An Unsupervised Anomaly Detection Algorithm for Time Series Big Data

Abstract

Many time series anomaly detection algorithms are hard to be applied in real scenarios for two reasons. Firstly some of them are supervised since training data is required to define the normal behavior, but it is expensive to annotate the normal part for large volume data. Secondly, many algorithms are parameter-laden, which are hard to be generalized to different dataset. This paper is motivated to overcome these disadvantages. It is believed that a normal behavior is a subsequence which is similar to some subsequences in a time series while an anomaly is a subsequence which is distinct from the others. In order to improve the efficiency of searching anomaly, we first select candidate anomalies rather than check all subsequences. We roughly distinguish the candidate anomalies from normal subsequences by transforming each subsequence into a string. If a string corresponds to only one subsequence, then it is a candidate anomaly. And the subsequences of the same string represent a kind of normal behavior. Secondly, similarity threshold is calculated according to the similarity between normal behaviors. If the similarity between a candidate anomaly and its nearest neighbor is lower than the threshold, then this candidate is determined to be anomalous. We conduct extensive experiments on benchmark datasets from diverse domains and compare our method with the state-of-the-art method. The empirical results show that our method can reach high detection rate in an unsupervised and parameter-lite manner.