Detecting Anomalies in Time Series Using Distance-Based Methods

Anomaly detection is the process of identifying signal abnormalities by detecting deviations from normal behavior.

One approach to anomaly detection is using distance-based methods, which base anomaly detection on pattern matching within the time series data. This pattern matching is based on the z-normalized Euclidean distances among subsequences.

Distance-based methods allow you to identify common recurring subsequences (motifs) that typically indicate normal operation and unique subsequences (discords) that indicate possible anomalies. These methods use a query sequence that includes a target motif, or, alternatively, a specific discord. The algorithm computes the distance between query and all time series subsequences that have the same length. If the query contains a motif, a small distance indicates a good match between a subsequence and the query, and likely normal behavior, while a large distance indicates possible anomalous behavior. Alternatively, the query can include a specific discord. A small distance between the subsequence and the query in this case indicates a possible similar anomaly.

Distance-based methods are especially useful because they are relatively simple. The methods require no trained models or labeled data. They can detect anomalous deviations in the data itself for any type of anomalous behavior, whether characterized previously or not. The algorithms for these methods are optimized for fast computation.

Predictive Maintenance Toolbox™ provides the following functions for assessing your data.

• similarityDistance—Computes the distance vector between a query sequence and a time series. This function also finds the most similar and the most different subsequences in the time series with respect to the query.

• distanceProfile—Computes the distance vector between a query subsequence within the target time series and all subsequences within that time series that have the same length

• matrixProfile—Finds the top motifs and discords in the time series for subsequences of a specified length. Two additional functions help you analyze the output of matrixProfile:

  • findDiscord—Identifies discords, indicating possible anomalies

  • findMotif—Identifies motifs, indicating examples of normal behavior

For detailed information on each of these functions, see the corresponding function reference pages.