Detection and Analysis of Anomalies in People Density and Mobility Through Wireless Smartphone Tracking

One of the challenges of this century is to use the data that a smart-city provides to make life easier for its inhabitants. Specifically, within the area of urban mobility, the possibility of detecting anomalies in the movement of pedestrians and vehicles is an issue of vital importance for the planning and administration of a city. The aim of this paper is to propose a methodology to detect the movement of people from the information transmitted by their smart mobile devices, analyze these data, and be able to detect or recognize anomalies in their behavior. In order to validate this methodology, different experiments have been carried out based on real data aiming to extract knowledge, as well as obtaining a characterisation of the anomalies detected. The use of this methodology might help the city policy makers to better manage their mobility and transport resources.


I. INTRODUCTION
Measuring groups of people in urban zones is a widely studied topic due to its application in a considerable number of fields, such as urban planning, marketing and safety [1], among others. In addition, crowd control at specific events, such as concerts or demonstrations, can improve urban safety. Detecting this type of flows is not a trivial task, as it requires a measurement in open, wide and variable spaces. Moreover, certain events may not be planned beforehand, such as traffic accidents, changes in weather, or spontaneous mass meeting. Detecting these kinds of anomalies allows city policy makers to acquire a more adequate understanding of urban planning decisions.
Usual technologies used for people monitoring are expensive because they usually require high installation and main-The associate editor coordinating the review of this manuscript and approving it for publication was Lei Guo . tenance costs. These costs are only reasonable in the case of large cities with higher budgets, or only limited to be spent in critical surveillance zones. However, using wireless signal monitoring and tracking systems has been proven to be a low-cost solution to obtain information about the mobility of people [2].
One of these systems, called Mobywit [3], has been used in the past to track data in the movement of people in urban scenarios. The system gathers information from the gadgets carried by people, usually smart devices (such as smartphones), by capturing the wireless communications send out inadvertently by them.
However, this huge amount of data that can be gathered by that system, and similar ones, has not been properly analysed in order to extract knowledge. Considering the data obtained by a system such as the one described, a complete methodology to allow the detection and study of anomalies in the density and movements of people in the streets is proposed here. VOLUME 8, 2020 This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/ This methodology is based on four separate steps: crowd flow data acquisition, validation of the data source studying known mobility anomalies and their influence on the data, precise model refinement to detect unknown events, and finally, information and knowledge extraction about the anomalies detected. In this paper, the proposed methodology has been applied to a real dataset, obtained after monitoring several points of the city of Granada (Spain) during two years.
Results show the methodology proposed has the potential to detect and analyze anomalies in the density and movement of pedestrians on the streets. The data source, tracked wireless communications of smart devices, is affected by the known anomalies, and can also be explored to detect unknown anomalies. These anomalies can be analyzed to extract patterns in its occurrence, that allows to prevent or anticipate new mobility anomalies in the future. This can be valuable for smart cities, because this information can facilitate the efficient management of resources and infrastructure.
The rest of the paper is structured as follows. Section II presents some concepts and current trends in the monitoring of people and the detection of mobility anomalies. Section III proposes the methodology followed to detect and study mobility anomalies. Section IV details the experiments carried out in order to demonstrate how the data obtained is affected for known anomalies and how they have been detected. Finally, Section V comments the conclusions reached and outlines future lines of work.

II. BACKGROUND: ANOMALY DETECTION IN PEOPLE MOBILITY
This section presents some concepts and current trends in the detection of anomalies in people mobility or displacement. First, a description of the most conventional technologies used in order to monitor people is presented, focusing on their limitations to be used in crowd detection inside cities.
Next, relevant works about the use of wireless signal tracking of devices to study the movement of people are commented. Finally, an introduction to the detection of anomalies in time series is presented.

A. TRACKING PEOPLE MOBILITY
During the last years, measuring groups of people in urban settings is a widely studied topic [4] and it has become increasingly important in the emerging Smart Cities [5], as it can be applied in a large number of fields, such as urban planning, marketing and safety. An evident example is to facilitate urban planning decisions, such as where to locate pedestrian or commercial areas.
Nowadays, current methodologies applied to this scope are limited to very specific areas and require high installation and maintenance costs [6]. For instance, infrared beams [7] and pressure plates [8] are widely used to estimate people walking in a limited bounded place, such as a gate or a turnstile gate, but they cannot be applied to a spacious place like a street. In the other hand, more advanced systems, such as thermal counters [9], [10] and video cameras [11], [12] have problems dealing with crowds and obstacles caused by partially hidden elements. Finally, in the case of measuring specific events, such as demonstrations, the usual way is the manual counting of persons from aerial photography [13]. Moreover, there have been attempts to automatize the process [14], but they have not been successful enough. Furthermore, other approaches have focused on social networks, using information in tweets sent from a particular place [15] or with a certain hashtag as a measurement of the number of people in the event. Nevertheless, this method may not be as exhaustive as others, as it may carry several additional problems, mainly because not everybody uses social networks or data can be corrupted by malicious users.

B. TRACKING PEOPLE USING DEVICES' WIRELESS COMMUNICATIONS
Initially, the idea of tracking people using their smart devices has been exploited as more and more people wield them every day [16]. Thus, a wide amount of researchers has paid attention in this area in recent years [17]- [19].
For instance, Wei Xi [20] and Gabe Fierro [21] demonstrated how tracking people with their personal WiFi devices may be used to count people inside a building without requiring additional infrastructure and with considerable accuracy.
In fact, using wireless signal monitoring and tracking systems has been proven as an economical solution to address some of the aforementioned shortcomings [2]. This approach is based on the analysis of the information provided by the wireless signals emitted by electronic devices to obtain reliable and valuable data. Those devices are smartphones or wearables that are carried daily by citizens or the vehicles themselves [22]- [24].
Hence, in our previous research, the low-cost monitoring system, called Mobywit, has been used to effectively measure traffic density and flow in highways, streets or buildings [3]. Moreover, it has currently been used as a proof-of-concept to crowd analysis, where the system was used for monitoring a demonstration, being able to register a reliable approximated amount of protesters and their behavior [25].

C. ANOMALY DETECTION
An anomaly in a dataset is a pattern that does not conform to a well-defined notion of typical behavior [26]. Focusing on spatial data, like time series, a time series can be influenced by seasonal factors (e.g. months, weeks, days, hours, etc.) [27] repeating cyclical patterns. Thus, time series with seasonal factors are considered seasonal time series, and consist of various components witch can be extracted using the seasonaltrend decomposition algoritm (STL) [28]: seasonal, trend and remainder, being the remainder the component that cannot be explained by the others because they are unsystematic and exhibit unclear patterns [29].
In this case, anomaly detection is related to the remainder component of a seasonal time series, because it is the component that yields the pattern. One of the earliest anomaly detection methods implied modeling the time series as a stationary auto-regressive process [30]. A stationary model for a time series is one whose statistical properties (such as mean, variance, auto-correlation, etc) are all constant over time. So, if an observation falls outside the model, it is considered to befall an anomaly. In order to create a stationary model many regression-based techniques have been applied in the past, such as robust regression [31], auto-regressive models [30], ARMA models [32] or ARIMA models [33].
However, those techniques are not applicable in the context of the movement of people because of its inherent seasonal and trend components [29]. In a seasonal time series an anomaly can be global or local. Global anomalies usually extend above or below expected seasonality and therefore they are not subject to seasonality and the underlying trend. Local anomalies, instead, occur in seasonal patterns.
The problem of anomaly detection in seasonal time series has been widely studied in social networks, such as Twitter, because the amount of messages about a topic along the time is a seasonal time series. This fact encouraged Twitter to develop their own algorithm to detect anomalies in seasonal time series. This algorithm called Seasonal Hybrid ESD (Seasonal Hybrid Extreme Studentized Deviate) [34] was built upon the Generalized ESD test [35] for detecting anomalies. S-H-ESD can be used to detect global and local anomalies and for a tremendously long time series the algorithm employs piecewise approximation. This is because the trend extraction in the presence of anomalies is non-trivial for anomaly detection [36].

Algorithm 1 S-H-ESD Algorithm [34]
Input X A time series n Number of observations in X k Max anomalies Output X A An anomaly vector wherein each element is a tuple (timestamp, observer value) Require k ≤ (n × 0.49) 1) Extract seasonal component S X using STL Variant 2) Compute Median Absolute Desviation (MAD)X 3) Compute Residual R X = X − S X −X 4) Detect anomalies vector X A using ESD algorithm In the scope of this paper, some other methods have been used to detect anomalies in urban environments. For example, in [37] GPS data from a fleet of 15,000 taxis were used to detect anomalies in traffic, using Shewart and EWMA control chart methods. Other anomaly detection techniques have been applied from heterogeneous data obtained from a website where citizens describe problems they found in the city [38]. However, our methodology is the first to be applied to time series obtained from citizens' movement data obtained by tracking the wireless signals of their mobile phones. Unlike the previous methods, our methodology allows to detect anomalies in real time, and can be applied to both people and vehicles, as well as to be limited to specific spaces or even inside buildings.

III. METHODOLOGY
The methodology presented in this paper is based on four steps, and makes use of the data gathered by the acquisition of wireless communications, emitted inadvertently by the smart devices carried by people. Thus, the methodology allows to detect of mobility anomalies in people density and speed, as well as to analyze and prevent them. These four steps are: • Step 1: Initially, crowd flow data are acquired using a monitoring method, in our case, using the Mobywit system.
• Step 2: Next, it is analyzed how that data reflects known mobility anomalies. This implies that the number of devices detected, when it is known that an anomalous event is occurring, is significantly different from the number of devices normally detected.
• Step 3: If this type of irregularities is found, then the gathered data can be used to detect anomalies that have not been identified from a previously unknown event.
For this purpose, the S-H-ESD algorithm, described in Figure II-C, is used. This algorithm detects the times when the values measured by the system are abnormal, i.e. a significantly unusual value is found. The algorithm must be adapted according to the type of anomalies to be studied: anomalies in 5-minute windows are not the same as in 1-day windows.
• Step 4: Once the dates and hours with anomalous values have been determined, the common patterns of these dates can be considered to extract the common characteristics. This will allow identifying which moments of VOLUME 8, 2020 the future, with similar characteristics, will be more at risk of presenting anomalous behaviors. Finally, to validate the methodology, it has been applied in an urban scenario monitored by the Mobywit system, in which some demonstrations have occurred in different dates. These protests may give information about how an arising crowd caused by a previously known event impacts in the data gathered by the system. Applying the proposed methodology, it is desired to determine periodic factors that suffer anomalous impacts on the system, e.g. many more (or less) people down the street than usual.
These steps of the methodology are explained in detail in the following sections and subsections of this manuscript.

IV. EXPERIMENTAL VALIDATION OF THE METHODOLOGY
In this section, the steps of our methodology will be applied. First, the method used to gather the data will be explained. Then, it will be studied if the data are susceptible to mobility anomalies (step 2), and therefore to detect them using algorithmic methods (step 3). Finally, the last step will help us to understand the characteristics of the anomalies that can be detected knowing specific events, and how this knowledge can be used to detect anomalies in unknown events and how to facilitate its prevention.

A. STEP 1: DATA ACQUISITION
The first step of the methodology is to acquire data using a tracking system.

1) TRACKING PEOPLE USING WiFi SIGNALS
In this paper, the data acquisition has been performed using the Mobywit system. The nodes ( Figure 2) are placed along several streets, more specifically within the traffic lights, as Figure 3 shows. These nodes are provided with WiFi antennae that are able to operate in monitor mode. In this mode, all the traffic sent or received from any wireless network or device can be monitored without having to be associated with an access point or an Ad-Hoc network. A detailed description of the Mobywit system can be found in [3].
Every WiFi compliant device emits messages using network packages, which are composed of frames that are physically broadcasted and which can be received by the node's antennae. The device that sends those frames is uniquely identified by a physical address or MAC Address. This address is used to identify network interfaces for most of IEEE 802 network technologies, are assigned by the manufacturer of the network interface controller (NIC), and are stored in its hardware, such as the NIC's read-only memory or some other firmware mechanisms. This implies that the MAC Address of the smart devices cannot be changed, so a particular device shows always the same address (which is also unique).
The smart devices are constantly searching for open or known WiFi networks, sending frames called beacons. These frames are captured by Mobywit nodes, taking note of the MAC Address of the device that sends the frame and the timestamp of the detection. Note that this process complies with legal and ethical issues, since the frame is not protected implementing any type of encryption and the frame does not contain personal information, as the MAC Address of a device cannot be linked to a person (unlike a car plate or a phone number). That means, it is impossible to figure out the owner or the carrier of the device that emitted the frame. However, as an additional security step, the MAC addresses are transformed using a one-way hash function, before being stored.
As long as the smart devices periodically send these frames, Mobywit nodes detect the same device several times. Using the first and last detection, the node is able to know the time that the device has been near to the node. In this paper, we differentiate between the moment where a device appeared (step of a device for a node, or simply step) with respect to the number of devices that were being detected in a specific moment (simultaneous detections).
Particular steps are useful, but they acquire more relevance when they are grouped by time, in order to determine, for example, how many devices have moved through the street in the last hour, and to perform this operation for all the hours of a day, a week or all the time, in order to compose a time series. The time used for grouping is called time window, window size or just window. This measure is the most employed in mobility studies, since most of the sensors provide the number of steps by unit time, given that usually only a timestamp is attached to each step. Grouping the steps implies some considerations as Figure 4 shows, being the Grouping steps in an interval of time. Let A,B,C and D devices detected by one node. Each device's step has two times associated: tinitial and tfinal. In this example, the grouping consider intervals of one hour. For the interval of the 11 : 00 : 00, the device step A is not counted because, the tinitial is previous to 11 : 00 : 00. Steps of devices B and C are counted, as their tinitial is over 11 : 00 : 00, being the tfinal irrelevant for the grouping. D step is not counted in the interval 11 : 00 : 00, because its tinitial is sooner. most important that each step can be only added to a sole group (or interval).
This causes that making the window smaller (for example half an hour, a quarter of an hour, or just a few minutes) for an identical time implies the creation of more groups, with a smaller number of steps inside. If the window decrease enough, most of the groups have few values or would be even empty, as Figure 5 shows. In any case, in order to obtain an adequate precision, a narrow window should be considered.
One of the strengths of tracking wireless devices and specifically of Mobywit system, is that the step contains two timestamps, the first and last detection of the device. With both timestamps, the system is able to determine for a certain moment, how many devices were around the node. As previously mentioned, in this paper this is defined as simultaneous detections in a moment of time or the simultaneous. The main difference with respect to a device detected as step is that one simultaneous device detection can be in more than one correlative interval. In a similar way to the steps, the simultaneous can be grouped to obtain a time series as shown in Figure 6.
Grouping (the steps and the simultaneous detections) attach a label to the counting with the timestamp that defines the minor time of the interval. The next label is determined as the previous label plus the window size. For example, if the window is set to one hour, the group 12−05−2017 14 : 00 : 00 contains the steps or the simultaneous detections between 14 : 00 : 00 and the next label 15 : 00 : 00. If the windows are set to 5 minutes, the next label would be 14 : 05 : 00 instead.  In addition, a scenario with several Mobywit nodes working together also allows to measure the time required to go from a place to another, or to track the movement of the people.
It must be noted that tracking smart devices communications may not be considered to be the same thing as tracking persons. But several authors [3], [17]- [21] have shown that the variations in the number of devices can be extrapolated to the number of people, so tracking the number of devices is almost identical to tracking people. Even if it is not an exhaustive method.

2) DATA DESCRIPTION
The collaboration of the Mobility Area of the Local Council of Granada City allowed us to place several Mobywit nodes along the city center. The data considered in this paper were obtained by three nodes placed near the public bullring, a space that concentrates a lot of people because it is used for cultural events such as concerts and exhibitions.
In addition, it is very close to a big avenue that leads to the city center. This avenue is traditionally chosen as starting point of demonstrations, as Figure 7 shows. 1 The three nodes have gathered steps of devices for about two years. The information gathered is sampled by time window following the section IV-A guidelines. Table 1 shows the size of the three time series using different windows for sampling. These window sizes have been chosen from 60 minutes to 1 minute, using the most usual values in urban traffic-related studies, namely: 60, 30, 15, 5 and 1 minutes.
During the processing data step, two problems have been surpassed. The first, the dataset size, because it includes a lot of months of data, and it is very big. Second, the difficulty of having the data related to anomalies and lost them because  This section matches the second step of the methodology proposed earlier. In this experiment, the differences between regular days and days with known anomalies are studied.
As a source of anomalies, 4 days with known protests have been selected. A protest gathers more people in the streets proclaiming a complaint or their support for a specific cause. The success of a protest is typically measured wielding the number of people that follow along with it, so a successful protest should steer many more people on the street than usual. The estimation from the local police of the influx of people in each protest is presented in Table 2.
These protests and a concentration took place in the area near to the Mobywit nodes. All the events were held on Sunday, from 12:00 onward (usual day and hour for demonstrations). These four days have been compared with four regular Sundays during the same time period in the same month.
The existence of an anomalous increment of the number of devices, and therefore of people, in the previous moments and during the protests, may indicate that Mobywit system can be useful in the detection of anomalies in the number of people in the streets. If these known anomalies have an impact on data gathered by the system, it is assumable that other anomalies will impact too. The following subsections describe different comparisons used to discern the characteristics of the anomalies, both in terms of time and number of people.

1) NUMBER OF DEVICES/PEOPLE BY HOUR
Mobywit is able to count the number of devices (people) that have passed through a particular site, close to the node, in a time period as it has been shown in Section IV-A. Figure 8 presents the number of devices tracked by hour for each one of the 8 studied Sundays.
On regular days, a similar number of devices have been detected in the three nodes, with no significant difference, according to the TWO-WAY ANOVA test with respect to the number of devices detected by the hour of the day, as Figure 9 shows. Before performing these tests, it has been proven that the number of people by hour conforms to a normal distribution. At point A, the closest to the protest locations, there are significant differences between regular days and protest days P2 and P3. Put differently, the other days are clearly related (according to the p-value), being P2 and P3 less related to the regular days. At point B, regular days are related to each other, in the same way protest days are related to each other. However, there is not a correlation between regular and protest days, according to the p-values, as expected. At point C, all the days do not show statistically significant differences, because this point is the farthest one to the protest location, so it is not strongly influenced by the mobility anomalies due to these events.
That means the anomalies considered produce an evident impact on the number of smart devices in the street (as compared to usual days), with a clear increase in the amount of people in the areas near to the nodes. Moreover, the distance to the protest is also very relevant. This first effect will be better analyzed in the following subsection.

2) INCREMENT OF THE AMOUNT OF PEOPLE IN THE STREETS
As the system is not exhaustive, in the sense that people who do not carry smart devices are not tracked, the most precise way to present information about the number of devices detected is to show the increment of devices in comparison to those in regular days. This will also allow identifying the crucial hours of the protests, and obtaining an approximate measure of the number of additional people with respect to a regular day. Figure 10 shows the increment of detected devices in the protest days. Looking at protest days 2 and 3, there is an increase of around 10 times in the number of detected devices per hour near to the protest location. In other hours, there   is not a considerable variation in the number of devices detected.
Taking into account the protest day 1, the increment is lower than the other protest days, around four or five times more devices. In the concentration day, there is not a discernible increment, this may be because concentrations have less call power than a demonstration.
Considering the aforementioned, we can conclude that this information can be useful to measure the impact of a demonstration in the city peoples' flows, considering the difference on the amount of people as opposed to regular days.

3) MINUTE BY MINUTE ANALYSIS OF THE CROWD
Since the system identifies each device within a period of time, it is possible to reconstruct the protest, knowing in every moment how many devices (people) are there in the area near to the node. Figure 11 shows the number of devices tracked at a second level by the system during the protest time.
Analysing that information it is straightforward to infer the approximate number of devices that in a particular moment were in the place. Hence, the system is capable to know how many and what devices were being detected at any given time, acquiring the number of the detected devices and allowing to replicate, somehow, the protest situation. This information can be practical both in real time (during the protest), and after, to allow an analysis of the behavior of the protesters. This can help city administrators or even demonstration organizers to get an idea of its impact. Figure 12 shows the devices detected at Point B on Protest Day 2 during two different hours. At 10:00 the demonstration had not started yet, so the number of devices in the area are usual. But at 12:00, start time of the protest, the number of devices in the area has increased up to VOLUME 8, 2020  . Number of devices detected by hour in each node. In the y-axis, the time of the day from 9am to 15pm. In the x-axis, the number of devices detected, ordered by apparition of the device. The width of the coloured line for each device represents the amount of time that each device has been detected in that point. ten times. Signal intensity can also be used as a possible metric of closeness to the node: it can be seen that most devices passed close to the node, as it was adjacent to the road.

4) ANALYSIS OF CROWDS BASED IN DISPLACEMENT TIME
Given the information of the devices that have passed by the point B and later by A, and the time associated with these events, the system is able to calculate the time required to do this displacement. In this regard, Figure 13 shows that the time needed to make the same displacement is higher during the protest days.
This shows that not only the number of people in the street can be studied by the system, but other characteristics, such  as the speed of the pedestrians, can also be used to detect anomalies.

C. STEP 3: DETECTING ANOMALIES IN THE NUMBER OF PEOPLE ON THE STREETS
The previous section has demonstrated how the data obtained from the system described in Section IV-A is affected by known anomalies. As the data source (number of devices detected) is susceptible to present anomalies, the following step in the methodology is to implement a method capable of detecting other anomalies. To this end, the S-H-ESD algorithm presented in Section II has been applied. This method requires that the time series are seasonal and stationary, which are firstly studied in the following sections.

1) TIME SERIES STUDIES: SEASONALITY AND STATIONARITY
The time series used in this work, are generated grouping the steps and the simultaneous detections by different window  sizes for the sampling, in the three points considered. First requirement to apply S-H-ESD is the time series must be stationary, so in order to prove this, Augmented Dickey-Fuller Test (ADF) [27], Kwiatkowski-Phillips-Schmidt-Shin Test (KPSS) [40], [41] and Phillips-Perron Test (PP) [27], [42] have been carried out. All the series, with all the windows sizes, get a p-value lower than 0.01 in all the tests in the three points so the series can be considered as stationary.
Additionally, the S-H-ESD method is designed to deal with seasonal series. Figures 21 y 22 from the Appendix show the seasonal decomposition of the time series with other cycles for the seasonal period. This decomposition evidences how the time series can be expressed as the combination of three components: seasonal, trend and remainder. The remainder component is where anomalies tend to occur.

2) DETECTION OF ANOMALIES
Once it has been demonstrated that the time series are seasonal and stationary, the S-H-ESD algorithm can be applied to detect anomalies in the data that have not been recognized so far. A limit on the maximum number of anomalies is set to the 5% of the size of the series. This is a limitation of the algorithm itself, if more than 5% of the values are detected as anomalous this implies that some of the previously described restrictions are not being satisfied. The level of statistical significance to accept or reject possible anomalies is set to 0.05, as it is typically considered in the literature.
The algorithm has been applied to the series of the three location points with the information about the grouping of devices in steps and simultaneous detections.  Critical days with anomalies selected by their level to each point, type and window size. The use of wide windows, such as 60 and 30 minutes, shows differences between the steps and the simultaneous detections. These differences are less appreciable in 15 minutes window size, where the days are almost the same for both series. Finally, with narrower window sizes, such as 5 and 1 minutes, differences appear again between the step and the simultaneous detections series.
Different window sizes for the sampling of the grouping have been studied: 60, 30, 15, 5 and 1 minute.
The output of the algorithm returns a list of intervals of time with anomalies detected. For each interval, the algorithm shows the expected value and the real value.

3) INFLUENCE OF WINDOW SIZES
From the data gathered of each point (A, B and C) several values for the grouping of the steps and the simultaneous have VOLUME 8, 2020 been studied for the detection of anomalies. Table 3 shows the percentage of intervals (over the size of the time series) that the method has considered as anomalous.
Given a node and for the steps and the simultaneous detected devices (to a greater or lesser extent), making smaller the size of the window of grouping implies that a bigger percentage of the data will be considered anomalous for the same period of time. This can be checked in Figure 14 where absolute values (instead of percentages) are employed. On the contrary, the use of a window size too wide has the problem that short duration anomalies can be diluted in the wide interval.
Windows size must be set smartly, because a window size too narrow or precise can make that too many anomalies are detected. For example, a group of friends walking together can be considered an anomaly if people are normally detected separated in an area. Therefore, it becomes necessary to decide whether an anomaly is relevant or not. Figure 15 show how anomalies are diluted in wide windows and how anomalies arise in narrow windows.

4) SELECTION OF CRITICAL ANOMALIES
As the number of mobility anomalies grows when the windows employed to group becomes narrower, it is required to provide a criterion to be able to determine the most critical anomalies detected. For example, it is more relevant an anomaly where 200 devices have been detected when only 50 were expected, than detecting only 60 devices. In this paper, the level of an anomaly is defined as the ratio between the real and the expected values. In the previous example, the first anomaly would obtain a level of 4 and the second anomaly a level of 1.2, so the first anomaly can be considered more relevant.
This criterion may have problems dealing with anomalies where the magnitude is on a different scale. For example, anomalies where one device is expected, but five devices are detected, with respect to anomalies as the ones considered in the previous example: 200 devices have been detected when only 50 were expected. This usually occurs in the time series grouping steps with small window sizes, because as Figure 5 shows, in steps series the number of devices is distributed between the intervals. That is, the more intervals used, the fewer devices detected in each interval. However, one of the strengths of S-H-ESD algorithm is that this type of scenarios is usually not considered as anomalies. Even so, this selection criterion is more recommended for those series obtained grouping the simultaneous detections than those obtained grouping the steps. This can be noticed in Figure 16 where the days with high-level anomalies have been chosen to each point, type and window size.
The series obtained using steps are less consistent with the election of these days. Thus, if we consider very large samples, the anomalies can be diluted. For example, if 500 people in a company leave work an hour earlier than usual, it will be detected as an anomaly if we use one-hour windows, but it will not be detected if we use one-day windows. Using steps and simultaneous detections also imply differences: if we do a very fine sampling, for example, second by second, FIGURE 19. Weekdays, Hours and minutes of the anomalies detected by the system at three points and with differences windows sizes. This study shows how most of the anomalies follow a pattern in their date and time of occurrence at each point.
the possible anomalies using steps would be diluted (because a device by definition can only belong to one step/sample) even if the device has been in the surroundings of the node for a longer time. In the measurement of simultaneous detections this does not happen, because by definition, a device can belong to more than one sampling interval. It should be taken into account that a simultaneous detection does not indicate that the device has passed through the zone, but that at that time the device was being detected by the monitoring node. This is why simultaneous detection sampling is better to deal with very small sampling windows. Figures 23 and 24 in the Appendix show the differences between the days chosen to each different window size at the point A using steps and simultaneous detections respectively.
As it can be seen, narrow windows sizes obtain 'punctual' anomalies. These can be explained with large groups of people walking together. Most of the days chosen in the series grouping by 1 minute are days of summer, when large groups of tourists usually explore the city following a guide very closely. This will be considered in Section IV-D.

5) ANOMALIES IN THE SPEED
As discussed in Section IV-B, the mobility anomalies can also be obtained from the travel time between one point to another. The S-H-ESD algorithm can also be employed to detect the anomalies using the average time of displacement VOLUME 8, 2020 between points A and B. Figure 17 plots the time series and the anomalies detected.
A relevant observation about the anomalies is that the direction of the path affects the number of anomalies detected. The path from A to B has more than five times more anomalies than the in reverse path. This can be explained by the fact that the street is one-way from A to B, which also points to the city centre, where the government and leisure  buildings are located and therefore more people are going in that direction.

D. STEP 4: EXTRACTING INFORMATION ABOUT THE ANOMALIES DETECTED
The final step of the proposed methodology implies extracting knowledge from the mobility anomalies previously detected. This information can be very valuable to explain the circumstances of the anomalies and to examine the impact of the window size.

1) KNOWLEDGE EXTRACTED FROM DENSITY-BASED ANOMALIES
In Section IV-C pieces of evidence were presented regarding how the usage of narrow window sizes allowed to detect more critical anomalies in the summer months for the steps and the simultaneous detections time series. This can be better noticed in Figure 18, which plots the number of anomalies detected per month in three extreme windows sizes.
The same analysis can be done considering weekdays, hours or even minutes, as Figure 19 shows.
For example, it is remarkable how the majority of the anomalies detected at point A happen on Friday mornings.
At point B, however, the anomalies arise on Mondays at noon. At Point C, there is not a pattern at the hour level, but the anomalies are focused on Mondays and Thursdays.
The knowledge of this information can be very useful for the planning of events, as well as for setting alternative urban policies and ordinances in the affected areas. In addition, it can help to understand which days have more affluence of people, and maybe require more intense vigilance, or could be more recommended for marketing purposes, for instance.

2) KNOWLEDGE EXTRACTED FROM SPEED-BASED ANOMALIES
As with the anomalies in the density of devices, the anomalies detected in the time of displacement between points A and B, can be analyzed in order to obtain information about their followed pattern. Figure 20 shows a sample of the information that can be obtained.
The mobility anomalies in the displacements between A and B are located on Friday mornings in both directions. The number of anomalies detected in the direction from A to B is almost four times more frequent than in the reverse direction.

V. CONCLUSION
In this paper, a methodology to detect and analyze anomalies in the density and movement of people has been proposed. This methodology is divided into four steps, which have been explained and studied throughout this work.
First, the process of the acquisition of data about the movement of people, exploding the wireless communications of their smart devices (as smartphones) has been described, using two ways to obtain this data: grouping by steps and grouping by simultaneous detected devices. To achieve this, the Mobywit System has been used. Data was gathered during a period of almost two years in the city of Granada (Spain).
Then, the influence of known mobility anomalies (such as demonstrations) in the data obtained has been studied, showing statistical evidences about the impact of these anomalies in the data. Therefore it can be concluded that the anomalies in the people density and movement affect the data obtained by the Mobywit system.
With that evidence, the algorithm S-H-ESD is proposed to detect new unknown anomalies in the data. Several factors have been explored, such as the seasonality and stationarity of the data obtained, required for a satisfactory performance of the algorithm. In addition, the influence of the window size of the intervals used to group the steps and simultaneous detections is studied, concluding how this factor is decisive for the number of mobility anomalies detected and their nature. Narrow windows sizes allow to detect punctual anomalies, but on the other hand, wide window sizes are useful for detecting global anomalies. Combining different windows sizes with the use of steps or simultaneous data can also be useful. Steps series are more 'sensitive' to punctual anomalies, for example, groups of people walking together. Simultaneous data are better to detect global anomalies, as an unexpected increment of the people density, for example at the end of a concert or during a demonstration. A criterion to select mobility anomalies offering a level to each anomaly is proposed. Finally, the algorithm S-H-ESD is used to detect anomalies in the average time required for the displacements between two of the considered Mobywit nodes.
The last step of the proposed methodology implies to extract information about the mobility anomalies detected, trying to identify any pattern about their occurrence. On this regard, the month, weekday, hour and even minute of the anomalies have been analyzed. For example, it has been observed that even if two considered nodes are quite near, they presented unique patterns in the detected anomalies. VOLUME 8, 2020 This information is pertinent to understand how people move around the city, as well as how the mobility anomalies impact the area where they arise. This information would be relevant in order to reach a Smart City planning, able to optimize the resources offered to the citizens: for example adjusting the programming of traffic lights, the urban transport, or the optimal pedestrian crossing design. Otherwise, these anomalies can be employed to detect errors or inadequate designs in urban planning. Inexorably, these anomalies can be employed to observe the impact of new rules and ordinances that implied the movement of people, just comparing the data between the historic and current scenarios.
The use of smart devices tracking for detecting anomalies in the density and movement of people represents an emerging area of considerable interest in the town planning of Smart Cities. As future work, the use of Mobywit and the proposed methodology will be applied to more places and scenarios. In addition, we will conduct a detection of anomalies in the movement between much more points, making a complex network of displacements that will be better analyzed.

APPENDIXES APPENDIX A SEASONAL DECOMPOSITION FIGURES
This Appendix includes the Figures used in Section IV-C to show the seasonal decomposition of the time series with other cycles for the seasonal period (Figures 21 and 22). Figures 23 and 24 show the anomalies detected using the grouping by steps and simultaneous detections respectively.