Multi-scale streaming anomalies detection for time series

HAL Id: hal-02568715

https://hal.archives-ouvertes.fr/hal-02568715

Submitted on 10 May 2020

HAL is a multi-disciplinary open access archive for the deposit and dissemination of sci- entific research documents, whether they are pub- lished or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L’archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d’enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Multi-scale streaming anomalies detection for time series

Ravi Kiran

To cite this version:

Ravi Kiran. Multi-scale streaming anomalies detection for time series. CAp 2017, Jun 2017, Grenoble, France. �hal-02568715�

Multi-scale streaming anomalies detection for time series

B Ravi Kiran Université Lille 3, CRIStAL, Lille, France

Streaming anomaly detection

I x (t ) are observations over time t where new data arrives over time t .

I Problem : Window x (t ) , [ t : t − p + 1 ] which “deviates” from normal behavior.

I Motivation : How to become invariant to the window-size/scale of pseudo-periodic structure in x (t ) ?

Streaming multi-scale Lag-matrix construction

X

_t^p

= [ x

_t

, x

_t−1

, . . . , x

_t−p+1

]

^T

∈ R

^p

Streaming PCA

I Dimensionality reduction for time series lag embedding I Recursive update for principal subspace

I Linear Principal Component Analysis criterion : Given X

^p

∈ R

^T×p

, w

_p

is defined as 1-D projection capturing most of the energy of samples :

w

_p

= arg min

kwk=1

P

_T

t=1

k X

_t^p

− (ww

^T

) X

_t^p

k

²

Multiscale streaming PCA

Algorithm 1 Streaming PCA

Initialization: w

_j

← 0, σ

_j²

← ϵ with ϵ 1

for t = 1, . . . , T do for j = 1 , . . . , J do

Z

_t^j

← H

^T

2^j

X

_t^j

y

_t^j

← w

^T_j

Z

_t^j

σ

_j²

← σ

_j²

+ (y

_t^j

)

²

e

^j_t

← Z

_t^j

− y

_t^j

w

_j

w

_j

← w

_j

+ σ

_j⁻²

y

_t^j

e

^j_t

Z H

_t^j

← w

^T_j

Z

_t^j

w

_j

α

_t^j

← k Z H

_t^j

− Z

_t^j

k

²

end for

end for

return ααα ∈ R

^T×J

Given x (t ) ∈ R for t = 1 : T I We evaluate the lag-matrix

X ∈ R

^T×p

where p = 2

^j

.

I For each X

_t

∈ R

^p

we perform a change of basis Z

_t

: = Φ

^T

X

_t

I H refers to a unitary tx. that can . localize a deviation from the

local mean and variations.

. Preserve the variance.

I Haar transform Φ = H : H

_2N

=

^√1₂

"

H

_N

⊗ [ 1 , 1 ] I

_N

⊗ [ 1, − 1 ]

#

Hierarchical (Approximation) PCA

2^j−1 2^j−1 2^j−1 2^j−1 Future

w^T_j−1· w^T_j−1·w^T_j−1· w^T_j−1· w^T_j · w^T_j ·

w^T_j+1·

For scale p

_j+1

= 2p

_j

, a reduced lag matrix Z

_t^j+1

is obtained by projection of each component of size p

_j

on the principal direction obtained at this scale, i.e. Z

_t^j+1

= [ w

^T_j

Z

_t^j

, w

^T_j

Z

^j

t−2^j

]

^T

with Z

_t¹

= X

_t¹

. The principal direc- tion is updated after this step.

Global flow

Input x

_t

X

_t^2j=1

X

_t^2j=2

X

_t^2j=J

Update w

₁

Update w

₂

Update w

_J

α

_t¹

= k X

_t¹

− X f

_t¹

k

α

_t²

= k X

_t²

− X f

_t²

k

α

_t^J

= k X

_t^J

− X H

_t^J

k

Norm k ααα

_t

k

²

2nd iteration k ααα H

_t

− ααα

_t

k

²

Least corr. scale arg min

_j

P

i

( ααα

^T

ααα )

_ji

... ... ... ...

AUC performances across different aggregation methods

Performance Evaluation : Area under the receiver operators characteristics curve (AUC) (FPR vs TPR), 0 (worst) & 1 (perfect).

Effect of 2nd iteration of Streaming PCA

Least correlated scale Vs 2nd iteration of Streaming PCA :

I Least correlated scale and 2nd iteration of streaming PCA decorrelates the reconstruction error across scales.

I The least correlated scale performs better when there is a single scale

structure across time series. Second iteration performs better when there are multiple scales.

Future work

I Understand bounds on reconstruction error ααα (t ) for Streaming PCA.

I Better base-line by comparing with streaming covariance estimation.

I Probabilistic anomaly score using gaussian neg-log score.

I Recursively calculable multi-scale time series representation H

^T

X

_t

to model long range dependencies.

References

I Papadimitriou et al. Optimal multi-scale patterns in time series streams, 2006 ACM SIGMOD

I Bin Yang, Projection approximation subspace tracking. Trans. Sigal Processing, Jan. 1995

I Evaluating real-time anomaly detection algorithms, Numenta benchmark, ICMLA 2015

https://beedotkiran.github.io/anomaly.html beedotkiran@gmail.com