Content uploaded by Gerhard Klassen

Author content

All content in this area was uploaded by Gerhard Klassen on Jun 17, 2022

Content may be subject to copyright.

Citation: Korlakov, S.; Klassen, G.;

Bravidor, M.; Conrad, S. Alone We

Can Do So Little; Together We

Cannot Be Detected. Eng. Proc. 2022,

18, 3. https://doi.org/10.3390/

engproc2022018003

Academic Editors: Ignacio Rojas,

Hector Pomares, Olga Valenzuela,

Fernando Rojas and Luis Javier

Herrera

Published: 17 June 2022

Publisher’s Note: MDPI stays neutral

with regard to jurisdictional claims in

published maps and institutional afﬁl-

iations.

Copyright: © 2022 by the authors.

Licensee MDPI, Basel, Switzerland.

This article is an open access article

distributed under the terms and

conditions of the Creative Commons

Attribution (CC BY) license (https://

creativecommons.org/licenses/by/

4.0/).

Proceeding Paper

Alone We Can Do So Little; Together We Cannot Be Detected †

Sergej Korlakov 1,*,‡ , Gerhard Klassen 1, *,‡ , Marcus Bravidor 2and Stefan Conrad 1

1

Department of Computer Science, Heinrich Heine University, Universitätsstr. 1, 40225 Düsseldorf, Germany;

stefan.conrad@hhu.de

2

Department of Financial Accounting & Auditing, Albert Ludwigs University Freiburg, Rempartstraße 10–16,

79098 Freiburg, Germany; marcus.bravidor@accounting.uni-freiburg.de

*Correspondence: korlakov@hhu.de (S.K.); klassen@hhu.de (G.K.)

† Presented at the 8th International Conference on Time Series and Forecasting, Gran Canaria, Spain,

27–30 June 2022.

‡ These authors contributed equally to this work.

Abstract:

It is no longer possible to imagine our everyday life without time series data. This includes,

for example, market developments, COVID-19 cases, electricity prices, and other data from a wide

variety of domains. An important task in the analysis of these data is the detection of anomalies.

In most cases, this is accomplished by examining individual time series. In our work, we use the

techniques of cluster analysis to establish a relationship between time series and groups of time

series. This relationship allows us to observe the development of time series in their entirety, thereby

gaining additional insights. Our approach identiﬁes outliers with a real-world reference and enables

the user to locate outliers without prior knowledge. To underline the strengths of our approach, we

compare our method with another known method on two real-world datasets. We found that our

solution needs signiﬁcantly fewer calculations, produces more reasonable results, and can be applied

to real-time data. Moreover, our method detected additional outliers, whose occurrence could be

explained by real events.

Keywords:

outlier detection; outlier detection in time series; time series analysis; time series cluster-

ing; time series cluster evaluation

1. Introduction

Outlier or anomaly detection in time series is the problem of identifying rare or

deviating observations in (univariate or multivariate) time series. Those observations

may occur once or form a sequence when arising multiple times in a row. Finding

anomalies in time series can be beneﬁcial in a variety of applications, such as fraud

detection in stock markets [

1

,

2

], anomaly detection in network data [

3

,

4

], and the de-

tection of unusual time series in medical data [

5

,

6

]. The sheer number of possible ap-

plications of anomaly detection in time series makes it important for industry; there-

fore, it has been implemented in a number of business applications released by Google

(https://cloud.google.com/blog/products/data-analytics/ (accessed on 10 April 2022)),

RapidMiner (https://rapidminer.com/glossary/anomaly-detection/ (accessed on 10 April

2022)), Microsoft, and IBM [

7

,

8

]. The broad diversity of applications and products indicates

a variation in the underlying data, which requires speciﬁc solutions in order to detect

meaningful anomalies. Furthermore, outliers may also be deﬁned differently, depending

on the context at hand.

Most approaches focus on the detection of anomalous observations or subsequences in

a single time series. This is useful for many applications but does not include a comparison

to other time series from the same domain. However, assuming that time series from

the same context are inﬂuenced by similar framework conditions, such a comparison

becomes necessary. The idea of outlier detection by comparing time series is part of

Eng. Proc. 2022,18, 3. https://doi.org/10.3390/engproc2022018003 https://www.mdpi.com/journal/engproc

Eng. Proc. 2022,18, 3 2 of 12

recent research and often applies Dynamic Time Warping (DTW) techniques [

9

,

10

] or the

Granger Causality [

11

,

12

]. Although, these approaches are able to identify anomalous data

points or even subsequences, they are limited to the comparison of only two time series

at a time. The comparison of one time series to a group of other time series at the same

time is, therefore, the next logical step; however, it also requires techniques to localize

corresponding groups. The latter is well researched and is referred to as cluster analysis in

time series.

In general, the goal of cluster analysis is to group objects with the objects in the same

group being as similar as possible to each other and the objects from different groups being

as dissimilar as possible. The similarity between two objects is usually expressed by a

distance function (e.g., Euclidean distance). The number of existing clustering algorithms

is very large; hence, which one should be used depends, among other things, on the given

data and performance requirements. There are also different approaches for the clustering

of time series. Examples of these are clustering using common methods with an explicit

distance function for time series, clustering of multiple time series at each point in time, or

using a clustering algorithm that was speciﬁcally developed for time series.

An example of a clustering algorithm developed for time series (based on K-means [

13

])

is the method of Chakrabarti et al. [

14

]. The authors claim that their algorithm can pre-

serve a certain consistency of clusters in consecutive points in time. A recent study by

Tatusch et al. [

15

], however, has shown, that the development of time-series adapted al-

gorithms is not implicitly required to preserve this consistency. Instead, it is sufﬁcient to

ﬁnd corresponding parameters for existing not-time-adjusted clustering algorithms. In a

different work, the authors also demonstrate the use of this technique to ﬁnd behavioral

outliers in time series. Although the results are convincing, the given method is not appli-

cable to streaming data because it is decidedly computationally intensive. Furthermore,

the approach of Tatusch et al. [

16

] requires the user to set a threshold, which is based on

the time-series over-time stability. However, the construct of this stability measure is not

intuitive; therefore, it may be very difﬁcult to ﬁnd appropriate values for the threshold.

In this paper, we present an alternative approach based on a

cl

uster

o

ver-time

s

tability

e

valuation measure called CLOSE [

15

] that is signiﬁcantly less computationally expensive.

Moreover, the results are based on a much more intuitive threshold that incorporates

the cluster membership of time series. We compare the obtained results with those of

Tatusch et al. [16].

In the remainder of this section, we provide the necessary notations and deﬁnitions

(Section 1.1). In the next section, we ﬁrst introduce a categorization of machine learning

methods to time series analysis. Based on this categorization, we present the related work

with the respective fundamental concepts and discuss the limitations in comparison to

our solution. In Section 3, we describe our method mathematically with examples for

every introduced deﬁnition. Then, we propose an optimization to reduce the number of

computations required and, thus, to improve the performance of our method. In

Section 4

,

we compare the results of our method with the results of Tatusch et al. [

16

], a solution

with a similar key idea. To ensure a fair comparison, we use the same data set and

hyperparameters as in [

16

]. Finally, we conclude and discuss possible future work in

Section 5.

1.1. Notation and Deﬁnitions

Since we compared our procedure with that of Tatusch et al. [

16

], we adapted the

deﬁnitions they provided.

Deﬁnition 1

(Time Series)

.

A time series

TSx=x1

, . . . ,

xn

is an ordered set of

n

real-valued

data points of any dimension. The data points are ordered chronologically by time. The order is

represented by the corresponding indices of the data points.

Eng. Proc. 2022,18, 3 3 of 12

Deﬁnition 2

(Subsequence)

.

A subsequence

Sx,[k,m]=xk

, . . . ,

xm

of a time series

TSx

is an

ordered subset of

m−k

real-value data points of

TSx

with

k<m

and

∀xl∈TSx:k<l<m:

xl∈Sx,[k,m].

Deﬁnition 3

(Data Set)

.

A data set

D={TS1

, . . . ,

TSm}

is a set of

m

time series of the same

length n and equivalent points in time.

Deﬁnition 4

(Cluster)

.

A cluster

Ci,t

at time

t

with

i∈1, . . . , p

being an unique identiﬁer, is

a set of similar data points, identiﬁed by a clustering algorithm. All clusters have distinct labels

regardless of time.

Deﬁnition 5

(Cluster Member)

.

A cluster

Ci,t

at time

t

with

i∈1, . . . , p

being an unique

identiﬁer, is a set of similar data points identiﬁed by a clustering algorithm. All clusters have distinct

labels regardless of time.

2. Related Work

The different nature of data and approaches has led to a variety of diverse deﬁnitions

of outliers; however, the general deﬁnition according to Douglas M. Hawkins is often used:

“An observation which deviates so much from other observations as to arouse suspicions

that it was generated by a different mechanism” [

17

]. The observations mentioned may

have been made at one point in time or over a period of time and refer to univariate or

multivariate time series. To capture the differences in both data and methods, Blázquez-

García et al. [

18

] proposed a taxonomy that categorizes methods for anomaly detection

in time series by three axes: input data (i.e., univariate, multivariate), outlier type (i.e.,

point, subsequence, time series) and nature of the method (i.e., univariate, multivariate).

The latter describes whether a technique converts a multivariate time series into multiple

univariate time series before further processing of the data. In the following, the described

taxonomy is used to categorize the methods presented in the remainder of this section.

One method that can be categorized according to the described taxonomy under

methods of univariate nature with the support of point and subsequence outliers was

presented by Sun et al. [

19

]. The goal of the method is to detect anomalies in character

sequences. Therefore, a probabilistic sufﬁx tree is ﬁrst constructed from character sequences,

which is then used to estimate the probability of a point or subsequence being an anomaly.

Due to the fact that the method takes univariate character sequences as input, a time series

must ﬁrst be converted into such a sequence, e.g., by SAX [

20

], in order to be processed in

the following steps. In contrast, our proposed method can process time series without ﬁrst

having to convert them into a different (reduced) representation.

Alternatively, Munir et al. [

21

] introduced a method, that is multivariate in nature and

can be applied equally to both types of time series. It consists of two modules: a CNN-based

event predictor and a distance-function-based anomaly detector. As the name suggests,

the event predictor predicts the next event based on all given time series, and the anomaly

detector determines whether the deviation between the prediction and the occurred event

is higher than a certain threshold. Thus, the outlier type handled by this method is a point

in time. Compared to the supervised CNN-based event predictor, our proposed method is

unsupervised, so that a training phase is not required. Moreover, the approach presented

here has a white box character, which allows a more detailed analysis of outlier formation.

In contrast to the black box model of Munir et al. [

21

], Hyndman et al. [

22

] proposed a

white box method exclusively for anomaly detection in multivariate time series. In their

study, they extracted 18 features from each time series ﬁrst. Then, principal components

were determined from the data points of these features. Finally, a density based multidimen-

sional anomaly detection algorithm [

23

] was applied to the ﬁrst two principal components

to detect anomalous time series. Although the method has a good performance and accu-

racy compared to other presented models, the approach contains a number of drawbacks.

On one hand, the feature extraction from time series and the dimension reduction by PCA

Eng. Proc. 2022,18, 3 4 of 12

(Principal Component Analysis) can lead to a loss of important information. On the other

hand, principal components generally have a low interpretability. In this context, it can be

difﬁcult to determine the impact of features on the outlier detection. Since we consider the

dimensions of the time series as a whole in our approach, there is no loss of information.

In addition, based on cluster transitions and the reasons for those transitions, our method

allows a detailed analysis of the occurrence of anomalous subsequences.

In response to the fact that several approaches (including those described here) focused

on the deviation of one time series from the others, Tatusch et al. [

16

] presented a method

for anomalous subsequence detection, which examines the behavior of a time series relative

to their peers. For this, all time series are ﬁrst clustered per timestamp; then, the transitions

of time series between clusters are analyzed. If a time series or its subsequence frequently

moves to different clusters compared to its peers from previous clusters, it will obtain a

higher outlier score. According to this method, a time series or its subsequence is an outlier,

if the outlier score exceeds a threshold, which must be speciﬁed by the user. In other words,

if a time series changes its group often enough over time, it will be identiﬁed as an outlier.

As for any threshold that has to be set by a user, the approach of Tatusch et al. [

16

]

raises the question of what value to set it to. Thus, the problem arises that the outlier

score is not intuitive. While an outlier score of zero states that the corresponding time

series is consistently in the same clusters with its peers over time, an outlier score from an

interval

I= [

0, 1

]

can be much more difﬁcult to interpret. Further, under the assumption

that all time series of a dataset

D

have the same length

l

, the proposed method requires

K

computations to ﬁnd all anomalous subsequences in D, where Kis deﬁned as:

K=(l−1)2+ (l−1)

2∗ |D|

Finally, Tatusch et al. [

16

] differentiate between two outlier types: outliers by distance

and intuitive outliers. Outliers by distance can be detected based on their outlier score,

and intuitive outliers are subsequences consisting of noise which can arise during clustering

per timestamp. This distinction is necessary to be able to categorize the latter type of

subsequences as outlier as well, since the outlier score for these would be zero.

In our work, we present an alternative deﬁnition of an outlier, which is also based on a

clustering of the time series per timestamp; however, it addresses the problems listed for the

approach of Tatusch et al. [

16

]. Thus, the threshold of our method is more intuitive, contains

no need to differentiate between any types of outliers, and the number of computations

K0

,

based on the same assumptions as above, is smaller with:

K0= (l−1)∗ |D|

For this purpose, the given time series are clustered per timestamp ﬁrst. Then, scores

are calculated for each time series between consecutive timestamps, indicating the number

of peers with which the time series remains in the same cluster. Finally, a threshold is

deﬁned to indicate how unique a path between two clusters in consecutive timestamps

must be for the corresponding subsequence to be classiﬁed as an anomaly.

3. Method

Building on the described fundamentals, this section ﬁrst introduces further terminol-

ogy that is necessary to understand the method. This is followed by the deﬁnition of an

anomalous subsequence of a time series. Finally, a way to ﬁnd all anomalous subsequences

within a time series is presented.

For a better illustration of the equations and corresponding calculations, we refer to the

example given in Figure 1, which represents multiple time series clustered per timestamp.

In the context of this work, data points deﬁned as noise are considered as separate clusters.

Thus, the data points of the time series

TS f

are assigned to the clusters

Cr,1

and

Cv,2

at

timestamps one and two.

Eng. Proc. 2022,18, 3 5 of 12

Figure 1. Example: clustering per timestamp.

The ﬁrst term which will be relevant in the rest of this section is the cluster transitions

set

ct

. A single cluster transition of a time series

TSy

is a tuple of two cluster labels

indicating in which clusters two adjacent data points of

TSy

are located. Thus, a set of

cluster transitions ct has the following deﬁnition:

ct(TSy) = {(Ci,t,Cj,t+1)| ∃yt,yt+1∈TSy:yt∈Ci,t∧yt+1∈Ci,t+1}. (1)

For example, in Figure 1, the cluster transition sets of the time series TScare:

ct(TSc) = {(Cp,1,Cu,2 ),(Cu,2,Cw,3 )}.

Given the description of the cluster transition set, we next deﬁne a multiset

M

that

contains all cluster transitions for all time series TSiof the data set D:

MD=[

TSi∈D

ct(TSi). (2)

Regarding Figure 1, the multiset MDis:

MD={(Cp,1,Cs,2 ),(Cp,1,Cs,2 ),(Cp,1,Cu,2 ),

(Cq,1,Cu,2 ),(Cq,1,Cu,2 ),(Cr,1,Cv,2),

(Cs,2,Cw,3 ),(Cs,2,Cw,3 ),(Cu,2,Cw,3 ),

(Cu,2,Cx,3 ),(Cu,2,Cx,3 ),(Cv,2,Cx,3 )}b.

In combination with the equation for the cluster transition set, the given multiset

description is then used to deﬁne a conformity score, which indicates how often a particular

cluster transition poccurs in all time series of a data set D:

con f o rmity_score(p,MD) = MD(p). (3)

With respect to this equation, the conformity score of the cluster transition

(Cp,1

,

Cs,2)

of the data set Dpresented in Figure 1is:

con f o rmity_score((Cp,1,Cs,2),MD) = MD((Cp,1 ,Cs,2)) = 2.

Using Equations (1)–(3), a set of anomalous transitions

at

for a time series

TSy∈D

is

deﬁned as follows:

at(TSy) = {p|p∈ct(TSy)∧con f o rmity_score(p,MD)≤σ}, (4)

where

σ

is a threshold for the conformity score of a single cluster transition. Thus, if the

conformity score is less than or equal to

σ

, then the corresponding transition is categorized

Eng. Proc. 2022,18, 3 6 of 12

as anomalous. Consequently, a subsequence

Sy,[k,m]

of a time series

TSy

is anomalous if

and only if:

at(Sy,[k,m]) = ct(Sy,[k,m]). (5)

According to Equations (4) and (5), the entire time series

TSc

of the data set

D

shown

in Figure 1is anomalous due to:

at(TSc) = {(Cp,1,Cu,2 ),(Cu,2,Cw,3 )}=ct(TSc).

Using Equation (5), anomalous subsequences of a time series

TSy

can be identiﬁed by

iterating over all possible subsequences of

TSy

. As an alternative to this approach, a set

of tuples can be derived based on the set of anomalous cluster transitions, where the ﬁrst

element of each tuple indicates the beginning of an anomalous subsequence, and the second

one speciﬁes the end of the corresponding subsequence. Given a lower number of required

iterations through a time series, this alternative is intended to optimize the performance of

the method presented in this paper. This ﬁrst requires the deﬁnition of an order relation

≤

:

(Ci,ta,Cj,tb)≤(Ck,tc,Cl,td):⇔(ta≤tb)∧(tc≤td). (6)

Based on the presented order relation, a set of tuples can be deﬁned with respect to a

time series

TSy

, where each tuple consists of two anomalous cluster transitions. The ﬁrst

transition indicates the beginning of an anomalous subsequence of the time series

TSy

, and

the last one speciﬁes the end of the corresponding subsequence. The formal description for

this set of anomalous transition boundaries atb is given by:

atb(TSy) = {(p,p0)|(p,p0∈at(TSy))∧

(@˜

p∈ct(TSy)∧˜

p/∈at(TSy):p≤˜

p≤p0)∧

(@(Ci,t,Cj,t+1)∈at(TSy):p0= (Ch,t−1,Ci,t))}.

In the case of the time series

TSc

from Figure 1, the set of anomalous transition

boundaries for σ=1 is:

atb(TSc) = {((Cp,1,Cu,2 ),(Cu,2,Cw,3 ))}.

Further, to obtain data point-based outlier boundaries for a time series

TSy

, a mapping

dpy(Ci,t

,

Cj,t0) = (yt

,

y0

t)

is required that maps cluster tuples to a tuple of data points based

on TSy, such that:

yt∈TSy∧yt∈Ci,t∧yt0∈TSy∧yt0∈Cj,t0.

Finally, the outlier boundaries set

ob

within a time series

TSy

is deﬁned as a element-

wise merge of tuples of the set of the anomalous transition boundaries, which is then

mapped to the data points of TSy:

ob(TSy) = {dpy(Cw,t,Cz,t0+1)|∀((Cw,t,Cx,t+1),(Cy,t0,Cz,t0+1)) ∈atb(TSy)}.

In this context, the set of outlier boundaries consists of tuples, where the ﬁrst element

of each tuple marks the beginning of an anomalous subsequence, and the second one

indicates the end of that subsequence. Consequently, the outlier boundaries set of the time

series TSc=c1,c2,c3shown in Figure 1for σ=1 is:

ob(TSc) = {dpc(Cp,1,Cw,3 )}={(c1,c3)}.

4. Experiments

In this section, we evaluate the method presented in this work. Since the method

for detection of outliers in time series (DOOTS (https://github.com/tatusch/ots-eval/

blob/main/doc/doots.md (accessed on 20 April 2022))) of Tatusch et al. [

22

] also detects

anomalous subsequences based on time series transitions between different clusters, we

Eng. Proc. 2022,18, 3 7 of 12

used their method for comparison with our approach. In addition, we used the identical

data sets and the same clustering method. This is intended to make the comparison of the

two methods as fair as possible. In both approaches, DBSCAN with euclidean distance was

used for timestamp-based clustering, with

minPts

and

ε

set differently for each data set

but equally for both methods. In order to identify the best cluster parameters, we made

use of the cluster over-time stability evaluation measure called CLOSE [

15

] and found that

these were the same as Tatusch et al. used in their study [

16

]. Furthermore, we used the

same thresholds for DOOTS as proposed in Tatusch et al. In order to make a meaningful

comparison with our method, we chose the conformity score threshold in a way to ensure

the results of both methods were as similar as possible. Overall, we used two real world

data sets to compare both methods.

4.1. Eikon Financial Data Set

One of the real world data sets Tatusch et al. used for the evaluation of their work

was an extract from the EIKON database. This database contains ﬁnancial data from over

150,000 sources worldwide, and the information includes the previous 65 years. The extract

contained annual values from the features’ net sales and expected return for 30 (originally)

random selected companies. The values of both features were normalized by min–max-

normalization. The parameters used for the clustering by DBSCAN were

ε=

0.15 and

minPts =2.

Figure 2a shows the result of DOOTS [

16

] for the threshold

τ=

0.6, and Figure 2b

illustrates the result of our outlier detection method for the conformity score threshold of

σ=

1. The black dashed boxes in Figure 2a mark intuitive outliers, which by deﬁnition

consist of noise, and the red boxes represent outliers found by analyzing cluster transitions

(outlier by distance). In contrast, in Figure 2b, each black dashed box highlights the

beginning of an anomalous subsequence and each red dashed box marks the remainder of

that subsequence.

The most noticeable fact when comparing the results of both methods is the dif-

ferent number of detected subsequences. While DOOTS [

16

] found only two anoma-

lous subsequences (

SGM,[2008,2009]

and

SKR,[2009,2013]

), our solution identiﬁed four of them

(

SGM,[2008,2009]

,

SKR,[2008,2013]

,

STJX,[2008,2009]

, and

SUPS,[2012,2013]

). A detailed analysis of

STJX,[2008,2009]

and

SUPS,[2012,2013]

showed that both of them had a unique cluster transi-

tion with a conformity score of one each. Since the threshold

σ

was set to the same value,

both subsequences were identiﬁed as anomalous by our method.

The explanation for why

STJX,[2008,2009]

and

SUPS,[2012,2013]

were not considered anoma-

lous by DOOTS [16] is more complex. In the case of UPS, neither a subsequence score nor

the best score can be calculated, due to the lack of a cluster membership of the last data

point of the time series. The inclusion of such a case requires an additional case differentia-

tion. This can be seen as a disadvantage of the method of Tatusch et al. [

16

]. The reason

for the missing detection of

STJX,[2008,2009]

was the small size of the cluster in which TJX

was located in 2008. Therefore, the calculation of the subsequence score for

STJX,[2008,2009]

resulted in 0.5. Since the best score for this subsequence was one, the outlier score for it

was

(

1

−

0.5

) =

1, thus lower than the threshold

τ

of 0.6. From this case, the dependence of

the outlier detection result on the corresponding cluster sizes can be derived, which can be

considered as another disadvantage of the method of DOOTS [16].

Eng. Proc. 2022,18, 3 8 of 12

(a)

(b)

Figure 2.

(

a

) Result of Tatusch et al. Colors: cluster memberships, red dashed boxes: outlier by dis-

tance, black dashed boxes: intuitive outliers. (

b

) Result of our method. Colors: cluster memberships,

red dashed boxes: outliers, black dashed boxes: preoutliers.

Most interesting with regard to the identiﬁcation of UPS (2012–2013) and TJX (2008–

2009) as outliers is probably the realization that they can be explained by related events.

Unlike the companies with which UPS was clustered in 2012, UPS had to lower its expected

return in 2013. This was probably attributable to the crash of UPS Airlines Flight 1354

(https://www.bbc.com/news/world-us-canada-23698279; accessed on 25 April 2022)

14 August 2013. TJX Companies is a multinational department store corporation that in

2009 was still struggling with the consequences of the recession triggered by the economic

crisis in 2008 (https://www.bizjournals.com/denver/stories/2009/07/06/daily63.html;

accessed on 25 April 2022). For this reason, sales fell sharply, as they did for all retail

traders. The reason why TJX was identiﬁed as an outlier here was that it was the only retail

company in the data set.

4.2. Airline On-Time Performance Data Set

The other real world data set that Tatusch et al. [

16

] used in their publication was

called “Airline on-time performance”. It was originally created for a challenge with the

goal to predict delayed and canceled ﬂights. Therefore, the authors included ﬂight data on

Eng. Proc. 2022,18, 3 9 of 12

all commercial ﬂights in the USA between October 1987 and April 2008, resulting in a total

of 120 million records. Based on this data set, Tatusch et al. [

16

] generated one dimensional

time series with the feature “distance”. As described in their work, they took eight days of

every month and calculated the average distance for each airline in the data set. Before the

authors clustered the created data set with DBSCAN, they normalized the distances by

the min–max normalization. The parameters for the applied clustering algorithm were

minPts =3 and e=0.03.

The result of DOOTS [

16

] for

τ=

0.4 is displayed in Figure 3a. Here, the black solid

lines represent outliers by distance, and the black dashed lines are both outliers by distance

and intuitive outliers. Our result for

σ=

1 is shown in Figure 3b, where the black solid

lines mark anomalous subsequences. In both ﬁgures, the colors of the dots set at each time

point represent the cluster membership, with the red color representing noise found by

DBSCAN. The results of both methods show strong similarities regarding the detection of

anomalous subsequences, but there are also some differences. The most relevant of them

are discussed below.

(a) (b)

Figure 3.

Airline on-time performance data set. (

a

) Outlier detection result of the method of

Tatusch et al. (b) Result of our method.

Foremost, the subsequences

SA,[1,2]

and

SA,[3,4]

of the time series marked as

A

in

Figure 3were detected as anomalous by DOOTS [

16

], while they were not detected as such

by our method. In the context of our approach, these subsequences were not detected as

anomalous, because the number of equal cluster transitions and, therefore, the conformity

score of

SA,[1,2]

as well as of

SA,[3,4]

was higher than the threshold

σ=

1. In contrast,

explaining the results of DOOTS [

16

] requires detailed calculations. First, the subsequence

score for SA,[1,2]is:

subseq_score(SA,[1,2]) = 3/4 =0.75.

Given that the best score for the last cluster of

SA,[1,2]

is one, the outlier score for this

subsequence is:

outlier_score(SA,[1,2]) = 1−0.75 =0.25 <τ.

Based on this result,

SA,[1,2]

should not be labeled as anomalous. However, if we take

the subsequence

SA,[1,3]

, which in addition to

SA,[1,2]

contains a further value at

time =

3,

the subsequence score for SA,[1,3]becomes smaller compared to SA,[1,2]with:

subseq_score(SA,[1,3]) = 0.5 ∗(0.5 +0.1) = 0.3.

Since the best score for the corresponding cluster at

time =

3 is one, the outlier score

for SA,[1,3]is:

outlier_score(SA,[1,3]) = 1−0.3 =0.7 >τ.

Eng. Proc. 2022,18, 3 10 of 12

Thus, the subsequence

SA,[1,3]

, was marked as anomalous. The same type of calcula-

tions led to the detection of the subsequence

SA,[3,5]

as anomalous, which contained the not

anomalous subsequence SA,[3,4].

The detection of

SA,[1,2]

and

SA,[3,4]

by DOOTS [

16

] leads to two possible conclusions.

On one hand, it can be concluded that the approach of Tatusch et al. [

16

] considers anoma-

lous subsequences in a broader context with respect to the length of a time series than our

method, which would be an advantage of DOOTS. On the other hand, this solution leads

to subsequences that are not anomalous within their interval being detected as anomalous.

This can be seen as a disadvantage of DOOTS [

16

]. In contrast, our method detects only

those subsequences that exhibit suspicious behavior within their time interval. However,

a broader context regarding our detection method can be achieved by additionally consid-

ering non-anomalous subsequences that are adjacent to detected anomalous subsequences.

A more general observation is that our method detected every subsequence of length

two as anomalous if it contained one or more noisy data points. The reason for this is that

the conformity score of such sequences was one and thus smaller or equal to the chosen

threshold

σ

. In contrast, the solution of Tatusch et al. [

16

] follows a different approach.

Even if a subsequence of length two had a noisy data point, it does not mean that DOOTS

[

16

] would detect this subsequence as anomalous. In addition to the subsequence score,

the detection of outliers by the method of Tatusch et al. [

16

] also depends on the value

of the corresponding best score and whether both scores can be calculated for the given

subsequence. In summary, we can conclude that DOOTS [

16

] has a much more complex set

of rules than our method, whereby the results of both methods are similar.

5. Conclusions and Future Work

In this paper, we introduced a new approach for detecting outliers in multiple mul-

tivariate time series. For this purpose, we ﬁrst clustered the time series data at each time

point and then calculated conformity scores for each subsequence of length two. Finally,

we determined whether the conformity scores were less than or equal to the speciﬁed

threshold and labeled them as outliers if they were.

Since we found only one alternative algorithm (called DOOTS) [

16

] based on a similar

idea, we compared the two in detail. The application of both methods led to similar results,

although our solution had a much simpler rule set and, therefore, required fewer calcula-

tions (the runtime estimation is provided in Section 2). On one hand, this simpliﬁed the

understanding of the origin of the outliers and, on the other hand, the better performance of

our method allows it to be used on real time data. In addition, our rule set seems to be more

consistent in contrast to DOOTS [

16

]. This statement is supported, among other things,

by comparing the thresholds of both methods. While for our method the same minimum

conformity score threshold was used in each dataset, the threshold set in DOOTS [

16

]

varied without much difference between the results of both methods. Furthermore, our

solution detected subsequences even if they ended with a noisy data point.

The most important drawback of our method is that the outlier detection result

depends highly on the result of previous clustering. This implies that a poor clustering

result would lead to a poor detection result of our method. Since the analysis of cluster

transitions is the core idea of our method, we have to rely on approaches such as CLOSE [

15

]

to obtain reasonable clustering results for our solution. Furthermore, while our method

can be applied to real-time data due to its performance, this requires prior clustering in

real-time with reasonable results for time series data. Here, CLOSE [

15

] provides good

results, but the procedure is not applicable to real-time data because of the high number of

needed computations. Given that, the most important aspect for future work is to optimize

CLOSE [

15

] for real-time application. In addition, the freely selectable threshold

σ

in our

work has a high impact on the detection result of our method. Every increment of

σ

leads to

a superset of detected outliers regarding the result of the previous threshold. Although in

this work we set this parameter to one for each dataset in order to obtain results that were

as similar as possible and thus comparable to DOOTS [

16

], the optimal value for

σ

can

Eng. Proc. 2022,18, 3 11 of 12

be determined in several ways, and each determination should depend on the dataset

in question. One way to determine the optimal

σ

is to count the cluster transitions that

occur, sort them in ascending order, and choose the value for

σ

at which the slope change is

greatest. However, the analysis of this and other possible methods is beyond the scope of

this work and should therefore be addressed in future work. Another aspect is that not

all detected anomalous subsequences may be useful in the context of given requirements.

Since this case requires further analysis, our method could be applied to multiple data sets

in which the outliers have already been labeled.

Author Contributions:

Conceptualization, S.K. and G.K.; methodology, S.K. and G.K.; software, S.K.

and G.K.; validation, S.K. and G.K.; formal analysis, S.K. and G.K.; investigation, S.K. and G.K. and

S.C.; data collection, S.K., G.K. and M.B.; writing—original draft preparation S.K. and G.K.; writing—

review and editing, S.K., G.K., M.B. and S.C.; visualization, S.K. and G.K.; project administration S.C.,

M.B. All authors have read and agreed to the published version of the manuscript.

Funding: This work was funded by the Jürgen Manchot Foundation.

Institutional Review Board Statement: Not applicable.

Informed Consent Statement: Not applicable.

Data Availability Statement:

Data available in a publicly accessible repository that does not issue DOIs

(https://github.com/YellowOfTheEgg/mldp-outlier_detection (accessed on 16 June 2022)). Publicly

available datasets were analyzed in this study. This data can be found here: EIKON dataset: https://

www.refinitiv.com/ (accessed: 20 April 2020); Airline on-time performance dataset: https://community.

amstat.org/jointscsg-section/dataexpo/dataexpo2009 (accessed on 20 April 2020).

Acknowledgments:

We would like to thank the Jürgen Manchot Foundation, which supported this

work by ﬁnancing the AI research group Decision-making with the help of Artiﬁcial Intelligence at

Heinrich Heine University Düsseldorf.

Conﬂicts of Interest: The authors declare no conﬂict of interest.

Abbreviations

The following abbreviations are used in this manuscript:

DOOTS Detecton of outliers in time series (method)

CLOSE cluster over-time stability evaluation (measure)

DTW dynamic time warping

References

1.

Ferdousi, Z.; Maeda, A. Unsupervised Outlier Detection in Time Series Data. In Proceedings of the 22nd International Conference

on Data Engineering Workshops Atlanta, GA, USA, 3–7 April 2006; IEEE: New York, NY, USA, 2006.

2. Golmohammadi, K.; Zaiane, O.R. Time series contextual anomaly detection for detecting market manipulation in stock market.

In Proceedings of the 2015 IEEE International Conference on Data Science and Advanced Analytics (DSAA), Paris, France, 19–21

October 2015; IEEE: New York, NY, USA, 2015.

3.

Gao, J.; Liang, F.; Fan, W.; Wang, C.; Sun, Y.; Han, J. On community outliers and their efﬁcient detection in information

networks. In Proceedings of the 16th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining

KDD’10, Washington, DC, USA, 25–7 July 2010; ACM Press: New York, NY, USA, 2010

4.

Ghoting, A.; Otey, M.; Parthasarathy, S. LOADED: Link-Based Outlier and Anomaly Detection in Evolving Data Sets. In

Proceedings of the Fourth IEEE International Conference on Data Mining (ICDM’04), Brighton, UK, 1–4 November 2004; IEEE:

New York, NY, USA, 2004.

5.

Keogh, E.; Lin, J.; Fu, A.; Herle, H.V. Finding Unusual Medical Time-Series Subsequences: Algorithms and Applications. IEEE

Trans. Inf. Technol. Biomed. 2006,10, 429–439. [CrossRef] [PubMed]

6.

Nouira, K.; Trabelsi, A. Time Series Analysis and Outlier Detection in Intensive Care Data. In Proceedings of the 2006 8th

international Conference on Signal Processing, Guilin, China, 16–20 November 2006; IEEE: New York, NY, USA, 2006.

7.

Biem, A.; Feng, H.; Riabov, A.V.; Turaga, D.S. Real-time analysis and management of big time-series data. IBM J. Res. Dev.

2013

,

57, 8:1–8:12. [CrossRef]

8.

Ren, H.; Xu, B.; Wang, Y.; Yi, C.; Huang, C.; Kou, X.; Xing, T.; Yang, M.; Tong, J.; Zhang, Q. Time-Series Anomaly Detection Service

at Microsoft. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining,

Anchorage, AK, USA, 4–8 August 2019; ACM Press: New York, NY, USA, 2019.

Eng. Proc. 2022,18, 3 12 of 12

9.

Benkabou, S.E.; Benabdeslem, K.; Canitia, B. Unsupervised outlier detection for time series by entropy and dynamic time warping.

Knowl. Inf. Syst. 2017,54, 463–486. [CrossRef]

10.

Diab, D.M.; AsSadhan, B.; Binsalleeh, H.; Lambotharan, S.; Kyriakopoulos, K.G.; Ghaﬁr, I. Anomaly Detection Using Dynamic

Time Warping. In Proceedings of the 2019 IEEE International Conference on Computational Science and Engineering (CSE) and

IEEE International Conference on Embedded and Ubiquitous Computing (EUC), New York, NY, USA, 1–3 August 2019; IEEE:

New York, NY, USA, 2019.

11.

Granger, C.W.J. Investigating Causal Relations by Econometric Models and Cross-spectral Methods. Econometrica

1969

,37, 424.

[CrossRef]

12.

Qiu, H.; Liu, Y.; Subrahmanya, N.A.; Li, W. Granger Causality for Time-Series Anomaly Detection. In Proceedings of the 2012

IEEE 12th International Conference on Data Mining, Brussels, Belgium, 10 December 2012; IEEE: New York, NY, USA, 2019.

13. Lloyd, S. Least squares quantization in PCM. IEEE Trans. Inf. Theory 1982,28, 129–137. [CrossRef]

14.

Chakrabarti, D.; Kumar, R.; Tomkins, A. Evolutionary clustering. In Proceedings of the 12th ACM SIGKDD International

Conference on Knowledge Discovery Furthermore, Data Mining—KDD’06, Philadelphia, PA, USA, 20–23 August 2006; ACM

Press: New York, NY, USA, 2006.

15.

Tatusch, M.; Klassen, G.; Bravidor, M.; Conrad, S. How is your team spirit? cluster over-time stability evaluation. In Machine

Learning and Data Mining in Pattern Recognition, Proceedings of the 16th International Conference on Machine Learning and Data Mining,

MLDM 2020, New York, NY, USA, 18–23 July 2020; IBAI Publishing: Leipzig, Germany, 2020; pp. 155–170.

16.

Tatusch, M.; Klassen, G.; Bravidor, M.; Conrad, S. Show Me Your Friends and I will Tell You Who You Are. Finding Anomalous

Time Series by Conspicuous Cluster Transitions. In Communications in Computer and Information Science; Springer: Singapore, 2019;

pp. 91–103.

17. Hawkins, D.M. Identiﬁcation of Outliers; Springer: Cham, The Netherlands, 1980.

18.

Blázquez-García, A.; Conde, A.; Mori, U.; Lozano, J.A. A review on outlier/anomaly detection in time series data. ACM Comput.

Surv. 2021,54, 56:1–56:33. [CrossRef]

19.

Sun, P.; Chawla, S.; Arunasalam, B. Mining for Outliers in Sequential Databases. In Proceedings of the 2006 SIAM International

Conference on Data Mining. Society for Industrial and Applied Mathematics, Bethesda, MD, USA, 20–22 April 2006.

20.

Lin, J.; Keogh, E.; Wei, L.; Lonardi, S. Experiencing SAX: A novel symbolic representation of time series. Data Min. Knowl. Discov.

2007,15, 107–144. [CrossRef]

21.

Munir, M.; Siddiqui, S.A.; Dengel, A.; Ahmed, S. DeepAnT: A Deep Learning Approach for Unsupervised Anomaly Detection in

Time Series. IEEE Access 2019,7, 1991–2005. [CrossRef]

22.

Hyndman, R.J.; Wang, E.; Laptev, N. Large-Scale Unusual Time Series Detection. In Proceedings of the 2015 IEEE International

Conference on Data Mining Workshop (ICDMW), Atlantic City, NJ, USA, 14–17 November 2015; IEEE: New York, NY, USA, 2019.

23. Hyndman, R.J. Computing and Graphing Highest Density Regions. Am. Stat. 1996,50, 120.