Detection of Emergent Anomalous Structure in Functional Data

Figures & data

Fig. 1 Observations of throughput data recorded at 1 min intervals over 100 days at a point on a telecommunications network and represented as a functional time series. Each curve denotes a single day of data (a). An instance of an anomalous day is overlaid in red in (b).

Fig. 2 Example showing the emergence of an anomaly (bolded line) within the functional data from Figure 1(b). The solid vertical line indicates the time by which the anomaly can be said to have emerged, and it is desirable to detect this event as quickly as possible.

Fig. 3 Figure showing the values of $Z_{n+1}(\tau )$ (a) and ${\Delta }_{n+1}(\tau )$ (b) for the anomaly in Figure 1.

Fig. 4 This figure overlays a single instance of an anomaly from each of models 3 (red line), 5 (blue line), 6 (green line), 7 (purple line), and 8 (orange line) over 100 non-anomalous observations from model 1 (in gray). These five anomalies represent the different types of anomaly included in our simulation study, with models 4 and 9 omitted as they use the same anomaly function as models 3 and 5, respectively.

Table 1 Detection power and average detection delay of FAST for the nine models used in the simulation studies.

Model	1	2	3	4	5	6	7	8	9
Power	0.05	0.05	0.94	0.78	1	1	1	1	0.87
ADD	–	–	13.00	58.60	1.44	44.21	18.50	70.17	16.28

NOTE: The – in the ADD row for models 1 and 2 is because there is no anomalous behavior present in these settings.

Table 2 Detection power and average detection delay of FAST for the nine models used in the simulation studies when the anomaly is either on the interval $[1,200]$ (at start) or on the interval $[401,500]$ (at end).

Model	1	2	3	5	6	7	8	9
Power: At Start	0.05	0.05	1	1	1	0.99	1	0.96
ADD: At Start	–	–	2.00	2.07	120.26	103.69	158.86	8.4 10.88
Power: At End	0.03	0.05	0.60	1	1	0.98	0.89	0.58
ADD: At End	–	–	11.32	1.89	54.60	3.15	6.36	34.00

NOTE: The – in the ADD row for models 1 and 2 is because there is no anomalous behavior present in these settings. Model 4 is not included in this study as we do not wish to vary the start/end times of the anomaly.

Table 3 Table showing detection power for models 3–9 when the training data has been contaminated by 1%, 5%, and 10% anomaly functions.

Model	3	4	5	6	7	8	9
1%	0.76	0.71	0.96	1.00	0.84	0.71	0.78
5%	0.47	0.52	0.70	0.99	0.48	0.38	0.46
10%	0.32	0.43	0.48	0.14	0.32	0.31	0.53

Table 4 Detection power for FAST for each of the nine models when the ODE order is specified as m = 1 (underfitting), or m = 3, and m = 4 (overfitting).

Model	3	4	5	6	7	8	9
m = 1	0.27	0.08	0.52	1.00	0.96	0.65	0.06
m = 3	1.00	0.99	1.00	1.00	1.00	1.00	1.00
m = 4	1.00	1.00	1.00	1.00	1.00	1.00	1.00

Table 5 Table showing accuracy of BIC model selection for different models.

Model	10 (Order 1)	11 (Order 2)	12 (Order 3)	13 (Order 4)	14 (Order 2)
Accuracy	1.00	1.00	0.93	0.67	0.97

NOTE: The true order appears in brackets.

Table 6 Comparison of the performance of FAST testing only at the end of the day and the competitor methods when the underlying profile is order 2. The best performing method in each scenario is highlighted in bold.

Model	3	4	5	6	7	8	9
FAST	0.72	0.77	1.00	1.00	1.00	0.92	0.65
TVD	0.06	0.08	0.21	0.36	0.28	0.05	0.30
Bagplot	0.07	0.06	0.05	0.07	0.03	0.05	0.20

Fig. 5 (a) shows the training dataset which contains first 30 days of throughput normalized onto a 0–1 scale and represented as functional data. (b) shows the test data represented as functional data and with the axis scaled to highlight the similarities with the profile of the training data. Figure 6 shows the test data without axis scaling.

Fig. 6 Test dataset consisting of 63 days of normalized throughput data.

Fig. 7 Figure (a) illustrates the 11 detections returned by FAST, and (b) illustrates the two public holidays on which FAST identifies atypical behavior. In both figures the gray lines represent the days where FAST does not detect anything.

Fig. 8 This figure illustrates a selection of the days on which FAST identifies the emergence of atypical behavior. (a) shows two example magnitude anomalies, while (b) illustrates three example shape anomalies. The vertical lines indicate the point where FAST first identifies this behavior.