Main Content

TcnDetector

Detect anomalies in time series using TCN network

Since R2025a

Description

The TcnDetector object uses a temporal convolutional network (TCN) architecture to implement a detector model capable of being trained to detect anomalies in time series data using only nominal data.

By comparing reconstructed values with observed data within a detection window, the TCN detector identifies anomalies as significant deviations from expected patterns. You can control the sensitivity of the detector by modifying a set of threshold properties

Creating a TcnDetector object is the first step in a workflow that includes training the TCN model with normal data, testing the model with anomalous data, and validating the model by visualizing detection effectiveness on anomalous data using plotting functions. To improve detection performance, you can change certain properties, such as threshold properties, by updating the trained model without retraining. To change other properties, you must create a new detector object and specify the new properties using name-value arguments. You cannot modify detector properties using dot notation.

This anomaly detector model was inspired by the architecture proposed in the paper in [1].

For more information on the functions this workflow uses, see Object Functions.

Creation

Create a TcnDetector object by using the tcnAD function.

Properties

expand all

Input

Number of input channels in each time series, specified as a positive integer. All time series inputs must have the same number of channels.

This property is read-only after object creation.

Window

Window length of each time series segment, specified as a positive integer scalar.

This property is read-only after object creation.

Stride length of sliding window in detection stage, specified as a positive integer. DetectionStride controls the number of overlapped samples. If you do not specify DetectionStride, the software sets the stride length to the value of detectionWindowLength to create non-overlapping windows.

This property is read-only after object creation.

Threshold

Method to compute the detection threshold, specified as one of these values, each of which correspond to what the detection threshold is based on:

  • "kSigma" — Standard deviation of the normalized anomaly scores. The parameter k determines the threshold within the standard deviation levels that identifies an anomaly. The value of k is specified by ThresholdParameter.

  • "contaminationFraction" — Percentage of anomalies within a specified fraction of windows, measured over the entire training set. The fraction value is specified by ThresholdParameter.

  • "max" — Maximum window loss measured over the entire training data set and multiplied by ThresholdParameter

  • "mean" — Mean window loss measured over the entire training data set and multiplied by ThresholdParameter

  • "median" — Median window loss measured over the entire training data set and multiplied by ThresholdParameter

  • "manual" — Manual detection threshold value based on Threshold.

  • "customFunction" — Custom detection threshold method based on ThresholdFunction.

If you specify ThresholdMethod, you can also specify ThresholdParameter, Threshold, or ThresholdParameter. The available threshold parameter depends on the specified detection method.

This property can be set only during object creation and, after training, by using updateDetector.

Anomaly score used to detect anomalies, specified as a positive scalar. The source of the Threshold value depends on the setting of ThresholdMethod.

  • If ThresholdMethod is "manual", you set the value.

  • If ThresholdMethod is "customFunction", the function specified in ThresholdFunction computes the value.

  • For other values of ThresholdMethod, use ThresholdParameter to specify the detection threshold.

This property can be set only during object creation and, after training, by using updateDetector.

Parameter used for determining the detection threshold, specified as a numeric scalar.

The way you specify ThresholdParameter depends on the specified value for ThresholdMethod. The following list describes the specification of ThresholdParameter for each possible value of ThresholdMethod

  • "kSigma" — Specify ThresholdParameter as a positive numeric scalar. If you do not specify ThresholdParameter, the detector sets the threshold to 3.

  • "contaminationFraction"— Specify ThresholdParameter as a as a nonnegative scalar less than 0.5. For example, if you specify "contaminationFraction" as 0.05, then the threshold is set to identify the top 5% of the anomaly scores as anomalous. If you do not specify ThresholdParameter, the detector sets the threshold to 0.01.

  • "max", "mean", or "median" — Specify ThresholdParameter as a positive numeric scalar. If you do not specify ThresholdParameter, the detector sets the threshold to 1.

  • "customFunction" or "manual"ThresholdParameter does not apply.

This property can be set only during object creation and, after training, by using updateDetector.

Function to compute custom detection threshold, specified as a function handle. This argument applies only when ThresholdMethod is specified as "customFunction".

  • The function must have two inputs

    • The first input is a vector of scalar window anomaly scores.

    • The second input is a vector representing all point-level anomalies.

    For example, suppose that the value of detectionWindowLength is 10, the value of detectionStrides is set to be nonoverlapping, and the time series length is 10001. Then the first input vector has a length of 1000 and the second input vector has a length of 10000.

  • The function must return a positive scalar corresponding to the detection threshold.

This property can be set only during object creation and, after training, by using updateDetector.

Model

Filter size of each convolutional layer, specified as a positive integer or a vector of five positive integers.

  • If you specify FilterSize as a scalar, the size of each filter is the same in all layers.

  • If you specify FilterSize as a vector, the size of the filters in the ith layer is equal to the value of the ith vector element.

This property is read-only after object creation.

Number of filters in each convolutional layer, specified as a positive integer.

This property is read-only after object creation.

Dropout probability used to avoid overfitting, specified as a nonnegative numeric scalar less than 1. All convolution layers share the same dropout probability.

This property is read-only after object creation.

Normalization

Normalization technique for training and testing, specified as "zscore", "range", or "off".

Read-Only Properties

This property is read-only.

Training status, represented as 0 (false) or 1 (true). Once you train the detector, IsTrained is equal to 1.

This property is read-only.

Deep network layer structure, represented as a deep network layer structure.

This property is read-only.

Deep network, represented as a TCN-based deep network.

Object Functions

trainTrain anomaly detector and obtain detection threshold
detectDetect anomalies in time series using trained detector model
plotPlot detected anomalies and anomaly scores in time series
plotHistogramPlot histogram of anomaly scores and detection threshold
updateDetectorUpdate settings of a trained anomaly detector and recompute detection threshold

References

[1] He, Yangdong, and Jiabao Zhao. “Temporal Convolutional Networks for Anomaly Detection in Time Series.” Journal of Physics: Conference Series, vol. 1213, no. 4, June 2019, p. 042050. DOI.org (Crossref), https://doi.org/10.1088/1742-6596/1213/4/042050.

Version History

Introduced in R2025a