# Semi-Supervised Time Series Anomaly Detection Based on Statistics and Deep Learning

^{*}

## Abstract

**:**

_{1}-score.

## 1. Introduction

_{1}-score. It also compares Tri-CAD with related methods, such as the SARIMA [41], STL [42], LSTM [43], LSTM with STL [44], and ADSaS [44] methods. The comparisons show that Tri-CAD outperforms the others in all three datasets.

## 2. Background Knowledge

#### 2.1. Time Series and Related Models

_{1}, x

_{2}, …) is a sequence of observations (or data) ordered chronologically, where x

_{t}is recorded at a specific time point t, where t is a positive integer [47]. It is usually assumed that time points are equally separated. Based on the properties of observations, we have two types of time series. On the one hand, if observations of a time series are scalar values, then the time series is a univariate time series. On the other hand, if observations are multi-dimensional vectors, then the time series is a multivariate time series. This paper focuses on univariate time series; therefore, we use “time series” to stand for “univariate time series” in the following context.

_{1}, …, x

_{n}) and Z = (x

_{1+m}, …, x

_{n}

_{+m}) are the same, where Y and Z are subsequence of X. A time series X is weakly stationary if its mean E(∙), variance Var(∙), and covariance Cov(∙) do not change by time shifts. In other words, for every m and n, E(Y) = E(Z) = a constant μ, Var(Y) = Var(Z) = a constant σ

^{2}, and Cov(Y, Z) = γ(|m − n|) for some function γ(∙). In this paper, a time series is assumed to be stationary if it is weakly stationary. The next subsection will show how to use the Dickey–Fuller test to check the stationarity of a time series.

_{1}, x

_{2}, …) be a stationary time series and x

_{t}in X be an observation recorded at a specific time point t, where t is a positive integer. In consideration of p earlier lags x

_{t}

_{−1}, x

_{t}

_{−2}, …, x

_{t}

_{−p}and the white noise (or random error) e

_{t}at time t with the zero mean and a bounded variance, x

_{t}can be formulated according to the auto-regressive AR(p) model, as shown in (1).

_{t}= a

_{1}x

_{t}

_{−1}+ a

_{2}x

_{t}

_{−2}+ ….+ a

_{p}x

_{t}

_{−p}+ e

_{t},

_{1}, a

_{2}, …, a

_{p}are coefficients or parameters of the AR model.

_{t}at time t and q pervious random errors e

_{t}

_{−1}, e

_{t}

_{−2}, …, e

_{t}

_{−q}, the deviation of x

_{t}from the mean μ of the whole series can be formulated according to the moving-average MA(q) model, as shown in (2).

_{t}− μ = e

_{t}+ b

_{1}e

_{t}

_{−1}+ b

_{2}e

_{t}

_{−2}+ ….+ b

_{q}e

_{t}

_{−q},

_{1}, b

_{2}, …, b

_{q}are coefficients or parameters of the MA model.

_{t}

_{−1}, x

_{t}

_{−2}, …, x

_{t}

_{−p}, q pervious random errors e

_{t}

_{−1}, e

_{t}

_{−2}, …, e

_{t}

_{−q}, and the random error e

_{t}, x

_{t}can be formulated according to the auto-regressive and moving-average ARMA(p, q) model, as shown in (3).

_{t}– (a

_{1}x

_{t}

_{−1}+ a

_{2}x

_{t}

_{−2}+….+a

_{p}x

_{t}

_{−p}) = e

_{t}+b

_{1}e

_{t}

_{−1}+b

_{2}e

_{t}

_{−2}+ ….+b

_{q}e

_{t}

_{−q},

_{1}, a

_{2}, …, a

_{p}are coefficients of the AR model, and q is the order and b

_{1}, b

_{2}, …, b

_{q}are coefficients of the MA model. By introducing the lag operator L, where Lx

_{t}= x

_{t}

_{−1}, and L(Lx

_{t}) = L

^{2}x

_{t =}x

_{t}

_{−2}, …, and so on, we can rewrite ARMA(p, q) according to (4).

_{1}, x

_{2}, …) be a non-stationary time series and x

_{t}in X be an observation recorded at a specific time point t, where t is a positive integer. As X is not stationary, it cannot be formulated by AR, MA, or ARMA models. However, Box and Jenkins [49] suggested that differencing a non-stationary time series one or more times can make it stationary. To be specific, by differencing the non-stationary time series X for d times, X can still be properly formulated by the ARIMA(p, d, q) model, as described below. Note that (1 − L)x

_{t =}x

_{t}− x

_{t}

_{−1 =}first-order difference, and (1 − L)

^{d}x

_{t =}d

^{th}-order difference. We have the following Formula (5).

_{m}. In addition to d-order differencing of ARIMA, seasonal ARIMA or SARIMA also includes the m-order seasonal differencing to reduce the seasonal component. Please refer to [41] for the details of adding seasonal differencing terms for the SARIMA model.

#### 2.2. Pearson Correlation Coefficient

_{X,Y}, is formulated according to (6).

#### 2.3. Dickey–Fuller Test

_{t}= a

_{1}x

_{t}

_{−1}+ e

_{t}. The time series is non-stationary if a

_{1}≥ 1; on the contrary, it is stationary if a

_{1}< 1. Note that a unit root is present if a

_{1}= 1. Therefore, the DL test is under the null hypothesis that a

_{1}is equal to 1 (or the model has the root equal to the unity) and the alternative hypothesis that a

_{1}< 1 (or the model has the root not equal to the unity). In summary, if the null hypothesis is rejected, then the time series is stationary; otherwise, the time series is non-stationary.

#### 2.4. Discret Wavelet Transform

_{a}

_{,b}(t) of ψ(t) is defined according to (7).

#### 2.5. Autoencoder

^{T}+b), where f(∙) is an activation function (e.g., a hyperbolic tangent function), w is a weight vector, x

^{T}is the transposition of x, and b is a bias vector. Figure 2 illustrates the architecture of a simple AE. As shown in Figure 2, the AE has the encoder, code, and decoder parts. It is divided into front layers, a middle layer, and rear layers. The front layers can be regarded as the encoder, whereas the rear layers as the decoder. The middle layer constitutes the code, which can be used as a latent representation of the input. The middle layer associated with the code usually has much fewer neurons than the input layer. An AE can thus be used to reduce the dimensionality of input data. Specifically, the code of the AE can be regarded as the dimensionality reduction result or feature extraction result of the input data.

## 3. Proposed Anomaly Detection Framework

#### 3.1. Periodic Time Series Anomaly Detection

_{x}. Its standard anomaly score (SAS) λ

_{x}is then calculated according to (9).

_{x}of a data point x is the measurement of how far x’s anomaly score s

_{x}deviates from μ in terms of σ. As shown earlier, a different λ

_{x}value corresponds to different occurrence probability of such a data point. For example, λ

_{x}= 4.417173 corresponds to 0.001% of occurrence. If the SAS λ

_{x}exceeds a pre-specified deviation threshold τ and λ

_{x}is increasing (i.e., x’s SAS is larger than the SAS of x’s previous data point), then the data point x is assumed to be anomalous.

#### 3.2. Stationary Time Series Anomaly Detection

_{x}and Lmean

_{x}, respectively. Then, x’s anomaly score s

_{x}is calculated according to (10).

_{x}, its SAS λ

_{x}is calculated according to Equation (9). Similarly, if λ

_{x}is increasing and exceeds a pre-specified threshold, the data point x is regarded as anomalous.

#### 3.3. Non-Periodic and Non-Stationary Time Series Anomaly Detection

_{i}is the original data value; ${x}_{i}^{\prime}$ is the standardized data value; and μ and σ are the mean and the standard deviation of the original data, respectively.

_{x}is derived according to Equation (9). Likewise, if λ

_{x}is increasing and exceeds a pre-specified threshold, the data point x is regarded as anomalous.

#### 3.4. Treshold Setting

_{x}of a test data point x exceeds a certain deviation threshold τ (i.e., if λ

_{x}> τ × σ). If so, the data point x is assumed to be anomalous; otherwise, x is assumed to be normal.

#### 3.5. Predecesors of Tri-CAD

## 4. Performance Evaluation and Comparison

_{1}-score of the prediction, whose definitions are shown in (12)–(14), respectively. In the definitions, TP (true positive) represents the number of anomalies that are truly (or correctly) detected as anomalies, FP (false positive) represents the number of normal data that are falsely (or incorrectly) detected as anomalies, TN (true negative) represents the number of normal data that are truly detected as normal data, and FN (false negative) represents the number of anomalies that are falsely detected as normal data.

_{1}-score = 2 × precision/(precision + recall)

_{1}-score can be evaluated accordingly.

_{1}-score either for small or large training dataset sizes. It also has best performance (i.e., 1.0) either for small or large sliding window sizes. However, when the window sizes are not within the range between the small value and the large value, Tri-CAD does not work with high performance. Certainly, such window sizes should be avoided and their associated figures are not shown in this paper to save space.

_{1}-score for all datasets. This is because related methods try to improve anomaly detection performance by integrating various models, each of which is suitable for a different class of time series. On the contrary, the proposed framework first classifies time series into different classes and then utilizes a specific scheme to perform anomaly detection for a specific class of time series. As it is more likely to perform better by applying a special scheme to a special class of time series, the proposed framework thus outperforms others.

## 5. Conclusions

_{1}-score either for the small or the large training dataset sizes. It also has the best performance of 1 either for the small or the large WT sliding window sizes. The evaluated performance results of Tri-CAD are compared with those of related methods, namely, the STL, SARIMA, LSTM, LSTM with STL, and ADSaS. The comparisons show that Tri-CAD outperforms the others in terms of the precision, recall, and F

_{1}-score for all three datasets.

## Author Contributions

## Funding

## Conflicts of Interest

## References

- Chandola, V.; Banerjee, A.; Kumar, V. Anomaly detection: A survey. ACM Comput. Surv.
**2009**, 41, 1–58. [Google Scholar] [CrossRef] - Chalapathy, R.; Chawla, S. Deep learning for anomaly detection: A survey. arXiv
**2019**, arXiv:1901.03407. [Google Scholar] - Zhang, J. Advancements of outlier detection: A survey. ICST Trans. Scalable Inf. Syst.
**2013**, 13, 1–26. [Google Scholar] [CrossRef] [Green Version] - Gupta, M.; Gao, J.; Aggarwal, C.C.; Han, J. Outlier detection for temporal data: A survey. IEEE Trans. Knowl. Data Eng.
**2013**, 26, 2250–2267. [Google Scholar] [CrossRef] - Pimentel, M.A.; Clifton, D.A.; Clifton, L.; Tarassenko, L. A review of novelty detection. Signal Process.
**2014**, 99, 215–249. [Google Scholar] [CrossRef] - Zhao, Z.; Mehrotra, K.G.; Mohan, C.K. Online anomaly detection using random forest. In International Conference on Industrial, Engineering and Other Applications of Applied Intelligent Systems; Springer: Cham, Switzerland, June 2018; pp. 135–147. [Google Scholar]
- Beckman, R.J.; Cook, R.D. Outlier………. s. Technometrics
**1983**, 25, 119–149. [Google Scholar] - Tripathi, A.; Yadav, D.R. Outlier detection in big data using optimized Orion technique. Int. J. Curr. Res. Life Sci.
**2018**, 7, 1204–1207. [Google Scholar] - Al-khatib, A.A.; Balfaqih, M.; Khelil, A. A survey on outlier detection in Internet of Things big data. In Big Data-Enabled Internet of Things; IET Digital Library: London, UK, 2019; Chapter 11; pp. 225–272. [Google Scholar]
- Shahid, N.; Naqvi, I.H.; Qaisar, S.B. Characteristics and classification of outlier detection techniques for wireless sensor networks in harsh environments: A survey. Artif. Intell. Rev.
**2015**, 43, 193–228. [Google Scholar] [CrossRef] - Van, N.T.; Thinh, T.N. An anomaly-based network intrusion detection system using deep learning. In Proceedings of the 2017 International Conference on System Science and Engineering (ICSSE), Ho Chi Minh City, Vietnam, 21–23 July 2017; pp. 210–214. [Google Scholar]
- Maimó, L.F.; Gómez, Á.L.P.; Clemente, F.J.G.; Pérez, M.G.; Pérez, G.M. A self-adaptive deep learning-based system for anomaly detection in 5G networks. IEEE Access
**2018**, 6, 7700–7712. [Google Scholar] [CrossRef] - Lu, N.; Du, Q.; Sun, L.; Ren, P. Traffic-driven intrusion detection for massive MTC towards 5G networks. In Proceedings of the IEEE INFOCOM 2018-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), Honolulu, HI, USA, 15–19 April 2018; pp. 426–431. [Google Scholar]
- Choi, H.; Kim, M.; Lee, G.; Kim, W. Unsupervised learning approach for network intrusion detection system using autoencoders. J. Supercomput.
**2019**, 75, 5597–5621. [Google Scholar] [CrossRef] - Choi, S.; Youm, S.; Kang, Y.S. Development of scalable on-line anomaly detection system for autonomous and adaptive manufacturing processes. Appl. Sci.
**2019**, 9, 4502. [Google Scholar] [CrossRef] [Green Version] - Wang, P.; Yang, L.T.; Nie, X.; Ren, Z.; Li, J.; Kuang, L. Data-driven software defined network attack detection: State-of-the-art and perspectives. Inf. Sci.
**2020**, 513, 65–83. [Google Scholar] [CrossRef] - Krishnaveni, S.; Vigneshwar, P.; Kishore, S.; Jothi, B.; Sivamohan, S. Anomaly-based intrusion detection system using support vector machine. In Artificial Intelligence and Evolutionary Computations in Engineering Systems; Springer: Singapore, 2020; pp. 723–731. [Google Scholar]
- Kubota, T.; Yamamoto, W. Anomaly detection from online monitoring of system operations using recurrent neural network. Procedia Manuf.
**2019**, 30, 83–89. [Google Scholar] [CrossRef] - Lindemann, B.; Fesenmayr, F.; Jazdi, N.; Weyrich, M. Anomaly detection in discrete manufacturing using self-learning approaches. Procedia CIRP
**2019**, 79, 313–318. [Google Scholar] [CrossRef] - Hsieh, R.J.; Chou, J.; Ho, C.H. Unsupervised online anomaly detection on multivariate sensing time series data for smart manufacturing. In Proceedings of the 2019 IEEE 12th Conference on Service-Oriented Computing and Applications (SOCA), Kaohsiung, Taiwan, 18–21 November 2019; pp. 90–97. [Google Scholar]
- Wu, J.; Zhao, Z.; Sun, C.; Yan, R.; Chen, X. Fault-attention generative probabilistic adversarial autoencoder for machine anomaly detection. IEEE Trans. Ind. Informatics
**2020**, 16, 7479–7488. [Google Scholar] [CrossRef] - Nawaratne, R.; Alahakoon, D.; De Silva, D.; Yu, X. Spatiotemporal anomaly detection using deep learning for real-time video surveillance. IEEE Trans. Ind. Inform.
**2019**, 16, 393–402. [Google Scholar] [CrossRef] - Singh, G.; Kapoor, R.; Khosla, A.K. Intelligent anomaly detection video surveillance systems for smart cities. In Driving the Development, Management, and Sustainability of Cognitive Cities; IGI Global: Hershey, PA, USA, 2019; pp. 163–182. [Google Scholar]
- Di Mauro, N.; Ferilli, S. Unsupervised LSTMs-based learning for anomaly detection in highway traffic data. In International Symposium on Methodologies for Intelligent Systems; Springer: Cham, Switzerland, October 2018; pp. 281–290. [Google Scholar]
- Xu, M.; Wu, J.; Wang, H.; Cao, M. Anomaly detection in road networks using sliding-window tensor factorization. IEEE Trans. Intell. Transp. Syst.
**2019**, 20, 4704–4713. [Google Scholar] [CrossRef] - Malini, N.; Pushpa, M. Analysis on credit card fraud identification techniques based on KNN and outlier detection. In Proceedings of the 2017 Third International Conference on Advances in Electrical, Electronics, Information, Communication and Bio-Informatics (AEEICB), Chennai, India, 27–28 February 2017; pp. 255–258. [Google Scholar]
- Popat, R.R.; Chaudhary, J. A survey on credit card fraud detection using machine learning. In Proceedings of the 2018 2nd International Conference on Trends in Electronics and Informatics (ICOEI), Tirunelveli, India, 11–12 May 2018; pp. 1120–1125. [Google Scholar]
- Sheshasaayee, A.; Thomas, S.S. A purview of the impact of supervised learning methodologies on health insurance fraud detection. In Information Systems Design and Intelligent Applications; Springer: Singapore, 2018; pp. 978–984. [Google Scholar]
- Thill, M.; Däubener, S.; Konen, W.; Bäck, T. Anomaly detection in electrocardiogram readings with stacked LSTM networks. In Proceedings of the 19th Conference Information Technologies-Applications and Theory (ITAT 2019), Donovaly, Slovakia, 20–24 September 2019; pp. 17–25. [Google Scholar]
- Rastatter, S.; Moe, T.; Gangopadhyay, A.; Weaver, A. Abnormal Traffic Pattern Detection in Real-Time Financial Transactions (No 827). Available online: https://easychair.org/publications/preprint_open/CKvQ (accessed on 21 July 2021).
- Tam, N.T.; Weidlich, M.; Zheng, B.; Yin, H.; Hung NQ, V.; Stantic, B. From anomaly detection to rumour detection using data streams of social platforms. Proc. VLDB Endow.
**2019**, 12, 1016–1029. [Google Scholar] [CrossRef] [Green Version] - Wu, H.S. A survey of research on anomaly detection for time series. In Proceedings of the 2016 13th International Computer Conference on Wavelet Active Media Technology and Information Processing (ICCWAMTIP), Chengdu, China, 16–18 December 2016; pp. 426–431. [Google Scholar]
- Islam, M.R.; Sultana, N.; Moni, M.A.; Sarkar, P.C.; Rahman, B. A comprehensive survey of time series anomaly detection in online social network data. Int. J. Comput. Appl.
**2017**, 180, 13–22. [Google Scholar] - Cook, A.; Mısırlı, G.; Fan, Z. Anomaly detection for IoT time-series data: A survey. IEEE Internet Things J.
**2019**, 7, 6481–6494. [Google Scholar] [CrossRef] - Blázquez-García, A.; Conde, A.; Mori, U.; Lozano, J.A. A review on outlier/anomaly detection in time series data. arXiv
**2019**, arXiv:2002.04236. [Google Scholar] - Pearson, K. Notes on regression and inheritance in the case of two parents. Proc. R. Soc. Lond.
**1895**, 58, 240–242. [Google Scholar] - Dickey, D.A.; Fuller, W.A. Distribution of the estimators for autoregressive time series with a unit root. J. Am. Stat. Assoc.
**1979**, 74, 427–431. [Google Scholar] - Chui, C.K. An Introduction to Wavelets; Elsevier: Amsterdam, The Netherlands, 2016. [Google Scholar]
- Rumelhart, D.E.; Hinton, G.E.; Williams, R.J. Learning Internal Representations by Error Propagation. Available online: https://apps.dtic.mil/sti/pdfs/ADA164453.pdf (accessed on 21 July 2021).
- Numenta Anomaly Benchmark. Available online: https://github.com/numenta/NAB (accessed on 15 March 2020).
- Xu, S.; Chan, H.K.; Zhang, T. Forecasting the demand of the aviation industry using hybrid time series SARIMA-SVR approach. Transp. Res. Part E Logist. Transp. Rev.
**2019**, 122, 169–180. [Google Scholar] [CrossRef] - Cleveland, R.; Cleveland, W.S.; McRae, J.E.; Terpenning, I.J. STL: A seasonal-trend decomposition procedure based on loess (with discussion). J. Off. Stat.
**1990**, 6, 3–73. [Google Scholar] - Hochreiter, S.; Schmidhuber, J. Long short-term memory. Neural Comput.
**1997**, 9, 1735–1780. [Google Scholar] [CrossRef] - Lee, S.; Kim, H.K. ADSaS: Comprehensive real-time anomaly detection system. In International Workshop on Information Security Applications; Springer: Cham, Switzerland, 2018; pp. 29–41. [Google Scholar]
- Kao, J.B.; Jiang, J.R. Anomaly detection for univariate time series with statistics and deep learning. In Proceedings of the 2019 IEEE Eurasia Conference on IOT, Communication and Engineering (ECICE), Yunlin, Taiwan, 3–6 October 2019; pp. 404–407. [Google Scholar]
- Li, Y.L.; Jiang, J.R. Anomaly detection for non-stationary and non-periodic univariate time series. In Proceedings of the 2020 IEEE Eurasia Conference on IOT, Communication and Engineering (ECICE), Yunlin, Taiwan, 23–25 October 2020; pp. 177–179. [Google Scholar]
- Ruppert, D.; Matteson, D.S. Time series models: Basics. In Statistics and Data Analysis for Financial Engineering; Springer: New York, NY, USA, 2015; pp. 307–360. [Google Scholar]
- Konasani, V.R.; Kadre, S. Time-series analysis and forecasting. In Practical Business Analytics Using SAS; Apress: Berkeley, CA, USA, 2015; pp. 441–507. [Google Scholar]
- Box GE, P.; Jenkins, G.M. Some comments on a paper by Chatfield and Prothero and on a review by Kendall. J. R. Stat. Society. Ser. A
**1973**, 136, 337–352. [Google Scholar] [CrossRef] - Konasani, V.R.; Kadre, S. Multiple regression analysis. In Practical Business Analytics Using SAS; Apress: Berkeley, CA, USA, 2015; pp. 351–400. [Google Scholar]
- Cleveland, W.S.; Loader, C. Smoothing by local regression: Principles and methods. In Statistical Theory and Computational Aspects of Smoothing; Physica-Verlag HD: Heidelberg, Germany, 1996; pp. 10–49. [Google Scholar]
- Heymann, S.; Latapy, M.; Magnien, C. Outskewer: Using skewness to spot outliers in samples and time series. In Proceedings of the 2012 IEEE/ACM International Conference on Advances in Social Networks Analysis and Mining, Istanbul, Turkey, 26–29 August 2012; pp. 527–534. [Google Scholar]
- Alhakami, W.; ALharbi, A.; Bourouis, S.; Alroobaea, R.; Bouguila, N. Network anomaly intrusion detection using a nonparametric Bayesian approach and feature selection. IEEE Access
**2019**, 7, 52181–52190. [Google Scholar] [CrossRef] - Hosseini, A.; Sarrafzadeh, M. Unsupervised prediction of negative health events ahead of time. In Proceedings of the 2019 IEEE EMBS International Conference on Biomedical & Health Informatics (BHI), Chichago, IL, USA, 19–22 May 2019; pp. 1–4. [Google Scholar]

**Figure 4.**Illustration of using the Pearson correlation coefficient of two consecutive equal-sized time windows to check the periodicity of time series.

**Figure 5.**A large global sliding time window and a small local sliding time window of a stationary time series for calculating the ratio of data means.

**Figure 7.**Tri-CAD performance evaluation using NAB NCY Taxi dataset with training dataset size D = 500: (

**a**) the time series and anomaly points and (

**b**) standard anomaly scores and anomaly windows.

**Figure 8.**Tri-CAD performance evaluation using NAB NCY Taxi dataset with training dataset size D = 1000: (

**a**) the time series and anomaly points and (

**b**) standard anomaly scores and anomaly windows.

**Figure 9.**Tri-CAD performance evaluation using NAB AWS CPU Utilization dataset with training dataset size D = 500: (

**a**) the time series and anomaly points and (

**b**) standard anomaly scores and anomaly windows.

**Figure 10.**Tri-CAD performance evaluation using NAB AWS CPU Utilization dataset with training dataset size D = 1000: (

**a**) the time series and anomaly points and (

**b**) standard anomaly scores and anomaly windows.

**Figure 11.**Tri-CAD performance evaluation using NAB Machine Temperature dataset with training dataset size D = 1000 and WT window size ws = 30: (

**a**) the standardized time series and anomaly points and (

**b**) standard anomaly scores and anomaly windows.

**Figure 12.**Tri-CAD performance evaluation using NAB Machine Temperature dataset with training dataset size D = 2000 and WT window size ws = 30: (

**a**) the standardized time series and anomaly points and (

**b**) standard anomaly scores and anomaly windows.

**Figure 13.**Tri-CAD performance evaluation using NAB Machine Temperature dataset with training dataset size D = 1000 and WT window size ws = 60: (

**a**) the standardized time series and anomaly points and (

**b**) standard anomaly scores and anomaly windows.

**Figure 14.**Tri-CAD performance evaluation using NAB Machine Temperature dataset with training dataset size D = 2000 and WT window size ws = 60: (

**a**) the standardized time series and anomaly points and (

**b**) standard anomaly scores and anomaly windows.

Time Series | Class | Fixed Window Size (fws) | Metrics | STL only | SARIMA only | LSTM only | LSTM with STL | ADSaS | Proposed Framework Tri-CAD |
---|---|---|---|---|---|---|---|---|---|

NAB NYC Taxi | Class 1 | 206 | Precision Recall F _{1}-score | 0.533 0.889 0.667 | 0.000 0.000 0.000 | 0.176 0.333 0.231 | 0.161 1.000 0.277 | 1.000 1.000 1.000 | 1.0001.0001.000 |

NAB CPU Utilization | Class 2 | 200 | Precision Recall F _{1}-score | 0.800 1.000 0.889 | 0.143 0.250 0.182 | 0.833 1.000 0.909 | 0.308 1.000 0.471 | 1.000 0.250 0.400 | 1.0001.0001.000 |

NAB Machine Temperature | Class 3 | 566 | Precision Recall F _{1}-score | 0.250 0.222 0.235 | 0.000 0.000 0.000 | 0.049 0.222 0.080 | 0.059 0.625 0.108 | 1.000 0.500 0.667 | 1.0001.0001.000 |

Publisher’s Note: MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations. |

© 2021 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).

## Share and Cite

**MDPI and ACS Style**

Jiang, J.-R.; Kao, J.-B.; Li, Y.-L.
Semi-Supervised Time Series Anomaly Detection Based on Statistics and Deep Learning. *Appl. Sci.* **2021**, *11*, 6698.
https://doi.org/10.3390/app11156698

**AMA Style**

Jiang J-R, Kao J-B, Li Y-L.
Semi-Supervised Time Series Anomaly Detection Based on Statistics and Deep Learning. *Applied Sciences*. 2021; 11(15):6698.
https://doi.org/10.3390/app11156698

**Chicago/Turabian Style**

Jiang, Jehn-Ruey, Jian-Bin Kao, and Yu-Lin Li.
2021. "Semi-Supervised Time Series Anomaly Detection Based on Statistics and Deep Learning" *Applied Sciences* 11, no. 15: 6698.
https://doi.org/10.3390/app11156698