorithm on several real-world data from different areas, such as the car speed data, the motion capture data, and the weather data. Experiments demonstrate the effectiveness of the proposed algorithm to discover anomalies in real-world time series.

Задача обнаружения аномалий – является одной из ключевых при создании киберфизических систем, так как позволяет в режиме реального времени анализировать данные, поступающие с различных устройств, и оценивать состояние среды. В данной статье сравниваются 14 одномерных методов обнаружения аномалий во временных рядах, использующих статистический подход и методы машинного обучения. Эта работа позволит оценить различные подходы к задаче обнаружения аномалий. Сравнение данных методов проводится на тестовых наборах данных из открытых источников. Результатом работы является анализ точности и производительности методов обнаружения аномалий в одномерных числовых рядах. Как итог, статистические методы являются более точными, обнаруживая точечные и коллективные аномалии, при этом требуя меньше времени на вычисления. Измерения, приведенные в данной статье, проводились на одномерных рядах, обнаружение аномалий в многомерных временных рядах будет предметом дальнейшего изучения. The task of detecting anomalies is one of the key tasks in creating cyber-physical systems, as it allows you to analyze data coming from various devices in real time and assess the state of the environment. This article compares 14 one-dimensional methods for detecting anomalies in time series using a statistical approach and machine learning methods. This work will allow us to evaluate different approaches to the problem of detecting anomalies. The comparison of these methods is carried out on test data sets from open sources. The result of the work is an analysis of the accuracy and performance of methods for detecting anomalies in one-dimensional numerical series. As a result, statistical methods are more accurate, detecting point and collective anomalies, while requiring less time for calculations. The measurements given in this paper were performed on one-dimensional time series, and the detection of anomalies in multidimensional time series will be the subject of further study.

Anomalies identification of Earth's rotation rate time series (2012–2017) for possible correlation with strong earthquakes occurrence

Anomaly detection offers an important type of machine learning analysis for industrial automation systems because it is one of the highest goals in the industrial domain to avoid production disturbances and to stay productive. If devices are not operating anymore within normal bounds, or if the produced product quality is no longer within normal bounds, then the plant operator wants to be informed as early as possible. Anomaly detection can provide this type of information for the operator. This paper presents a solution pipeline for the detection and explanation of anomalies in the multivariate time series of industrial plant processes, and a possible implementation of this pipeline that is fully based on the use of neural network architectures. The pipeline consists of three consecutive steps, that build on each other, to successively explore in depth the anomalies and their underlying root-causes. The three steps of the pipeline are: 1) the detection of the anomaly itself, 2) pointing to the location where the anomaly comes from, and 3) determining the type of anomaly at this location. The evaluation of the pipeline is performed to detect a set of 16 simulated plant equipment failures that have been obtained from a real-world industrial process that is typically found in oil production fields, called the separator process.KeywordsAnomaly detectionExplainable AIIndustrial process plantsMultivariate time seriesProcess simulation

Anomaly detection in medical data is often of critical importance, from diagnosing and potentially localizing disease processes such as epilepsy to detecting and preventing fatal events such as cardiac arrhythmias. Generative adversarial networks (GANs) have since their inception shown promise in various applications and have been shown to be effective in cybersecurity, data denoising, and data augmentation, and have more recently found a potentially important place in the detection of anomalies in medical time series. This chapter provides a selective review of this novel use of GANs, in the process highlighting the nature of anomalies in time series, special challenges related to medical time series, and some general issues in approaching time series anomaly detection with deep learning. We cover the most frequently applied GAN models and briefly detail the current landscape of applying GANs to anomaly detection in two commonly used medical time series, electrocardiography (ECG) and electroencephalography (EEG).

To minimize the environmental impact of energy enterprises, it is important to promptly identify cases of possible changes in the quality of wastewater generated at power plants, that is, cases of exceeding the maximum permissible concentrations of contamination in wastewater. The goal of the method for detecting complex anomalies in multidimensional time series obtained from smart energy stations’ sensor channels is to improve the accuracy of detecting contamination levels in industrial wastewater. To achieve this goal, the following tasks were addressed: methods for detecting time series anomalies were analyzed, the method for detecting complex anomalies was developed, software implementation of the algorithm was carried out, and experiments were conducted. The developed method is recommended for use in a smart energy monitoring system.

The automated detection of sequential anomalies in time series is an essential task for many applications, such as the monitoring of technical systems, fraud detection in high-frequency trading, or the early detection of disease symptoms. All these applications require the detection to find all sequential anomalies possibly fast on potentially very large time series. In other words, the detection needs to be effective, efficient and scalable w.r.t. the input size. Series2Graph is an effective solution based on graph embeddings that are robust against re-occurring anomalies and can discover sequential anomalies of arbitrary length and works without training data. Yet, Series2Graph is no t scalable due to its single-threaded approach; it cannot, in particular, process arbitrarily large sequences due to the memory constraints of a single machine. In this paper, we propose our distributed anomaly detection system, short DADS, which is an efficient and scalable adaptation of Series2Graph. Based on the actor programming model, DADS distributes the input time sequence, intermediate state and the computation to all processors of a cluster in a way that minimizes communication costs and synchronization barriers. Our evaluation shows that DADS is orders of magnitude faster than S2G, scales almost linearly with the number of processors in the cluster and can process much larger input sequences due to its scale-out property.

The number of devices capable of measurement Power Quality (PQ) parameters is increasing continuously in all voltage levels. Consequently, the amount of available PQ data is also growing very fast. These data contain a lot of valuable information about the behavior of PQ, but up to now it is in the most cases used only to assess compliance with limits (e.g. EN 50160 in Europe). Beside long-term characteristics (trends) and medium-term characteristics (seasonal effects) in particular the analysis of short-term characteristics can provide useful information about deviations from a behavior, which are usually caused by significant changes in the customer or network behavior (e.g. connection of new disturbing equipment). As manual screening of the data is not feasible, automated methods to identify such are required. After a short description of typical variations in PQ datasets the paper classifies different types of anomalies in PQ time series and presents a new method in order to identify them. Finally, the performance of the method is discussed based on examples.

The article considers the problem of detecting anomalies in the time series of media content metrics obtained from Telegram channels. The task of detecting anomalies is relevant in the context of combating disinformation and analyzing the dynamics of content distribution in social networks. Anomalies in metrics, such as the number of views, shares, comments, and reactions, may indicate manipulative actions, including the use of bots, falsification of reach, or the spread of disinformation. A dataset obtained through the official Telegram API was used for the analysis. A feature of the data is the lack of retrospective values of metrics, which complicates the analysis of their dynamics. This problem was partially solved by collecting data at fixed time intervals after the publication of each post. The collected data was grouped by the channels of origin of the posts and time intervals after publication to ensure the accuracy of the analysis. Since the data were unlabeled, manual processing was used to remove outliers and ensure the reliability of the modeling. The article analyzes the functionality of five Python libraries for detecting anomalies in time series: PyOD, TODS, PySAD, Darts, and Prophet. Their compliance with the requirements was assessed, in particular, with respect to working with time series, processing incomplete data, real-time support, seasonality, and computational efficiency. A comparison was made based on tables and graphs that demonstrate the results of using each library. In particular, the PyOD library is a well-known tool for detecting anomalies, but does not support direct work with time series. TODS has the potential to detect anomalies in streaming data, but its development has been discontinued. PySAD specializes in streaming data analysis, but requires a fixed frequency of input data, which limits its application. The Darts library offers a wide set of algorithms for time series analysis, but requires pre-filling of missing values, which creates an additional load on the model. The best results were achieved using the Prophet model, which is able to work with irregular time series without the need for additional data augmentation. The experiments conducted showed that Prophet provides the best balance between forecast accuracy and computational efficiency. The choice of the amount of historical data for modeling is crucial, since excessive data increases processing time, and insufficient data reduces forecast accuracy.The results of the study indicate that none of the considered libraries is a universal solution for all tasks.However, Prophet showed the greatest potential for detecting anomalies in the time series of Telegram metrics, which makes it the best candidate for further development and adaptation in media content monitoring tasks.

Zurlini et al. (2014) formulated interesting thoughts on our recent publication dealing with the assessment of ecosystem stability using remote sensing time series (De Keersmaecker et al., 2014). Their main concerns can be summarized as follows: (i) the normalized spectral entropy (HSn; Zaccarelli et al., 2013) that was used to quantify resilience, should be interpreted as a metric for structural irregularity, rather than regularity and (ii) our focus was on local stability and the ability to return to a stable point or trajectory only (i.e., engineering resilience), whereas stability metrics are commonly used to assess the adaptive capacity to remain within the same stability domain (i.e., ecological resilience) (Pimm, 1984; Holling, 1996; Dakos et al., 2012). First, since we applied HSn to anomaly time series instead of to original Normalized DifferenceVegetation Index (NDVI) time series, the interpretation of the HSn metric also changes from structural irregularity to regularity. For example, when a large disturbance results in vegetation response persistent anomalies, the time series regularity would decrease (i.e., increase in HSn) but also the irregularity of the anomaly time series would decrease (i.e., decrease in HSn). Although we believe that both interpretations of HSn are valid, we based our analysis on the anomaly time series as it avoids the sensitivity of HSn to shape effects. Shape effects can have strong impact on the interpretation of HSn as a regularity metric as is illustrated in Fig. 1. Both time series shown are equally regular, but have different HSn values, which complicates the interpretation of regularity, whereas this is not the case for the anomaly time series with equal HSn values. Second, we agree that De Keersmaecker et al. (2014) focuses on local stability, whereas other stability measures can be important as well (Holling, 1996). However, these other stability measures are difficult to quantify based on metrics that assume stationarity and consequently do not account for multiple stable states [e.g., HSn is based on a Fourier transformation which assumes stationarity (Zaccarelli et al., 2013)]. For example, it is difficult to interpret HSn as an indicator of ecological resilience without knowing when the time series switches from one local stability regime to another. This is illustrated in Fig. 2, which shows two time series with similar HSn values but different stability regimes (i.e. time series A flips between two regimes, whereas time series B has only one regime). Therefore, we believe that detecting tipping points is imperative before assessing other stability measures. The interpretation of the stability metrics described in De Keersmaecker et al. (2014) is therefore only useful within a regime of local stability. Finally, we want to stress that the conclusion of De Keersmaecker et al. (2014) was exactly that understanding the reliability of stability metrics is essential when assessing ecosystem stability. This is especially true because time series properties (e.g., the presence of multiple stable states and the use of original vs. anomaly time series, as demonstrated here) can highly affect the interpretation of these metrics.

ABSTRACTAnomaly detection has applications across different knowledge domains and is intricately linked to numerous problems, such as fault detection for industrial and measurement systems. However, the usual completely unsupervised nature of the problem complicates and restricts the application of various intelligent models. In this context, solutions based on GANs for modelling distributions and arbitrary processes with unsupervised data show potential in anomaly detection. This work addresses a solution based on the TadGAN architecture in the unsupervised detection of anomalies in time series. Initially, a brief review of the state of the art on essential concepts about anomalies in time series is provided, as well as the main works involving GANs in this respective area. Subsequently, the TadGAN architecture is assessed utilising the proposed methodology, wherein its principles and primary limitations are discussed, such as the absence of standardisation in performance evaluation metrics. As an innovation, we assess TadGAN using experimental data and propose new metrics to quantify the anomalous state from both the model and the data. The obtained results confirm the significant potential of GANs in detecting anomalies in time series.

The article deals with the problem of recognition of anomalies in time series with Raleighand tsunami-wave disturbances in signals from hydrostatic pressure sensors (HPS) of ocean bottom seismic stations in the framework of tsunami warning problem. The proposed method of spectral-time analysis (STAN) of signals from the sensors was based on computing the evaluations of functions of frequency-time distribution, decision-making procedures and non-linear filtering for the above problem. The developed STAN method was applied to recognize time intervals with Rayleigh and tsunami-wave disturbances in HPS signals. The proposed STAN method is quite universal and can be used to solve problems of recognition of anomalies in time series of geophysical data of different nature. This is the e-book version of the article, published in the Russian Journal of Earth Sciences (doi:10.2205/2012ES000522). It is generated from the original source file using LaTeX’s epub.cls class.

Time series forecasting has many practical applications in a variety of domains such as commerce, finance, medicine, weather, environment, and transportation. There exist so many methods developed for time series forecasting. However, most of the forecasting methods do not pay attention to anomalies in time series even though time series are sensitive to anomalies. Anomaly patterns cause negative effects on the accuracy of time series forecasting. In this paper, we propose a novel anomaly repair-based approach to improve time series forecasting in the case of anomaly existence. In our approach, an effective time series forecasting framework, EPL_S_X, is proposed with anomaly smoothing as a pre-processing stage and any existing time series prediction algorithm X. In particular, our proposed approach consists of three steps including detecting anomalies, repairing anomalies by using our smoothing method, and forecasting time series using preprocessed time series. Experimental results on several time series datasets reveal that our proposed approach improves remarkably the accuracy of many existing time series forecasting methods. It also outperforms the two robust time series forecasting methods that are based on exponential and Holt-Winters smoothing. With such better prediction performance, our approach is not only more effective but also more useful when dealing with anomalies in time series forecasting.