Source-linked AI summary
Clustering-based Anomaly Detection in Multivariate Time Series Data
Jinbo Li, Hesam Izakian, Witold Pedrycz, Iqbal Jamal
TL;DR
Multivariate time-series anomaly detection must account for temporal and variable relationships, but many existing techniques focus on univariate data. The paper combines sliding-window subsequences, extended fuzzy clustering, reconstruction, and Particle Swarm Optimization to detect amplitude and shape anomalies. Experiments on synthetic and real-world datasets suggest that the methods detect multivariate anomalies, while the authors note limits related to high dimensionality and computational overhead.
Problem
Anomaly detection in multivariate time series is challenging because anomaly scores must consider temporal and variable relationships simultaneously.
Method
The framework creates sliding-window subsequences, applies extended Fuzzy C-Means clustering, reconstructs them, and uses reconstruction error with Particle Swarm Optimization for anomaly scoring.
Results
The proposed methods detect amplitude, shape, and relation-based anomalies in synthetic and real-world multivariate time series.
Takeaways & Limitations
The framework is suitable for identifying anomalous amplitude and shape patterns in multivariate time series across health care, weather, finance, and disease-outbreak applications.
Takeaways & Limitations
High-dimensional structure recovery is not guaranteed, and learning weighted distances creates substantial computational overhead.
Abstract
from arXiv · showhide
Multivariate time series data come as a collection of time series describing different aspects of a certain temporal phenomenon. Anomaly detection in this type of data constitutes a challenging problem yet with numerous applications in science and engineering because anomaly scores come from the simultaneous consideration of the temporal and variable relationships. In this paper, we propose a clustering-based approach to detect anomalies concerning the amplitude and the shape of multivariate time series. First, we use a sliding window to generate a set of multivariate subsequences and thereafter apply an extended fuzzy clustering to reveal a structure present within the generated multivariate subsequences. Finally, a reconstruction criterion is employed to reconstruct the multivariate subsequences with the optimal cluster centers and the partition matrix. We construct a confidence index to quantify a level of anomaly detected in the series and apply Particle Swarm Optimization as an optimization vehicle for the problem of anomaly detection. Experimental studies completed on several synthetic and six real-world datasets suggest that the proposed methods can detect the anomalies in multivariate time series. With the help of available clusters revealed by the extended fuzzy clustering, the proposed framework can detect anomalies in the multivariate time series and is suitable for identifying anomalous amplitude and shape patterns in various application domains such as health care, weather data analysis, finance, and disease outbreak detection.
1. Introduction
Multivariate time-series anomaly detection is challenging because anomalous segments must be identified while considering multiple variables and temporal relationships. The paper proposes a clustering-based approach for detecting amplitude and shape anomalies.
- Existing anomaly-detection techniques primarily address univariate time series, motivating a multivariate approach.
- Multivariate detection must account for temporal relationships and relationships among variables simultaneously.
- The proposed approach uses available clusters to detect anomalous amplitude and shape patterns in multivariate time series.
2. Literature review
The literature includes similarity-, clustering-, classification-, modeling-, and dimensionality-reduction approaches to multivariate time-series anomaly detection. Their effectiveness depends on choices such as similarity measures, training data, dimensionality reduction, and the structure captured by clustering.
- Similarity-based methods: Similarity-based methods flag subsequences that differ substantially from others, but performance depends strongly on the selected similarity measure.
- Similarity-based methods: Existing discord-based methods detect only the top k discords and provide limited guidance for choosing k.
- Clustering-based methods: Clustering-based methods generate subsequences, assign them to clusters, and score anomalies using subsequence fitness to those clusters.
- Classification-based methods: Classification-based methods train on normal instances before labeling test instances as normal or abnormal.
- Dimensionality-reduction methods: Dimensionality reduction can speed computation, but information loss may reduce multivariate anomaly-detection accuracy.
- Modeling-based methods: Clustering-based performance depends heavily on the time-series structure captured by the clustering method.
3. The proposed approach
The proposed framework detects amplitude and shape anomalies by clustering sliding-window multivariate subsequences, reconstructing them, and scoring reconstruction discrepancies. Extended fuzzy clustering weights variables, while autocorrelation features address time shifts in shape detection.
- Sliding-window subsequences: A fixed-length sliding window divides a long multivariate time series into shorter subsequences for subsequent analysis.The window advances by a step r, and each window contents forms one multivariate subsequence.
- Extended fuzzy clustering: Extended Fuzzy C-Means clusters the multivariate subsequences while assigning different weights to variables to control their clustering impact.The method iteratively computes the partition matrix and cluster prototypes; the fuzzification coefficient m satisfies m > 1.
- Reconstruction and optimization: A reconstruction criterion rebuilds subsequences from cluster centers and membership values, and its reconstruction error evaluates cluster quality.Lower reconstruction error indicates higher-quality granulation and degranulation, and PSO minimizes this error to optimize the variable weights.
- Anomaly scoring: The anomaly score for each multivariate subsequence is the squared Euclidean distance between the subsequence and its reconstructed version.Optimal cluster centers and the partition matrix provide the reconstruction used for scoring.
- Amplitude and shape anomalies: Amplitude detection uses Euclidean distances in the original time-series space, whereas shape detection uses autocorrelation coefficients to reduce time-shift effects.The shape-detection pipeline therefore includes an additional autocorrelation representation before anomaly detection.
- Parameter selection: A confidence index compares anomalous-subsequence scores with average scores to select parameters that better separate abnormal and normal regions.Higher confidence values indicate larger score differences between abnormal and normal subsequences.
4. Experimental Studies
Experiments on synthetic and real-world multivariate time series evaluate anomaly detection for amplitude, shape, and cross-variable relational anomalies. The proposed extended-FCM framework detects these patterns and generally outperforms standard FCM and compared methods.
- The evaluation covers synthetic and real-world multivariate time series, including ECG, climate, exchange-rate, EEG eye-state, and air-quality data.
- Synthetic datasets: The method detects anomalies caused by relationships between time series when individual univariate series contain no anomalies.The experiment constructs two variables in which signal 2 and signal 6 occurring together create two multivariate anomalies.
- Synthetic datasets: Extended FCM reveals multivariate data structure using variable-specific impacts and offers more accurate detection than standard FCM in the illustrated amplitude-anomaly comparison.
- Comparisons: Compared with a distance-based 1-NN method, the proposed clustering technique detects anomalous parts that the distance-based method misses when similar anomalies occur.The comparison uses a two-dimensional multivariate time series containing two inserted anomalies.
- Comparisons: Across several real-world datasets, the proposed methods show better performance than existing methods in the reported comparisons.The paper attributes this result to extended fuzzy clustering revealing data structure through optimal weights.
5. Conclusions
The proposed clustering-based methods detect amplitude and shape anomalies in multivariate time series by reconstructing subsequences with structure learned through extended Fuzzy C-Means. Experiments on synthetic and real-world datasets support their effectiveness, while limitations include optimization reliability in high dimensions and substantial computational overhead.
- Extended Fuzzy C-Means captures multivariate time-series structure by balancing the effects of different components during clustering.The method assigns different weights to variables to control their impact on clustering.
- Reconstruction error serves as the Particle Swarm Optimization fitness function and quantifies the anomaly level of each subsequence.The framework reconstructs multivariate subsequences using the structure revealed by clustering.
- Experiments on synthetic and real-world datasets demonstrate effectiveness in detecting amplitude and shape anomalies in multivariate time series.The proposed methods were compared with several techniques reported in the literature.
- The methods can help analyze large amounts of unlabeled high-dimensional time-series data without requiring normal or abnormal labels.
- High-dimensional structure recovery is not guaranteed because Particle Swarm Optimization may reach local optima and Fuzzy C-Means has drawbacks.
- Weighted Euclidean distance introduces substantial computational overhead because learning the weights is time-consuming.