| Title: | A Unified Time Series Event Detection Framework |
|---|---|
| Description: | By analyzing time series, it is possible to observe significant changes in the behavior of observations that frequently characterize events. Events present themselves as anomalies, change points, or motifs. In the literature, there are several methods for detecting events. However, searching for a suitable time series method is a complex task, especially considering that the nature of events is often unknown. This work presents Harbinger, a framework for integrating and analyzing event detection methods. Harbinger contains several state-of-the-art methods described in Salles et al. (2020) <doi:10.5753/sbbd.2020.13626>. |
| Authors: | Eduardo Ogasawara [aut, ths, cre]
 ,
Antonio Castro [aut],
Antonio Mello [aut],
Ellen Paixão [aut],
Fernando Fraga [aut],
Heraldo Borges [aut],
Janio Lima [aut],
Jessica Souza [aut],
Lais Baroni [aut],
Lucas Tavares [aut],
Rebecca Salles [aut],
Diego Carvalho [aut],
Eduardo Bezerra [aut],
Rafaelli Coutinho [aut],
Esther Pacitti [aut],
Fabio Porto [aut],
Federal Center for Technological Education of Rio de Janeiro (CEFET/RJ)
[cph] |
| Maintainer: | Eduardo Ogasawara <[email protected]> |
| License: | MIT + file LICENSE |
| Version: | 1.0.787 |
| Built: | 2024-11-11 05:48:19 UTC |
| Source: | https://github.com/cefet-rj-dal/harbinger |
Event detection using a fitted Harbinger model
detect(obj, ...)detect(obj, ...)
obj |
harbinger object |
... |
optional arguments. |
a data frame with the index of observations and if they are identified or not as an event, and their type
# See ?hanc_ml for an example of anomaly detection using machine learning classification # See ?hanr_arima for an example of anomaly detection using ARIMA # See ?hanr_fbiad for an example of anomaly detection using FBIAD # See ?hanr_garch for an example of anomaly detection using GARCH # See ?hanr_kmeans for an example of anomaly detection using kmeans clustering # See ?hanr_ml for an example of anomaly detection using machine learning regression # See ?hanr_cf_arima for an example of change point detection using ARIMA # See ?hanr_cf_ets for an example of change point detection using ETS # See ?hanr_cf_lr for an example of change point detection using linear regression # See ?hanr_cf_garch for an example of change point detection using GARCH # See ?hanr_cf_scp for an example of change point detection using the seminal algorithm # See ?hmo_sax for an example of motif discovery using SAX # See ?hmu_pca for an example of anomaly detection in multivariate time series using PCA# See ?hanc_ml for an example of anomaly detection using machine learning classification # See ?hanr_arima for an example of anomaly detection using ARIMA # See ?hanr_fbiad for an example of anomaly detection using FBIAD # See ?hanr_garch for an example of anomaly detection using GARCH # See ?hanr_kmeans for an example of anomaly detection using kmeans clustering # See ?hanr_ml for an example of anomaly detection using machine learning regression # See ?hanr_cf_arima for an example of change point detection using ARIMA # See ?hanr_cf_ets for an example of change point detection using ETS # See ?hanr_cf_lr for an example of change point detection using linear regression # See ?hanr_cf_garch for an example of change point detection using GARCH # See ?hanr_cf_scp for an example of change point detection using the seminal algorithm # See ?hmo_sax for an example of motif discovery using SAX # See ?hmu_pca for an example of anomaly detection in multivariate time series using PCA
A list of time series for anomaly detection
simple: a simple synthetic time series
contextual: a contextual synthetic time series
simple: a trend synthetic time series
trend: a simple synthetic time series
multiple: a multiple anomalies synthetic time series
sequence: a sequence synthetic time series
tt: a train-test synthetic time series
tt_warped: a warped train-test synthetic time series
#'
data(examples_anomalies)data(examples_anomalies)
A list of time series for anomaly detection.
data(examples_anomalies) serie <- examples_anomalies$simpledata(examples_anomalies) serie <- examples_anomalies$simple
A list of time series for change point
simple: a simple synthetic time series
sinusoidal: a sinusoidal synthetic time series
incremental: a incremental synthetic time series
abrupt: a abrupt synthetic time series
volatility: a volatility synthetic time series
#'
data(examples_changepoints)data(examples_changepoints)
A list of time series for change point detection.
data(examples_changepoints) serie <- examples_changepoints$simpledata(examples_changepoints) serie <- examples_changepoints$simple
A list of time series for event detection
nonstationarity: a synthetic nonstationarity time series
global_temperature_yearly: yearly global temperature of the world
global_temperature_monthly: monthly global temperature of the world
multidimensional: multidimensional time series with a change point
seattle_week: Seattle weakly temperature in 2019
seattle_daily: Seattle daily temperature in 2019
#'
data(examples_harbinger)data(examples_harbinger)
A list of time series.
data(examples_harbinger) serie <- examples_harbinger$seattle_dailydata(examples_harbinger) serie <- examples_harbinger$seattle_daily
A list of time series for change point
simple: a simple synthetic time series
mitdb100: sample of mitdb 100 time series
mitdb102: sample of mitdb 102 time series
#'
data(examples_motifs)data(examples_motifs)
A list of time series for motif discovery.
data(examples_motifs) serie <- examples_motifs$simpledata(examples_motifs) serie <- examples_motifs$simple
Anomaly detector using autoencoder
han_autoencoder(input_size, encode_size)han_autoencoder(input_size, encode_size)
input_size |
Establish the input size for the autoencoder anomaly detector. It is the size of the output also. |
encode_size |
The encode size for the autoencoder. |
han_autoencoder object histogram based method to detect anomalies in time series. Bins with smaller amount of observations are considered anomalies. Values below first bin or above last bin are also considered anomalies.>.
# setting up time series regression model #Use the same example of hanr_fbiad changing the constructor to: model <- han_autoencoder(3,1)# setting up time series regression model #Use the same example of hanr_fbiad changing the constructor to: model <- han_autoencoder(3,1)
Anomaly detection using daltoolbox classification. A training and test set should be used. The training set must contain labeled events. A set of preconfigured of classification methods are described in https://cefet-rj-dal.github.io/daltoolbox/. They include: cla_majority, cla_dtree, cla_knn, cla_mlp, cla_nb, cla_rf, cla_svm
hanc_ml(model)hanc_ml(model)
model |
DALToolbox classification model |
hanc_ml object
library(daltoolbox) #loading the example database data(examples_anomalies) #Using example tt dataset <- examples_anomalies$tt dataset$event <- factor(dataset$event, labels=c("FALSE", "TRUE")) slevels <- levels(dataset$event) # separating into training and test train <- dataset[1:80,] test <- dataset[-(1:80),] # normalizing the data norm <- minmax() norm <- fit(norm, train) train_n <- transform(norm, train) # establishing decision tree method model <- hanc_ml(cla_dtree("event", slevels)) # fitting the model model <- fit(model, train_n) # evaluating the detections during testing test_n <- transform(norm, test) detection <- detect(model, test_n) print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_anomalies) #Using example tt dataset <- examples_anomalies$tt dataset$event <- factor(dataset$event, labels=c("FALSE", "TRUE")) slevels <- levels(dataset$event) # separating into training and test train <- dataset[1:80,] test <- dataset[-(1:80),] # normalizing the data norm <- minmax() norm <- fit(norm, train) train_n <- transform(norm, train) # establishing decision tree method model <- hanc_ml(cla_dtree("event", slevels)) # fitting the model model <- fit(model, train_n) # evaluating the detections during testing test_n <- transform(norm, test) detection <- detect(model, test_n) print(detection[(detection$event),])
Anomaly detection using DTW The DTW is applied to the time series. When seq equals one, observations distant from the closest centroids are labeled as anomalies. When seq is grater than one, sequences distant from the closest centroids are labeled as discords. It wraps the tsclust presented in the dtwclust library.
hanct_dtw(seq = 1, centers = NA)hanct_dtw(seq = 1, centers = NA)
seq |
sequence size |
centers |
number of centroids |
hanct_dtw object
library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series regression model model <- hanct_dtw() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series regression model model <- hanct_dtw() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Anomaly detection using kmeans The kmeans is applied to the time series. When seq equals one, observations distant from the closest centroids are labeled as anomalies. When seq is grater than one, sequences distant from the closest centroids are labeled as discords. It wraps the kmeans presented in the stats library.
hanct_kmeans(seq = 1, centers = NA)hanct_kmeans(seq = 1, centers = NA)
seq |
sequence size |
centers |
number of centroids |
hanct_kmeans object
library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series regression model model <- hanct_kmeans() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series regression model model <- hanct_kmeans() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Anomaly detection using ARIMA The ARIMA model adjusts to the time series. Observations distant from the model are labeled as anomalies. It wraps the ARIMA model presented in the forecast library.
hanr_arima()hanr_arima()
hanr_arima object
library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series regression model model <- hanr_arima() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series regression model model <- hanr_arima() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Anomaly detection using EMD The EMD model adjusts to the time series. Observations distant from the model are labeled as anomalies. It wraps the EMD model presented in the hht library.
hanr_emd(noise = 0.1, trials = 5)hanr_emd(noise = 0.1, trials = 5)
noise |
nosie |
trials |
trials |
hanr_emd object
library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series emd detector model <- hanr_emd() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series emd detector model <- hanr_emd() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Anomaly detector using FBIAD
hanr_fbiad(sw_size = 30)hanr_fbiad(sw_size = 30)
sw_size |
Window size for FBIAD |
hanr_fbiad object Forward and Backward Inertial Anomaly Detector (FBIAD) detects anomalies in time series. Anomalies are observations that differ from both forward and backward time series inertia doi:10.1109/IJCNN55064.2022.9892088.
library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series regression model model <- hanr_fbiad() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series regression model model <- hanr_fbiad() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Anomaly detection using FFT The FFT model adjusts to the time series. Observations distant from the model are labeled as anomalies. It wraps the FFT model presented in the stats library.
hanr_fft()hanr_fft()
hanr_fft object
library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series fft detector model <- hanr_fft() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series fft detector model <- hanr_fft() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Anomaly detection using GARCH The GARCH model adjusts to the time series. Observations distant from the model are labeled as anomalies. It wraps the ugarch model presented in the rugarch library.
hanr_garch()hanr_garch()
hanr_garch object
library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series regression model model <- hanr_garch() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series regression model model <- hanr_garch() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Anomaly detector using histogram
hanr_histogram(density_threshold = 0.05)hanr_histogram(density_threshold = 0.05)
density_threshold |
It is the minimum frequency for a bin to not be considered an anomaly. Default value is 5%. |
hanr_histogram object histogram based method to detect anomalies in time series. Bins with smaller amount of observations are considered anomalies. Values below first bin or above last bin are also considered anomalies.>.
library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series regression model model <- hanr_histogram() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series regression model model <- hanr_histogram() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Anomaly detection using daltoolbox regression The regression model adjusts to the time series. Observations distant from the model are labeled as anomalies. A set of preconfigured regression methods are described in https://cefet-rj-dal.github.io/daltoolbox/. They include: ts_elm, ts_conv1d, ts_lstm, ts_mlp, ts_rf, ts_svm
hanr_ml(model, sw_size = 15)hanr_ml(model, sw_size = 15)
model |
DALToolbox regression model |
sw_size |
sliding window size |
hanr_ml object
library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series regression model model <- hanr_ml(ts_elm(ts_norm_gminmax(), input_size=4, nhid=3, actfun="purelin")) # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series regression model model <- hanr_ml(ts_elm(ts_norm_gminmax(), input_size=4, nhid=3, actfun="purelin")) # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Anomaly and change point detection using RED The RED model adjusts to the time series. Observations distant from the model are labeled as anomalies. It wraps the EMD model presented in the hht library.
hanr_red(sw_size = 30, noise = 0.001, trials = 5)hanr_red(sw_size = 30, noise = 0.001, trials = 5)
sw_size |
sliding window size (default 30) |
noise |
noise |
trials |
trials |
hanr_red object
library(daltoolbox) library(zoo) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series emd detector model <- hanr_red() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) library(zoo) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series emd detector model <- hanr_red() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Anomaly detection using REMD The EMD model adjusts to the time series. Observations distant from the model are labeled as anomalies. It wraps the EMD model presented in the forecast library.
hanr_remd(noise = 0.1, trials = 5)hanr_remd(noise = 0.1, trials = 5)
noise |
nosie |
trials |
trials |
hanr_remd object
library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series emd detector model <- hanr_remd() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series emd detector model <- hanr_remd() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Anomaly detection using Wavelet The Wavelet model adjusts to the time series. Observations distant from the model are labeled as anomalies. It wraps the Wavelet model presented in the stats library.
hanr_wavelet(filter = "haar")hanr_wavelet(filter = "haar")
filter |
Availables wavelet filters: haar, d4, la8, bl14, c6 |
hanr_wavelet object
library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series fft detector model <- hanr_wavelet() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_anomalies) #Using simple example dataset <- examples_anomalies$simple head(dataset) # setting up time series fft detector model <- hanr_wavelet() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Evaluation of event detection (traditional hard evaluation)
har_eval()har_eval()
har_eval object
library(daltoolbox) #loading the example database data(examples_anomalies) dataset <- examples_anomalies$simple head(dataset) # setting up time change point using GARCH model <- hcp_garch() # fitting the model model <- fit(model, dataset$serie) # making detections detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),]) # evaluating the detections evaluation <- evaluate(har_eval(), detection$event, dataset$event) print(evaluation$confMatrix) # ploting the results grf <- har_plot(model, dataset$serie, detection, dataset$event) plot(grf)library(daltoolbox) #loading the example database data(examples_anomalies) dataset <- examples_anomalies$simple head(dataset) # setting up time change point using GARCH model <- hcp_garch() # fitting the model model <- fit(model, dataset$serie) # making detections detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),]) # evaluating the detections evaluation <- evaluate(har_eval(), detection$event, dataset$event) print(evaluation$confMatrix) # ploting the results grf <- har_plot(model, dataset$serie, detection, dataset$event) plot(grf)
Evaluation of event detection using SoftED doi:10.48550/arXiv.2304.00439
har_eval_soft(sw_size = 15)har_eval_soft(sw_size = 15)
sw_size |
tolerance window size |
har_eval_soft object
library(daltoolbox) #loading the example database data(examples_anomalies) #Using the simple dataset <- examples_anomalies$simple head(dataset) # setting up time change point using GARCH model <- hcp_garch() # fitting the model model <- fit(model, dataset$serie) # making detections detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),]) # evaluating the detections evaluation <- evaluate(har_eval_soft(), detection$event, dataset$event) print(evaluation$confMatrix) # ploting the results grf <- har_plot(model, dataset$serie, detection, dataset$event) plot(grf)library(daltoolbox) #loading the example database data(examples_anomalies) #Using the simple dataset <- examples_anomalies$simple head(dataset) # setting up time change point using GARCH model <- hcp_garch() # fitting the model model <- fit(model, dataset$serie) # making detections detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),]) # evaluating the detections evaluation <- evaluate(har_eval_soft(), detection$event, dataset$event) print(evaluation$confMatrix) # ploting the results grf <- har_plot(model, dataset$serie, detection, dataset$event) plot(grf)
It accepts as harbinger, a time series, a data.frame of events, a parameter to mark the detected change points, a threshold for the y-axis and an index for the time series
har_plot( obj, serie, detection, event = NULL, mark.cp = TRUE, ylim = NULL, idx = NULL, pointsize = 0.5, colors = c("green", "blue", "red", "purple") )har_plot( obj, serie, detection, event = NULL, mark.cp = TRUE, ylim = NULL, idx = NULL, pointsize = 0.5, colors = c("green", "blue", "red", "purple") )
obj |
harbinger detector |
serie |
time series |
detection |
detection |
event |
events |
mark.cp |
show change points |
ylim |
limits for y-axis |
idx |
labels for x observations |
pointsize |
default point size |
colors |
default colors for event detection: green is TP, blue is FN, red is FP, purple means observations that are part of a sequence. |
A time series plot with marked events
library(daltoolbox) #loading the example database data(examples_anomalies) #Using the simple time series dataset <- examples_anomalies$simple head(dataset) # setting up time change point using GARCH model <- hanr_arima() # fitting the model model <- fit(model, dataset$serie) # making detections detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),]) # evaluating the detections evaluation <- evaluate(har_eval_soft(), detection$event, dataset$event) print(evaluation$confMatrix) # ploting the results grf <- har_plot(model, dataset$serie, detection, dataset$event) plot(grf)library(daltoolbox) #loading the example database data(examples_anomalies) #Using the simple time series dataset <- examples_anomalies$simple head(dataset) # setting up time change point using GARCH model <- hanr_arima() # fitting the model model <- fit(model, dataset$serie) # making detections detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),]) # evaluating the detections evaluation <- evaluate(har_eval_soft(), detection$event, dataset$event) print(evaluation$confMatrix) # ploting the results grf <- har_plot(model, dataset$serie, detection, dataset$event) plot(grf)
Ancestor class for time series event detection
harbinger()harbinger()
Harbinger object
# See ?hanc_ml for an example of anomaly detection using machine learning classification # See ?hanr_arima for an example of anomaly detection using ARIMA # See ?hanr_fbiad for an example of anomaly detection using FBIAD # See ?hanr_garch for an example of anomaly detection using GARCH # See ?hanr_kmeans for an example of anomaly detection using kmeans clustering # See ?hanr_ml for an example of anomaly detection using machine learning regression # See ?hanr_cf_arima for an example of change point detection using ARIMA # See ?hanr_cf_ets for an example of change point detection using ETS # See ?hanr_cf_lr for an example of change point detection using linear regression # See ?hanr_cf_garch for an example of change point detection using GARCH # See ?hanr_cf_scp for an example of change point detection using the seminal algorithm # See ?hmo_sax for an example of motif discovery using SAX # See ?hmu_pca for an example of anomaly detection in multivariate time series using PCA# See ?hanc_ml for an example of anomaly detection using machine learning classification # See ?hanr_arima for an example of anomaly detection using ARIMA # See ?hanr_fbiad for an example of anomaly detection using FBIAD # See ?hanr_garch for an example of anomaly detection using GARCH # See ?hanr_kmeans for an example of anomaly detection using kmeans clustering # See ?hanr_ml for an example of anomaly detection using machine learning regression # See ?hanr_cf_arima for an example of change point detection using ARIMA # See ?hanr_cf_ets for an example of change point detection using ETS # See ?hanr_cf_lr for an example of change point detection using linear regression # See ?hanr_cf_garch for an example of change point detection using GARCH # See ?hanr_cf_scp for an example of change point detection using the seminal algorithm # See ?hmo_sax for an example of motif discovery using SAX # See ?hmu_pca for an example of anomaly detection in multivariate time series using PCA
Change-point detection method that focus on identify one change point in mean/variance doi:10.1093/biomet/57.1.1. It wraps the amoc implementation available in the changepoint library.
hcp_amoc()hcp_amoc()
hcp_amoc object
library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_amoc() # fitting the model model <- fit(model, dataset$serie) # execute the detection method detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_amoc() # fitting the model model <- fit(model, dataset$serie) # execute the detection method detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Change-point detection method that focus on identify change points in mean/variance doi:10.2307/2529204. It wraps the BinSeg implementation available in the changepoint library.
hcp_binseg(Q = 2)hcp_binseg(Q = 2)
Q |
The maximum number of change-points to search for using the BinSeg method |
hcp_binseg object
library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_binseg() # fitting the model model <- fit(model, dataset$serie) # execute the detection method detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_binseg() # fitting the model model <- fit(model, dataset$serie) # execute the detection method detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Change-point detection is related to event/trend change detection. Change Finder ARIMA detects change points based on deviations relative to ARIMA model doi:10.1109/TKDE.2006.1599387. It wraps the ARIMA model presented in the forecast library.
hcp_cf_arima(sw_size = NULL)hcp_cf_arima(sw_size = NULL)
sw_size |
Sliding window size |
hcp_cf_arima object
library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_cf_arima() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_cf_arima() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Change-point detection is related to event/trend change detection. Change Finder ETS detects change points based on deviations relative to trend component (T), a seasonal component (S), and an error term (E) model doi:10.1109/TKDE.2006.1599387. It wraps the ETS model presented in the forecast library.
hcp_cf_ets(sw_size = 7)hcp_cf_ets(sw_size = 7)
sw_size |
Sliding window size |
hcp_cf_ets object
library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_cf_ets() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_cf_ets() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Change-point detection is related to event/trend change detection. Change Finder LR detects change points based on deviations relative to linear regression model doi:10.1109/TKDE.2006.1599387.
hcp_cf_lr(sw_size = 30)hcp_cf_lr(sw_size = 30)
sw_size |
Sliding window size |
hcp_cf_lr object
library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_cf_lr() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_cf_lr() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Change-point detection method that focus on identifying structural changes doi:10.18637/jss.v007.i02. It wraps the Fstats and breakpoints implementation available in the strucchange library.
hcp_chow()hcp_chow()
hcp_chow object
library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_chow() # fitting the model model <- fit(model, dataset$serie) # execute the detection method detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_chow() # fitting the model model <- fit(model, dataset$serie) # execute the detection method detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Change-point detection is related to event/trend change detection. Change Finder GARCH detects change points based on deviations relative to linear regression model doi:10.1109/TKDE.2006.1599387. It wraps the GARCH model presented in the rugarch library.
hcp_garch(sw_size = 5)hcp_garch(sw_size = 5)
sw_size |
Sliding window size |
hcp_garch object
library(daltoolbox) #loading the example database data(examples_changepoints) #Using volatility example dataset <- examples_changepoints$volatility head(dataset) # setting up change point method model <- hcp_garch() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_changepoints) #Using volatility example dataset <- examples_changepoints$volatility head(dataset) # setting up change point method model <- hcp_garch() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
GFT detection method focuses on identifying structural changes doi:10.18637/jss.v007.i02. It wraps the breakpoints implementation available in the strucchange library.
hcp_gft()hcp_gft()
hcp_chow object
library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_gft() # fitting the model model <- fit(model, dataset$serie) # execute the detection method detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_gft() # fitting the model model <- fit(model, dataset$serie) # execute the detection method detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Change-point detection method that focus on identifying multiple exact change points in mean/variance doi:10.1080/01621459.2012.737745. It wraps the BinSeg implementation available in the changepoint library.
hcp_pelt()hcp_pelt()
hcp_pelt object
library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_pelt() # fitting the model model <- fit(model, dataset$serie) # execute the detection method detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_pelt() # fitting the model model <- fit(model, dataset$serie) # execute the detection method detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Anomaly and change point detection using RED The RED model adjusts to the time series. Observations distant from the model are labeled as anomalies. It wraps the EMD model presented in the hht library.
hcp_red( sw_size = 30, noise = 0.001, trials = 5, red_cp = TRUE, volatility_cp = TRUE, trend_cp = TRUE )hcp_red( sw_size = 30, noise = 0.001, trials = 5, red_cp = TRUE, volatility_cp = TRUE, trend_cp = TRUE )
sw_size |
sliding window size (default 30) |
noise |
noise |
trials |
trials |
red_cp |
red change point |
volatility_cp |
volatility change point |
trend_cp |
trend change point |
hcp_red object
library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_red() # fitting the model model <- fit(model, dataset$serie) # execute the detection method detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_red() # fitting the model model <- fit(model, dataset$serie) # execute the detection method detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Change-point detection is related to event/trend change detection. Seminal change point detects change points based on deviations of linear regression models adjusted with and without a central observation in each sliding window <10.1145/312129.312190>.
hcp_scp(sw_size = 30)hcp_scp(sw_size = 30)
sw_size |
Sliding window size |
hcp_scp object
library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_scp() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method model <- hcp_scp() # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Discord discovery using Matrix Profile doi:10.32614/RJ-2020-021
hdis_mp(mode = "stamp", w, qtd)hdis_mp(mode = "stamp", w, qtd)
mode |
mode of computing distance between sequences. Available options include: "stomp", "stamp", "simple", "mstomp", "scrimp", "valmod", "pmp" |
w |
word size |
qtd |
number of occurrences to be classified as discords |
hdis_mp object
library(daltoolbox) #loading the example database data(examples_motifs) #Using sequence example dataset <- examples_motifs$simple head(dataset) # setting up discord discovery method model <- hdis_mp("stamp", 4, 3) # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_motifs) #Using sequence example dataset <- examples_motifs$simple head(dataset) # setting up discord discovery method model <- hdis_mp("stamp", 4, 3) # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Discord discovery using SAX doi:10.1007/s10618-007-0064-z
hdis_sax(a, w, qtd = 2)hdis_sax(a, w, qtd = 2)
a |
alphabet size |
w |
word size |
qtd |
number of occurrences to be classified as discords |
hdis_sax object
library(daltoolbox) #loading the example database data(examples_motifs) #Using sequence example dataset <- examples_motifs$simple head(dataset) # setting up discord discovery method model <- hdis_sax(26, 3, 3) # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_motifs) #Using sequence example dataset <- examples_motifs$simple head(dataset) # setting up discord discovery method model <- hdis_sax(26, 3, 3) # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Motif discovery using Matrix Profile doi:10.32614/RJ-2020-021
hmo_mp(mode = "stamp", w, qtd)hmo_mp(mode = "stamp", w, qtd)
mode |
mode of computing distance between sequences. Available options include: "stomp", "stamp", "simple", "mstomp", "scrimp", "valmod", "pmp" |
w |
word size |
qtd |
number of occurrences to be classified as motifs |
hmo_mp object
library(daltoolbox) #loading the example database data(examples_motifs) #Using sequence example dataset <- examples_motifs$simple head(dataset) # setting up motif discovery method model <- hmo_mp("stamp", 4, 3) # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_motifs) #Using sequence example dataset <- examples_motifs$simple head(dataset) # setting up motif discovery method model <- hmo_mp("stamp", 4, 3) # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Motif discovery using SAX doi:10.1007/s10618-007-0064-z
hmo_sax(a, w, qtd = 2)hmo_sax(a, w, qtd = 2)
a |
alphabet size |
w |
word size |
qtd |
number of occurrences to be classified as motifs |
hmo_sax object
library(daltoolbox) #loading the example database data(examples_motifs) #Using sequence example dataset <- examples_motifs$simple head(dataset) # setting up motif discovery method model <- hmo_sax(26, 3, 3) # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_motifs) #Using sequence example dataset <- examples_motifs$simple head(dataset) # setting up motif discovery method model <- hmo_sax(26, 3, 3) # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Motif discovery using xsax doi:10.1007/s10618-007-0064-z
hmo_xsax(a, w, qtd)hmo_xsax(a, w, qtd)
a |
alphabet size |
w |
word size |
qtd |
number of occurrences to be classified as motifs |
hmo_xsax object
library(daltoolbox) #loading the example database data(examples_motifs) #Using sequence example dataset <- examples_motifs$simple head(dataset) # setting up motif discovery method model <- hmo_xsax(37, 3, 3) # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])library(daltoolbox) #loading the example database data(examples_motifs) #Using sequence example dataset <- examples_motifs$simple head(dataset) # setting up motif discovery method model <- hmo_xsax(37, 3, 3) # fitting the model model <- fit(model, dataset$serie) detection <- detect(model, dataset$serie) # filtering detected events print(detection[(detection$event),])
Multivariate anomaly detector using PCA doi:10.1016/0098-3004(93)90090-R
hmu_pca()hmu_pca()
hmu_pca object
library(daltoolbox) #loading the example database data(examples_harbinger) #Using the time series 9 dataset <- examples_harbinger$multidimensional head(dataset) # establishing hmu_pca method model <- hmu_pca() # fitting the model using the two columns of the dataset model <- fit(model, dataset[,1:2]) # making detections detection <- detect(model, dataset[,1:2]) # filtering detected events print(detection[(detection$event),]) # evaluating the detections evaluation <- evaluate(model, detection$event, dataset$event) print(evaluation$confMatrix)library(daltoolbox) #loading the example database data(examples_harbinger) #Using the time series 9 dataset <- examples_harbinger$multidimensional head(dataset) # establishing hmu_pca method model <- hmu_pca() # fitting the model using the two columns of the dataset model <- fit(model, dataset[,1:2]) # making detections detection <- detect(model, dataset[,1:2]) # filtering detected events print(detection[(detection$event),]) # evaluating the detections evaluation <- evaluate(model, detection$event, dataset$event) print(evaluation$confMatrix)
The mas() function returns a simple moving average smoother of the
provided time series.
mas(x, order)mas(x, order)
x |
A numeric vector or univariate time series. |
order |
Order of moving average smoother. |
The moving average smoother transformation is given by
where k=order, t assume
values in the range 1:(n-k+1), and n=length(x). See also the
ma of the forecast package.
Numerical time series of length length(x)-order+1 containing
the simple moving average smoothed values.
R.H. Shumway and D.S. Stoffer, 2010, Time Series Analysis and Its Applications: With R Examples. 3rd ed. 2011 edition ed. New York, Springer.
#loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method ma <- mas(dataset$serie, 5)#loading the example database data(examples_changepoints) #Using simple example dataset <- examples_changepoints$simple head(dataset) # setting up change point method ma <- mas(dataset$serie, 5)
SAX
trans_sax(alpha)trans_sax(alpha)
alpha |
alphabet |
obj
library(daltoolbox) vector <- 1:52 model <- trans_sax(alpha = 26) model <- fit(model, vector) xvector <- transform(model, vector) print(xvector)library(daltoolbox) vector <- 1:52 model <- trans_sax(alpha = 26) model <- fit(model, vector) xvector <- transform(model, vector) print(xvector)
XSAX
trans_xsax(alpha)trans_xsax(alpha)
alpha |
alphabet |
obj
library(daltoolbox) vector <- 1:52 model <- trans_xsax(alpha = 52) model <- fit(model, vector) xvector <- transform(model, vector) print(xvector)library(daltoolbox) vector <- 1:52 model <- trans_xsax(alpha = 52) model <- fit(model, vector) xvector <- transform(model, vector) print(xvector)