Forecasting vs non-forecasting predition for time series anomaly detection

Question

I have got the objective of implementing a uni/multivariate online anomaly detection system.

After multiple days of research, I could collect many ways to achieve this (Eg. moving average solutions such as ARIMA, Space state solutions as Kalman filters, Holt-Winters double/triple exponential smoothing, CUSUM, one-class SVM, deep learning sliding-windows autoencoding approaches, deep learning using autoregressive neural networks, etc).

In general, anomaly detection on time series works with a threshold on the deviation originated from the difference between a predicted point or group of points of the original timeseries and the predicted one.

Attending to this prediction, this can happen in:

a forecasting way (such as ARIMA would do, or you could achieve this result also by using a LSTM deep learning model),
or in a non-forecasting way (eg. denoising with an autoencoder would do, or analyzing fragments STL+ESD used by Twitter).

Which are the (dis)advantages of each one, attending to the objective I mentioned?

drops · Answer

I had the same question and ultimately tried an LSTM forecaster and LSTM autoencoder. For me, the choice of forecaster vs autoencoder had effects on the following two points:

Seasonal Pattern:
if you have a seasonal pattern (e.g. weekdays vs weekend) in your data, and the timeframe you are looking at has the pattern -- but is shifted by e.g. a day, you are likely to find that outlier with the Forecaster, but not as likely with Autoencoder.
This Disadvantage of the Autoencoder can be circumvented by also feeding in the weekday and time for each datapoint.

Needed Datapoints:
With the Autoencoder, you don't need datapoints before the timeframe you want to examine. You can just take the series you are interested in and give it to your model.

Forecasting vs non-forecasting predition for time series anomaly detection

One Answer

Add your own answers!

Ask a Question