Framework and method for the automated determination of classes and anomaly detection methods for time series
Disclosed are a framework and method for selecting an anomaly detection method for each of a plurality of class of time series based on characteristics a time series example that represents an expected form of data. The method provides classification of a given time series into one of known classes based on expected properties of the time series, filtering the set of possible detection methods based on the time series class, evaluating the remaining detection methods on the given time series using the specific evaluation metric and selecting and returning a recommended anomaly detection method based on the specific evaluation metric.
1. A method of separating time series data into classes having similar attributes, comprising:
receiving a sample time series of a given class, the sample time series having labels identifying anomalies in the time series;
calculating a windowed F-score for each of a plurality of anomaly detection methods for the sample time series;
calculating a Numenta anomaly benchmark (NAB) score for each of the plurality of anomaly detection methods for the sample time series;
based on the windowed F-scores and the NAB scores, selecting one of the plurality of anomaly detection methods for application to any time series of the given class; and
applying the selected one of the plurality of anomaly detection methods to a time series of the given class.
2. The method of claim 1 , wherein the sample time series has been classified into one of a known class based on expected properties of the sample time series before receipt by the processor.
3. The method of claim 2 , wherein the known class includes at least one of seasonality, trend, concept drift, and missing time steps.
4. The method of claim 1 , further comprising injecting outliers into the sample time series.
5. The method of claim 1 , wherein the sample time series comprises a probationary period of unlabeled data.
6. The method of claim 1 , the sample dataset comprising pre-annotated datasets across a variety of domains and scripts.
7. The method of claim 1 , wherein the anomalies in the sample time series include one of a collective type, point type and a contextual type anomaly.
8. A system for separating time series data into classes having similar attributes, comprising:
at least one a processor; and
a memory storing instructions that, when executed by the at least one processor, cause the at least one processor to:
receive a sample time series of a given class, the sample time series having labels identifying anomalies in the time series;
calculate a windowed F-score for each of a plurality of anomaly detection methods for the sample time series;
calculate a Numenta anomaly benchmark (NAB) score for each of the plurality of anomaly detection methods for the sample time series; and
based on the windowed F-scores and the NAB scores, select one of the plurality of anomaly detection methods for application to any time series of the given class; and
apply the selected one of the plurality of anomaly detection methods to a time series of the given class.
9. The system of claim 8 , wherein the sample time series has been classified into one of a known class based on expected properties of the sample time series before receipt by the processor.
10. The system of claim 9 , wherein the known class includes at least one of seasonality, trend, concept drift, and missing time steps.
11. The system of claim 8 , wherein the instructions that when executed by the at least one processor cause the at least one processor to inject outliers into the sample time series.
12. The system of claim 8 , wherein the sample time series comprises a probationary period of unlabeled data.
13. The system of claim 8 , the sample time series comprising pre-annotated data across a variety of domains and scripts.
14. The system of claim 8 , wherein the anomalies include one of a collective type, point type and a contextual type anomaly.
15. A non-transitory computer readable medium comprising instructions that, when executed by at least one processor, cause the at least one processor to:
receive a sample time series of a given class, the sample time series having labels identifying anomalies in the time series;
calculate a windowed F-score for each of a plurality of anomaly detection methods for the sample time series;
calculate a Numenta anomaly benchmark (NAB) score for each of the plurality of anomaly detection methods for the sample time series; and
based on the windowed F-scores and the NAB scores, select one of the plurality of anomaly detection methods for application to any time series of the given class; and
apply the selected one of the plurality of anomaly detection methods to a time series of the given class.
16. The non-transitory computer readable medium of claim 15 , wherein the sample time series has been classified into one of a known class based on expected properties of the sample time series before receipt by the processor.
17. The non-transitory computer readable medium of claim 16 , wherein the known class includes at least one of seasonality, trend, concept drift, and missing time steps.
18. The non-transitory computer readable medium of claim 15 , wherein the instructions that when executed by the at least one processor cause the at least one processor to inject outliers into the sample time series.
19. The non-transitory computer readable medium of claim 15 , wherein the sample time series comprises a probationary period of unlabeled data.
20. The non-transitory computer readable medium of claim 15 , the sample time series comprising pre-annotated data across a variety of domains and scripts.
21. The non-transitory computer readable medium of claim 15 , wherein the anomalies include one of a collective type, point type and a contextual type anomaly.