Source-linked AI summary
A review on outlier/anomaly detection in time series data
Ane Blázquez-García, Angel Conde, Usue Mori, Jose A. Lozano
TL;DR
Time-series outlier detection is important, but the field has diverse terminology and methods. This review organizes unsupervised techniques into a taxonomy based on their defining characteristics and finds that most analyzed works treat outliers as useful events of interest rather than unwanted data to clean. It also identifies dissimilarity measures as a direction for further study.
Problem
Time-series outlier detection is important, but terminology remains unsettled and few surveys focus exclusively on temporal data or provide a taxonomy for classifying its techniques.
Method
The review presents a structured state-of-the-art of unsupervised time-series outlier detection techniques and organizes them through a taxonomy based on their main characteristics.
Results
Most analyzed works treat outliers as events of interest and extract their information rather than clean unwanted data to improve data quality.
Takeaways & Limitations
The review provides an organized overview of techniques and identifies dissimilarity measures as an area for future investigation.
Takeaways & Limitations
The review notes that different dissimilarity measures may influence outlier detection and should be examined in future work.
Abstract
from arXiv · showhide
Recent advances in technology have brought major breakthroughs in data collection, enabling a large amount of data to be gathered over time and thus generating time series. Mining this data has become an important task for researchers and practitioners in the past few years, including the detection of outliers or anomalies that may represent errors or events of interest. This review aims to provide a structured and comprehensive state-of-the-art on outlier detection techniques in the context of time series. To this end, a taxonomy is presented based on the main aspects that characterize an outlier detection technique.
1 INTRODUCTION
Outlier detection in time series has become an important data-mining task, but terminology and methods remain diverse. This review addresses the gap with a structured, comprehensive state-of-the-art focused on unsupervised detection and organized through a taxonomy.
- Outlier detection examines anomalous behavior across time and supports applications including fraud detection, cybersecurity intrusion detection, and industrial fault diagnosis.
- Despite many related terms and proposed methods, there is still no consensus on the terminology used for outliers.The literature uses terms including anomalies, discordant observations, discords, exceptions, aberrations, surprises, peculiarities, and contaminants.
- The meaning of an outlier depends on the analyst’s aim: it may be unwanted data to correct or an event of interest to detect and analyze.Sensor transmission errors may be eliminated to improve prediction accuracy, whereas fraud detection treats the outlier itself as the object of analysis.
- The review focuses on unsupervised identification of outliers in time series, regardless of the terminology used in the original papers.
- The review provides a taxonomy to classify techniques by their main characteristics, helping readers choose methods suited to their problems.It also reports publicly available software for some of the considered methods.
2 A TAXONOMY OF OUTLIER DETECTION TECHNIQUES IN THE TIME SERIES CONTEXT
The proposed taxonomy organizes time-series outlier detection techniques by input data type, outlier type, and method nature. These axes distinguish what data methods accept, what anomalies they target, and whether variables are analyzed jointly.
- The taxonomy has three axes: input data type, outlier type, and the nature of the detection method.It is intended to encompass the main aspects on which time-series outlier detection techniques vary.
- Input data: The input-data axis distinguishes univariate time series from multivariate time series.A univariate series contains ordered real-valued observations, whereas a multivariate series contains k-dimensional vectors recorded at each time.
- Outlier type: The outlier-type axis distinguishes point outliers, subsequence outliers, and entire outlier time series.Point outliers concern unusual observations, subsequence outliers concern unusual joint behavior across consecutive points, and entire time series can be outliers only in multivariate input.
- Input data: The taxonomy’s applicability is constrained by the input type: multivariate point or subsequence outliers require multivariate input, and outlier time series require multivariate time series.
- Outlier type: Point outliers may be global or local, depending on whether detection uses the whole series or only a neighborhood.Global outliers are also local, but some local outliers may appear normal when the entire series is considered.
- Nature of the method: The method-nature axis distinguishes univariate methods from multivariate methods that simultaneously use more than one time-dependent variable.A multivariate input can still be analyzed with a univariate method if variables are processed separately without modeling their dependencies.
3 POINT OUTLIERS
Point outlier detection is organized around how methods treat temporal order and streaming data, then divided into univariate and multivariate settings and model-based strategies. The review compares estimation and prediction approaches by the data used to obtain expected values and highlights their adaptation capabilities.
- Point outlier detection is the most common outlier detection task in time series.
- The review’s taxonomy is based on the main aspects that characterize an outlier detection technique.The presentation covers techniques for point outliers in univariate and multivariate time series, with methods organized using the taxonomy diagrams.
- Treatment of temporality: Methods differ in whether they use temporal order, ignore it, or use time windows that preserve local ordering.Methods ignoring temporal information produce the same results after shuffling the series, whereas window-based methods are invariant only to shuffling within windows.
- Streaming capability: Streaming methods decide whether a new datum is anomalous on arrival, using either a fixed model or a model updated by retraining or incremental learning.The review classifies a technique as non-streaming when it cannot decide at the arrival of the new datum.
- Streaming capability: Most analyzed point outlier techniques can be applied in streaming contexts and account for temporality through ordered sequences or time windows.However, very few techniques adapt incrementally to stream evolution.
- Model-based methods: Model-based methods compare observed values with expected values and a threshold, using estimation or prediction models.Estimation may use past, current, and future observations, while prediction obtains the expected value from past data only; prediction methods can therefore detect anomalies as new data arrive.
- Univariate techniques: Univariate techniques include constant or segmented statistics, fitted distributions, smoothing and slope models, residual analysis, density-based methods, and iterative hypothesis testing.Examples use the median, MAD, B-splines, kernels, EWMA, Gaussian Mixture Models, slope constraints, STL decomposition, and the ESD test.
4 SUBSEQUENCE OUTLIERS
Subsequence outliers are consecutive points that jointly behave unusually, making detection more challenging than point-outlier detection. The review organizes methods by their assumptions about subsequence length, representation, periodicity, streaming, and detection principle.
- Subsequence outliers are sets of consecutive points that jointly behave unusually rather than isolated anomalous points.
- Subsequence characteristics: Methods may use fixed-length subsequences, requiring a predefined length, or variable-length subsequences discovered across different lengths.Fixed-length methods commonly extract subsequences with sliding windows.
- Subsequence characteristics: Shorter subsequence lengths produce more candidate subsequences to analyze, increasing the number of comparisons.
- Representations: Because comparing subsequences is costly, many methods transform them using discretization, SAX, bitmaps, dictionaries, exemplars, or connectivity values.
- Temporal characteristics: Periodic subsequence outliers repeat over time and are relevant to applications such as detecting recurring anomalous transactions in fraud detection.
- Detection methods: Discord methods identify unusually dissimilar subsequences, whereas prediction- and other model-based methods use normality criteria or thresholds to classify outliers.Discord discovery often requires a user-specified length and may identify only the most unusual subsequence without deciding whether it is truly an outlier.
- Detection methods: Methods based on clustering, frequency, and information theory may perform better when time series contain periodic or repetitive patterns.
5 OUTLIER TIME SERIES
Outlier time series detection targets entire unusual variables within multivariate time series. Reviewed methods use dimensionality reduction, raw-data dissimilarity, clustering, shapelets, or related representations while generally preserving temporality.
- Outlier time series are entire unusual variables that can be detected only in multivariate time series.
- Dimensionality reduction: Dimensionality-reduction methods extract statistical features, apply PCA, and detect series deviating from dense regions or clusters in PCA space.Examples use features such as the mean and first-order autocorrelation.
- Dissimilarity-based methods: Raw-data dissimilarity methods compare whole time series directly, commonly using clustering with a multivariate series as the normality reference.
- Dissimilarity-based methods: Specialized clustering methods address temporal misalignment using phase adjustment or Dynamic Time Warping, with low-weight series treated as outliers.
- Dissimilarity-based methods: Shapelet methods learn representative subsequences of normal variables and identify variables whose subsequences are dissimilar to those shapelets.
- Summary: The reviewed techniques aim to find events of interest, use specified series lengths, and directly use raw data while considering temporality.Benkabou et al. [2018] is identified as the only reviewed approach handling variables of different lengths.
6 PUBLICLY AVAILABLE SOFTWARE
The review catalogs publicly available software for the described time-series outlier-detection techniques and organizes it by the outlier type each technique detects.
- Table 9 records technical descriptions and code links for publicly available time-series outlier-detection software.
- OTSAD in R is the only listed package that includes multiple methods, and it detects point outliers in univariate time series.
7 CONCLUDING REMARKS AND FUTURE WORK
The review organizes time-series outlier detection methods through a taxonomy and identifies shared principles, coverage patterns, limitations, and directions for future research.
- The proposed taxonomy categorizes outlier detection methods by input data type, outlier type, and the nature of the detection technique.
- Most analyzed works treat outliers as events of interest, whereas methods targeting unwanted data often iteratively remove or replace observations to improve data quality.
- Across reviewed methods, an outlier is generally a point, subsequence, or whole time series that significantly differs from its expected value.Methods differ in how they estimate the expected value and measure dissimilarity from the observation.
- General conclusions: Threshold selection can substantially affect results, and few techniques provide automatic threshold determination; dynamic and adaptive thresholds remain a future direction.The review notes that this gap applies to both univariate and multivariate time series, including subsequence and entire-series analysis.
- General conclusions: Most methods assume regularly sampled data, while irregularly sampled time series remain an open research direction.Converting irregularly sampled data to regular sampling is not always the best option.
- Outlier types: Point outlier detection is the most researched problem, while subsequence and whole-series detection receive less attention and lack methods for periodic multivariate subsequence outliers.The review also identifies unaddressed propagation of an outlier across variables over later time steps.