Introduction
Three kinds of anomaly in time series
-
Point anomaly [23]: point anomaly refers to a point which is different from other points. Point anomaly is also called outlier.
-
Pattern anomaly [24]: pattern anomaly refers to a significant difference between a segment pattern and other segment patterns.
-
Sequence anomaly [25]: sequence anomaly refers to the non-compliance of a subsequence to other subsequences.
Pattern anomaly detection in time series
Pattern anomaly detection based on raw time series
Pattern anomaly detection methods based on different feature representations
Domain transform
Singular value decomposition (SVD) [49, 50]
Symbolic discretization [51‐53]
Piecewise linear representation [58, 59]
-
Segment error e: the adjustment of segment error is based on two indicators. First, the maximum error of an individual segment should be greater than a predetermined threshold. Second, the sum of the maximum errors of all segments should not exceed a predetermined threshold.
-
Number of segments k: an optimal value of k should be determined by integrating demands such as compression ratio, computation speed, and searching precision.
-
Extremum points [64]: for a segment \(\left\{ x_{i-1}, x_i, x_{i+1} \right\} \) of a time series \(X = \left\{ x_1, x_2, \ldots , x_n \right\} \), if \((x_{i-1} \leqslant x_i \mid x_{i+1} \leqslant x_i)\) is true, namely the observations are monotonically increasing or decreasing at extremum \(x_i\), the raw time series can be approximately represented by the set of these extremum points. However, the representation based on extremum points suffers from unfiltered and trivial information. Noise cannot be effectively eliminated.
-
Local extremum points [65]: as the above extremum points approach is unable to eliminate noise, local extremum points are introduced to handle details related to noise. For each segment, certain negligible intermediate observations between the maximum and the minimum are filtered. However, to achieve an effective approximate representation of a raw time series, the number, range, and characteristics of negligible observations should be prudently selected.
-
Important points [66]: important points are the most influential ones which demonstrate the variation trend of a time series. Traditionally, the selection of important points is conducted by measuring the amplitude variation between observation \(x_i\) and its predecessor \(x_{i-1}\). If the amplitude variation is greater than a predetermined threshold, observation \(x_i\) is identified as an important point. In specific, if \(( |(x_i-x_{i-1})/x_{i-1}| \geqslant R_1 \mid |(x_i-x_{i-1})| \geqslant R_2)\) is true, where \(R_1\) and \(R_2\) are application-related values, \(x_i\) is identified as an important point. However, identification rate for certain pivot points is low.
Edge-cloud collaboration anomaly detection architecture
Edge-cloud collaboration architecture
Task migration
Multi-dimensional feature representation
Sliding window
Trend | Description |
---|---|
Figure 3(1) | \(d_a = d_m < d_b\) |
Figure 3(2) | \( d_a< d_m< d_b \ \& \& \ k_{am} - k_{mb} < 0\) |
Figure 3(3) | \(d_a < d_m = d_b\) |
Figure 3(4) | \( d_a< d_m < d_b \ \& \& \ k_{am} - k_{mb} > 0\) |
Figure 3(5) | \(d_a = d_m > d_b\) |
Figure 3(6) | \( d_a> d_m > d_b \ \& \& \ \left| k_{am} \right| - \left| k_{mb} \right| < 0\) |
Figure 3(7) | \(d_a > d_m = d_b\) |
Figure 3(8) | \( d_a> d_m> d_b \ \& \& \ \left| k_{am} \right| - \left| k_{mb} \right| > 0\) |
Figure 3(9) | \(d_a > d_m < d_b\) |
Figure 3(10) | \(d_a < d_m > d_b\) |
Trend | Condition |
---|---|
Figure 3(1) | \(\left| v_m - v_b \right|> \epsilon \mid \mid t_m - t_a + 1 > l\) |
Figure 3(2) | \( v_m - v_a < \epsilon \ \& \& \ \left| v_m - v_b \right| > \epsilon \) |
Figure 3(3) | \(v_m - v_a> \epsilon \mid \mid t_b - t_m + 1 > l\) |
Figure 3(4) | \( v_m - v_a > \epsilon \ \& \& \ \left| v_m - v_b \right| < \epsilon \) |
Figure 3(5) | \(v_m - v_b> \epsilon \mid \mid t_m - t_a + 1 > l\) |
Figure 3(6) | \( \left| v_m - v_a \right| < \epsilon \ \& \& \ v_m - v_b > \epsilon \) |
Figure 3(7) | \(\left| v_m - v_a \right|> \epsilon \mid \mid t_b - t_m + 1 > l\) |
Figure 3(8) | \( \left| v_m - v_a \right| > \epsilon \ \& \& \ v_m - v_b < \epsilon \) |
Figure 3(9) | \( \left| v_m - v_a \right| > \epsilon \ \& \& \ \left| v_m - v_b \right| < \epsilon \) |
Figure 3(10) | \( v_m - v_a > \epsilon \ \& \& \ v_m - v_b < \epsilon \) |
Mean value
Kurtosis
Oscillation
Variation coefficient
Trend coefficient
Pattern anomaly detection based on kernel density estimation
Experiments and analysis
-
\(E \left| X(t) \right| ^2 < \infty \), for all \(t \in \mathbb {Z}\),
-
\(EX(t) = m \), for all \(t \in \mathbb {Z}\),
-
and \(\gamma _x(r,x)=\gamma _x(r+t,s+t)\), for all \(t \in \mathbb {Z}\),
Data sets
Synthetic data set
Real-world data sets
Data set | Cloud-based (s) | Edge-based (s) | Edge-cloud collaboration (s) |
---|---|---|---|
Y | 0.32 | 0.29 | 0.27 |
R1 | 0.35 | 0.34 | 0.31 |
R2 | 0.34 | 0.32 | 0.29 |
R3 | 0.39 | 0.36 | 0.30 |
R4 | 0.48 | 0.52 | 0.39 |
R5 | 0.43 | 0.41 | 0.37 |
R6 | 0.53 | 0.48 | 0.42 |
R7 | 0.61 | 0.56 | 0.44 |