Time Series Anomaly Detection

# Time Series Anomaly Detection

## Introduction & Motivation

Time Series Anomaly Detection: identify unusual patterns in sequences. Unsupervised learning; autoencoder approaches. Applications: network monitoring, system health, fraud detection.

Motivation: Detect system failures before they occur.

Applications: Network monitoring, predictive maintenance, fraud detection.

---

## Core Concepts & Theory

### Statistical Baselines

Moving average, Gaussian models.

### Autoencoder Reconstruction

Learn normal patterns.

### LSTM-VAE

Temporal variational models.

### Isolation Forest

Anomaly-specific learning.

---

## Mathematical Formulation

Reconstruction Error:
$$L = \|x - \hat{x}\|^2$$

Anomaly Score:
$$ ext{score}(x_t) = ext{distance}(x_t, ext{normal patterns})$$

Isolation Forest:
$$ ext{anomaly}(x) = ext{path length}(x) / \log(N)$$

---

## Advanced Theory & Extensions

### LSTM Encoder-Decoder

Temporal sequence modeling.

### GRU-Based Detection

Gated recurrent variants.

### Attention-Based Detection

Focus on anomalous time steps.

---

## Computational Considerations

Reconstruction: O(sequence_length·latent_dim).

Scoring: O(N·features).

Anomaly threshold: O(data·statistics).

---

## Practical Implementation Strategies

### Sliding Windows

Temporal context capture.

### Normalization

Z-score standardization.

### Threshold Selection

ROC curve analysis.

---

## Benchmark Datasets & Evaluation

NASA TSC: Time series classification.

Yahoo Datasets: System metrics.

UNSW-NB15: Network anomalies.

---

## Key Challenges & Limitations

### Anomaly Definition

Context-dependent normal/anomaly.

### Class Imbalance

Rare anomalies in data.

### Concept Drift

Changing patterns over time.

---

## Hyperparameter Tuning

Window size: 50-500 steps.

Latent dimension: 16-128.

Anomaly threshold: 0.5-2.0 std.

---

## Real-World Applications & Case Studies

Network Monitoring: DDoS attack detection.

Predictive Maintenance: Equipment failure prediction.

Fraud Detection: Credit card transaction anomalies.

---

## Integration with Other Methods

Anomaly detection + alerting for automated responses; + clustering for pattern discovery.

---

## Summary & Key Takeaways

Time Series Anomaly Detection via autoencoders enables automatic abnormality identification.

Principles:
1. Reconstruction learning: Normal pattern capture.
2. Error thresholding: Anomaly identification.
3. Temporal modeling: Sequence dependencies.
4. Unsupervised learning: No label requirements.
5. Real-time processing: Streaming detection.

---

---

## Appendix: Practical Labs

### Lab 1: Reconstruction Error

import numpy as np

def compute_reconstruction_error(original, reconstructed):
 """Compute reconstruction error"""
 error = np.mean((original - reconstructed) ** 2, axis=1)
 return error

# Test
np.random.seed(42)
orig = np.random.rand(100, 20)
recon = orig + np.random.randn(100, 20) * 0.1

error = compute_reconstruction_error(orig, recon)

assert len(error) == 100, "Correct error length"
print("✓ Reconstruction error working")

if __name__ == "__main__":
 print("Lab 1: ReconstructionError - PASSED")

### Lab 2: Anomaly Scoring

import numpy as np

def score_anomalies(time_series, window_size=10):
 """Score anomalies using sliding window stats"""
 scores = []
 
 for i in range(window_size, len(time_series)):
 window = time_series[i-window_size:i]
 current = time_series[i]
 
 mean = np.mean(window)
 std = np.std(window)
 
 # Z-score
 z_score = np.abs((current - mean) / (std + 1e-8))
 scores.append(z_score)
 
 return np.array(scores)

# Test
np.random.seed(42)
ts = np.random.randn(100)

scores = score_anomalies(ts)

assert len(scores) == 90, "Correct score length"
print("✓ Anomaly scoring working")

if __name__ == "__main__":
 print("Lab 2: AnomalyScoring - PASSED")

### Lab 3: Threshold Selection

import numpy as np

def select_anomaly_threshold(scores, percentile=95):
 """Select anomaly threshold from score distribution"""
 threshold = np.percentile(scores, percentile)
 return threshold

# Test
np.random.seed(42)
scores = np.random.rand(1000)

threshold = select_anomaly_threshold(scores, percentile=95)

assert 0 <= threshold <= 1, "Valid threshold"
print("✓ Threshold selection working")

if __name__ == "__main__":
 print("Lab 3: ThresholdSelection - PASSED")

### Lab 4: Autoencoder Loss

import numpy as np

def autoencoder_anomaly_loss(x, x_reconstructed, lambda_reg=0.001):
 """Loss for anomaly detection via autoencoder"""
 # Reconstruction loss
 recon_loss = np.mean((x - x_reconstructed) ** 2)
 
 # Regularization (simplified)
 reg_loss = lambda_reg * np.mean(x_reconstructed ** 2)
 
 total_loss = recon_loss + reg_loss
 return total_loss

# Test
np.random.seed(42)
x = np.random.rand(32, 50)
x_recon = x + np.random.randn(32, 50) * 0.05

loss = autoencoder_anomaly_loss(x, x_recon)

assert np.isfinite(loss), "Loss finite"
print("✓ Autoencoder loss working")

if __name__ == "__main__":
 print("Lab 4: AutoencoderLoss - PASSED")