Anomaly Scoring for Prediction-Based Anomaly Detection in Time Series

Prediction-based anomaly detection methods for time series have been studied for decades and demonstrated to be useful in many applications. However, many predictors cannot accurately predict values around abrupt changes in time series, which may result in false detections or missed detections. In this paper, the problem is addressed using an anomaly scoring method for prediction-based anomaly detection. A Long Short-Term Memory (LSTM) network is used for prediction, and a dynamic thresholding method is used for anomaly extraction from prediction error sequences. The pattern of falsely-detected anomalies, or false positive sequences (FPS), in training data is learned by a clustering algorithm. A score is assigned to each detected anomaly in test data according to its distance to the nearest FPS pattern learned from training data. The effectiveness of this method is demonstrated by testing it on a variety of public time series datasets.