deepantAD

Create anomaly detector model that uses CNN network to detect anomalies

Since R2025a

Syntax

detector = deepantAD(numChannels)

detector = deepantAD(numChannels,Name=Value)

Description

detector = deepantAD(numChannels) creates a DeepantDetector model with numChannels channels for each time series input to the detector.

detector = deepantAD(numChannels,Name=Value) sets additional options using one or more name-value arguments.

For example, detector = deepantAD(3,DetectionWindowLength=20) creates a detector model for data containing three input channels and with a detection window length of 20.

Input Arguments

Input

numChannels — Number of input channels

positive integer

Number of input channels in each time series, specified as a positive integer. All time series inputs must have the same number of channels.

Name-Value Arguments

Specify optional pairs of arguments as Name1=Value1,...,NameN=ValueN, where Name is the argument name and Value is the corresponding value. Name-value arguments must appear after other arguments, but the order of the pairs does not matter.

Example: detector = deepantAD(3,DetectionWindowLength=20) sets the length of the detection window to 20.

Window

ObservationWindowLength — Length of observation window

35 (default) | positive integer scalar

Training window length of each time series segment, specified as a positive integer scalar.

TrainingStride — Training stride length

1 (default) | positive integer | ...

Training stride length of sliding window in training stage, specified as a positive integer. TrainingStride controls the number of overlapped samples. If you do not specify TrainingStride, the software sets the stride length to the value of 1 to create non-overlapping windows.

DetectionWindowLength — Length of detection window

1 (default) | positive integer scalar

Window length of each time series segment, specified as a positive integer scalar.

DetectionStride — Stride length

positive integer

Detection stride length of sliding window in detection stage, specified as a positive integer. DetectionStride controls the number of overlapped samples. If you do not specify DetectionStride, the software sets the stride length to the value of 1 to create non-overlapping windows.

Threshold

ThresholdMethod — Method to compute detection threshold

"kSigma" (default) | "contaminationFraction" | "max" | "mean" | "median" | "manual" | "customFunction

Method to compute the detection threshold, specified as one of these values, each of which correspond to what the detection threshold is based on:

• "kSigma" — Standard deviation of the normalized anomaly scores. The parameter k determines the threshold within the standard deviation levels that identifies an anomaly. The value of k is specified by ThresholdParameter.

• "contaminationFraction" — Percentage of anomalies within a specified fraction of windows, measured over the entire training set. The fraction value is specified by ThresholdParameter.

• "max" — Maximum window loss measured over the entire training data set and multiplied by ThresholdParameter

• "mean" — Mean window loss measured over the entire training data set and multiplied by ThresholdParameter

• "median" — Median window loss measured over the entire training data set and multiplied by ThresholdParameter

• "manual" — Manual detection threshold value based on Threshold.

• "customFunction" — Custom detection threshold method based on ThresholdFunction.

If you specify ThresholdMethod, you can also specify ThresholdParameter, Threshold, or ThresholdParameter. The available threshold parameter depends on the specified detection method.

Threshold — Anomaly score used to detect anomalies

1 (default) | positive scalar

Anomaly score used to detect anomalies, specified as a positive scalar. The source of the Threshold value depends on the setting of ThresholdMethod.

• If ThresholdMethod is "manual", you set the value.

• If ThresholdMethod is "customFunction", the function specified in ThresholdFunction computes the value.

• For other values of ThresholdMethod, use ThresholdParameter to specify the detection threshold.

ThresholdParameter — Parameter used for determining threshold

numeric scalar

Parameter used for determining the detection threshold, specified as a numeric scalar.

The way you specify ThresholdParameter depends on the specified value for ThresholdMethod. The following list describes the specification of ThresholdParameter for each possible value of ThresholdMethod

• "kSigma" — Specify ThresholdParameter as a positive numeric scalar. If you do not specify ThresholdParameter, the detector sets the threshold to 3.

• "contaminationFraction"— Specify ThresholdParameter as a as a nonnegative scalar less than 0.5. For example, if you specify "contaminationFraction" as 0.05, then the threshold is set to identify the top 5% of the anomaly scores as anomalous. If you do not specify ThresholdParameter, the detector sets the threshold to 0.01.

• "max", "mean", or "median" — Specify ThresholdParameter as a positive numeric scalar. If you do not specify ThresholdParameter, the detector sets the threshold to 1.

• "customFunction" or "manual" — ThresholdParameter does not apply.

ThresholdFunction — Function to compute detection threshold

function handle

Function to compute custom detection threshold, specified as a function handle. This argument applies only when ThresholdMethod is specified as "customFunction".

• The function must have two inputs

  • The first input is a vector of scalar window anomaly scores.

  • The second input is a vector representing all point-level anomalies.

  For example, suppose that the value of detectionWindowLength is 10, the value of detectionStrides is set to be nonoverlapping, and the time series length is 10001. Then the first input vector has a length of 1000 and the second input vector has a length of 10000.

• The function must return a positive scalar corresponding to the detection threshold.

Model

FilterSize — Filter size

[2 3] (default) | positive integer | two-element vector

Filter size of each convolutional layer, specified as a positive integer or a vector of two positive integers.

• If you specify FilterSize as a scalar, the size of each filter is the same in both layers.

• If you specify FilterSize as a vector, the size of the filters in the ith layer is equal to the value of the ith vector element.

NumFilters — Number of filters

35 (default) | positive integer

Number of filters in each convolutional layer, specified as a positive integer.

DropoutProbability — Dropout Probability

0.25 (default) | nonnegative numeric scalar less than 1

Dropout probability used to avoid overfitting, specified as a nonnegative numeric scalar less than 1. All convolution layers share the same dropout probability.

Normalization

Normalization — Normalization technique

"zscore" (default) | "range" | "off"

Normalization technique for training and testing, specified as "zscore", "range", or "off".

Output Arguments

detector — Anomaly detector model

DeepantDetector object

Anomaly detector model, returned as a DeepantDetector object.

References

[1] Munir, Mohsin, et al. “DeepAnT: A Deep Learning Approach for Unsupervised Anomaly Detection in Time Series.” IEEE Access, vol. 7, 2019, pp. 1991–2005. DOI.org (Crossref), https://doi.org/10.1109/ACCESS.2018.2886457.

Version History

Introduced in R2025a