vc1492a
commented
4 years ago I've started playing around with an approach that utilizes the absolute errors and an examination of the previous N observations with a simple strategy of doing the following for each observation in the absolute errors:
1: Calculate the euclidean distance from this absolute error value to the previous N values, and collect those distances into an array. 2: For each of those distances, take the log transform. 3: Take the minimum distance value in the array as the distance value for the observation.
The idea borrows off of a previous approach my colleague Ian Colwell was using for anomaly detection for the Mars Science Laboratory (MSL), and aims to highlight localized anomalies over global ones. My desire for this sort of approach was that localized anomalies are what we are interested in here, and not larger, more global shifts in the telemetry. This sort of approach also accounts for model drift to some degree.
It remains to be seen whether this sort of approach will be ideal for this use case, but here's the initial results. The first image shows the approach's values for the day prior to the earthquake (a normal day) and the second image for the day of the earthquake. This approach seems to pick up on the anomaly, but there's still work to do in determining how to set a threshold for classification and applying it across different satellites etc.
hamlinliu17
The central component of this approach to anomaly detection is the manner in which model residuals (errors) are analyzed / handled for classifying which time periods may be considered anomalous. Once our residuals have patterns we can expect / work with,
There's a lot of work out there on this topic, and it's something my colleagues and I explored in the past, too (non-parametric dynamic thresholding). But many approaches assume Gaussian distributions and certain patterns in the errors (dynamic thresholding, as an example, would not work well when residuals are high on the front and tail of the predicted values).