Detecting Anomalies in Time Series Using Deep Learning Detector Models

Anomaly detection is the process of identifying signal abnormalities by thoroughly characterizing normal behavior and detecting deviations from that behavior.

You can create anomaly-detection algorithms without incorporating knowledge of physics-based dynamics modes or failure modes or signatures. You can train anomaly detectors using only normal data. You therefore need only a relatively small amount of anomalous data, just for testing.

Detectors for Subsequence Anomalies in Time Series

One area of anomaly detection is that of subsequence anomalies, which includes signal transients that extend through a finite continuous sequence within the signal, but which do not result in permanent changes in the signal. Predictive Maintenance Toolbox™ provides a suite of anomaly detection models, each using a different deep learning architecture, that are specialized for subsequence anomaly detection. The models also require Deep Learning Toolbox™.

Once you have trained one of these detectors on normal data, you can use the detector to identify abnormal behavior in other data sets. The detectors operate sequentially on each subsequence, predict or reconstruct the next expected value, and assign an anomaly score that is based on the prediction or reconstruction error. The training process produces a threshold that bounds normal behavior. The detection process flags anomaly scores that exceed the threshold.

This diagram shows a typical sequence of developing a detector model.

Create Detector

Create the detector. You create the detector using a command such as tcnAD, which creates a detector that includes a TCN network and has default settings.

The only required input is the number of channels in the data, but you can also specify other options as part of your command syntax. The number of channels you specify must apply to the training data, the test data, and the operational data that you plan to use once the detector is finalized.

For example, this command creates a three-channel tcnAD detector with default properties.

detector = tcnAD(3)

Train Detector

Train the new detector by using train with an input data set of normal data. train computes anomaly scores for the data set and returns a threshold that bounds the scores of the normal data. You can specify how train computes this threshold. You can also set the threshold manually, which is useful once you have determined a good threshold and want repeatable results.

For example, this command trains detector using normal data and default settings and training options.

detector = train(detector,normaldata)

Test Detector

Test the trained detector by using detect with an input of data set of test data that can contain any combination of normal and anomalous data. detect returns the anomaly scores and identifies scores that exceed the threshold.

For example, this command tests the trained detector using test data and default settings.

detect(detector,testdata)

Assess Detector Performance

Assess the detection performance visually by plotting and evaluating detections and histograms. Use plot to

Plot the detected anomalies as an overlay on top of the original signal and evaluate whether they appear where you expect them.
Pot the anomaly scores by index along with an overlay of the threshold line, and evaluate whether the threshold is effective at separating anomalous behavior from normal behavior.

For example, this command plots both the detected anomaly overlay and the anomaly scores for a set of test data.

plot(detector,testdata)

Use plotHistogram to plot a histogram of the anomaly scores that lets you view the score distribution and the placement of the threshold.

For example, this command plots the histogram of normal data and test data together.

plotHistogram(detector,normaldata,testdata)

You can also command a histogram by specifying the PlotHistogram name-value argument when you call detect. However, in this case, you will see a histogram of only the test anomaly scores and not the anomaly scores for the normal training data.

Improve Detection Results

Based on your assessment, you can decide whether the detector is successful or requires improvement.

If the plots indicate that a different threshold is possible that would be more effective, you can modify the threshold option set using updateDetector. When you use updateDetector, you do not need to retrain the detector.
For example, suppose you want to change the method you use to set the threshold from its default value of "ksigma" to "contaminationFraction", and flag the top 10% of the anomaly scores as anomalous. The following command executes this change.
```
detector = updateDetector(detector,testdata,ThresholdMethod="contaminationFraction",...
ThresholdParameter=0.1)
```
Otherwise, if you want to modify options that are used in training, such as network options, you must create a new detector and use name-value pairs to specify the new options.

For an example of this workflow, see Train and Test TCN Anomaly Detector.