Detecting Anomalies In Time Series Data

Abstract

Anomaly detection has shown to be a valuable tool in a variety of application domains, e.g. detecting credit card fraud, network intrusion and sensor malfunction. This thesis provides an anomaly detection algorithm as a monitoring aid applied to time series data from the pulp and paper industry, developed for the company Eurocon MOPSsys AB. The algorithm is designed to be generally applicable to the targeted time series by providing methods for adapting parameters to the input data. The anomaly detection algorithm runs in an unsupervised setting using a statistical approach for detection. The algorithm works by fitting a statistical model to a training set of a given size and computing control limits for extracted features of the data. An anomaly is said to be found if a feature falls outside of its limits that are constantly updated to adapt to the current data. The thesis also gives an algorithm that detects changes in the trend of the time series by investigating residuals of linear fits to calculated trends of the data. The time complexities of the algorithms are linear in training size which make them suitable to run in an online environment. The algorithm was evaluated using time series data provided by MOPSsys consisting of both laboratory and sensor values. As an aid for the evaluation, the time series were inspected visually to manually label deviating patterns. The anomaly detection algorithm is shown to be able to find these deviating patterns. However, it could not be determined whether these patterns are anomalies with respect to the underlying process as no labelled test data was available. Changes in the trend were also found to be in agreement with the beforehand expected outcome. The developed algorithms show promising results but need labelled test data to give a more accurate evaluation of its performance.