Method for Anomaly Detection in Time Series Data Based on Spectral Partitioning

摘要

Anomalies in real time series are detected by first determining a similarity matrix of pairwise similarities between pairs of normal time series data. A spectral clustering procedure is applied to the similarity matrix to partition variables representing dimensions of the time series data into mutually exclusive groups. A model of normal behavior is estimated for each group. Then, for the real time series data, an anomaly score is determined, using the model for each group, and the anomaly score is compared to a predetermined threshold to signal the anomaly.

主权项

1. A method for detecting an anomaly in real time series, comprising the steps of:
determining a similarity matrix of nonnegative pairwise similarities between pairs of normal time series data; applying a spectral clustering procedure to the similarity matrix to partition variables representing dimensions of the time series data into groups, wherein the groups are mutually exclusive; estimating a model of normal behavior for each group; determining, for the real time series data, an anomaly score using the model of normal behavior for each group; and comparing the anomaly score to a predetermined threshold to signal the anomaly, wherein the steps are performed in a processor.