Appl Intell
DOI 10.1007/s10489-017-1017-x
Anomaly detection using piecewise aggregate approximation
in the amplitude domain
Huorong Ren1 · Xiujuan Liao1 · Zhiwu Li1,2 · Abdulrahman AI-Ahmari3
© Springer Science+Business Media, LLC 2017
Abstract Anomaly detection has received much attention
due to its various applications. Generally, the first step to
discover anomalies is a data representation method which
reduces dimensionality as well as preserves key informa-
tion. Anomaly detection based on real-value representation
methods is meaningful for its convenience in numeric oper-
ation. A typical real-value representation method is the
Piecewise Aggregate Approximation (PAA) that is simple
and intuitive by capturing mean values of segments in a
sequence. However, if segments are same or similar in their
average values but different in their oscillation amplitudes,
the PAA method is ineffective to describe a sequence com-
posed of such segments. To address this issue, we propose
a representation method called the Piecewise Aggregate
Approximation in the Amplitude Domain (AD-PAA). For
discovering anomalies, a sequence is partitioned into subse-
quences by a sliding window firstly. Then in the AD-PAA
method, a subsequence is divided into equal size subsections
according to the amplitude domain. With mean values of
subsections computed, the amplitude oscillation of a subse-
quence is embodied effectively. When the AD-PAA method
is applied to approximate subsequences, the AD-PAA rep-
resentation of a sequence is constructed. Anomalies are
 Huorong Ren
rszhjin@126.com
1 School of Electro-Mechanical Engineering, Xidian University,
Xi’an 710071, China
2 Institute of Systems Engineering, Macau University
of Science and Technology, Taipa 999078, Macau, China
3 Industrial Engineering Department, College of Engineering,
King Saud University, Riyadh 11421, Saudi Arabia
determined by anomaly scores that are based on similarities
among representation results. Experimental results on vari-
ous data confirm that the proposed method is more accurate
than the PAA based method and other comparison meth-
ods. The ability to differentiate anomalies of the proposed
algorithm is also superior.
Keywords Sequences · Anomaly detection · Data
representation · Anomaly score
1 Introduction
Sequences arise frequently in many fields, including med-
ical science, network security, finance, industrial engineer-
ing, and transportation [3, 9, 32, 40, 42]. Since meaningful
information of a sequence is involved in anomalies, anomaly
detection for sequences is valuable in real applications,
for instance, disease diagnosis in medical science [2] and
intrusion detection in networks [44]. In a sequence, pattern
anomalies are sub-regions (subsequences) that deviate from
the expected behavior [11], which is an important type of
anomalies. This paper focuses on pattern anomaly detection.
Initially, the studies for anomaly detection usually deal
with sequences directly. Different techniques such as dis-
tance functions [25], density functions [5], clustering meth-
ods [19] and prediction models [4] are employed for
detecting various types of anomalies. For the reason that
a subsequence is equal to a set of points, Ma and Perkins
[35] propose an algorithm using a prediction model. By
using the Support Vector Regression (SVR) model that is
being trained for normal parts in a sequence, the predicted
values for points to be detected are computed. When the
difference between some real values of all points and the
predicted values exceeds expectation, the pattern anomalies

are detected. The work in [24] develops a method called
the brute force algorithm that utilizes the nearest neighbor
distance between any two subsequences. By setting a thresh-
old, the top-k anomalies are found. Luo et al. [34] suggest
a method reconstructing a raw sequence in the phase space.
When reconstruction errors between parts of a raw sequence
and a reconstructed sequence are larger than the selected
threshold, anomalies are detected. There are other studies
that utilize reconstruction methods for anomaly detection.
For example, in [18] and [46], reconstruction models are
built by the fuzzy C-means clustering. Certainly, some algo-
rithms that manage raw sequences directly are efficient for
anomaly detection. However, the time cost of these anomaly
detection methods that handle sequences directly is usually
high.
Recently, algorithms always commence with a data rep-
resentation method to speed up the procedure of anomaly
detection [29, 36, 41, 43]. There are two major func-
tions of data representation methods. Firstly, it contributes
to compress sequences [21]. When a sequence is long, a
data representation approach is useful to reduce computa-
tional costs. Secondly, it contributes to represent critical
information of a sequence [12]. If an unsuitable data rep-
resentation is adopted, false anomaly detection results are
probably yielded. Consequently, an effective data represen-
tation method is primary to anomaly detection. The symbol
representation is a common data representation technique.
With a certain rule for segments in a sequence, each segment
is converted into a character [30]. Accordingly, a subse-
quence in the transformed sequence is a string formed of
characters. The symbol representation is superior in using
complex tools such as suffix trees [31]. Keogh et al. pro-
pose a method called the HOT-SAX [24] that employs
the maximum neighbor distance among strings to decide
anomalies. Several algorithms using symbol representation
methods are also reported. Yan and Chen [43] develop an
on-line method by estimating the density of anomaly scores
in subsequences continuously, where anomaly scores are
calculated by the HOT-SAX algorithm. Lonardi et al. [33]
suggest an approach using the Markov model to train a nor-
mal string and then to compute the expected probability of
test strings. The work in [6] reports a binary representa-
tion based method that adopts the identical algorithm frame
in the HOT-SAX. In reality, anomaly detection depends on
numerical values, but the computation for symbols should
be transformed to numeric operation in the existing stud-
ies. Based on the numeric form directly, the operation for
real-value approximation results is convenient. Hence, an
efficacious real-value representation method for anomaly
detection is worthy of attention.
The Piecewise Aggregate Approximation (PAA) [21]
technique is a typical and fast real-value method which uses
mean values of equal size segments to represent a sequence.
H. Ren et al.
However, the PAA method smooths the amplitude informa-
tion of the local of a sequence. Improved works for the PAA
method are mainly divided into three types. One method is
to add different information such as variance for each seg-
ment of a sequence directly. Using the adaptive division
method in the time axis falls into the second category. The
third is the combination of the approach of adding various
information and the technique of adaptive division. There
are two limitations of these improved works. Firstly, they
only capture the local change of a sequence in the time axis,
while that of a sequence in the amplitude axis is ignored.
Secondly, the complexity of improved representation meth-
ods based on the adaptive division is high. To overcome
these limitations of the PAA-based methods, the need for
a non-adaptive representation method that strengthens the
description of the local information of the amplitude axis is
significant.
In this paper, we propose a concise and effective real-
value representation method, namely the Piecewise Aggre-
gate Approximation in the amplitude domain (AD-PAA),
which divides a subsequence into equal size subsections
according to the amplitude domain to realize anomaly
detection. The AD-PAA method partitioned a sequence
into non-overlapping subsequences firstly. Then mean val-
ues in subsections are utilized to substitute original data.
After that, the proposed representation method can be con-
structed. By using the AD-PAA method to all subsequences,
the AD-PAA representation of a sequence is obtained. Since
the AD-PAA method describes information of a sequence in
the amplitude domain, it reserves the information of oscil-
lation amplitude. The division method in the AD-PAA adds
information in the direction of the amplitude domain. In
addition, there is no need to fit the shape of sequences
in the division process. With the help of Euclidean dis-
tance, we construct the relationship between two arbitrary
subsequences. Finally, we convert correlations among sub-
sequences into anomaly scores for subsequences. By setting
an anomaly threshold parameter, anomalies are detected.
The remainder of this paper is structured as follows.
Section 2 briefly reviews some previous works. Section 3
presents the related definitions of anomaly detection. The
proposed method AD-PAA is developed in Section 4.
Section 5 formulates an algorithm for anomaly detection
using the AD-PAA method. The experiment results are
reported in Section 6. Conclusions are reached in Section 7.
2 Related work
Currently, lots of representation methods have been pro-
posed. Popular real-value representation methods include
the Discrete Wavelet Transform (DWT) [8, 10], the Model
Approximation (MA) [14, 37, 38], the Piecewise Linear
Anomaly detection using piecewise aggregate approximation...
Approximation (PLA) [22] and the Piecewise Aggregate
Approximation (PAA) [21, 45]. Various real-value data rep-
resentation strategies constitute different approaches for
anomaly detection. Based on the DWT method, Shahabi
et al. [39] propose an algorithm called the TSA-Tree which
uses the maximum of Harr wavelet coefficients to find
anomalies. Harr wavelet is outstanding in describing local
information [13]. Since a sequence is represented by several
significant Harr DWT coefficients, some anomalies may be
lost when the TSA-Tree algorithm is utilized for anomaly
detection. Akouemo et al. propose an algorithm by combing
different models [1]. In this work, the difficulty of training
process by adopting various models is increased simultane-
ously. On the basis of the PLA method that approximates
segments as straight lines, Leng et al. [27] develop an
approach utilizing the dynamic warping distance function to
two arbitrary subsequences. Once some results exceed the
setting threshold, they can be regarded as anomalies. In [28],
the PLA method is applied by Leng et al. again to propose a
method where the density function called the Local Outlier
Factor (LOF) is used. The LOF is adopted in [28] of mea-
suring the density relationship among a subsequence and its
neighbors. Generally, if the LOF of a subsequence is larger
than one, the subsequence is an anomaly. These works sug-
gested by Leng et al. receive good grades in accuracy, but
their complex procedure affects the efficiency of detection espe-
cially when the data size is great. From the literature review,
it is easy to find that data representation methods have
important influence on the results of anomaly detection.
The DWT is a method which transforms a sequence of
length m into p main wavelet coefficients (with p <<
m) merely. For the reason that the DWT completes the
task of representation in frequency domain instead of time
domain, the representation results of the DWT method is
not intuitive. The MA, as its name suggests, is a method
that describes a sequence by a kind of model. By build-
ing a suitable model with its parameters or coefficients, the
model is formed. However, sometimes only a kind of model
for a sequence approximation is not sufficient, especially
when a sequence is complex. Classic model approximation
methods include the Support Vector Machine (SVM), the
Hidden Markov Model (HMM), etc.. The PLA is a linear
method which is intuitive and understandable. By select-
ing and connecting breakpoints into segments, the process
of the PLA approach is implemented. A vital parameter
to choose breakpoints is the segmentation error [26] and
different methods to select breakpoints are proposed. An
example of the PLA method is given next. Firstly, one can
link two adjacent points and add points one by one until
the fitting error of a straight line exceeds the segmentation
error. Secondly, the previous step is executed continuously
to receive all breakpoints of a sequence. Once the break-
points of a sequence are obtained, the PLA representation
of a sequence is completed. The PLA method is effec-
tive in shape approximation and information representation
if the breakpoints are reasonable. However, the segmenta-
tion procedure by traversing all points to find break points is
complex [15].
Next the PAA technique [21, 45] will be reviewed. Sup-
pose that a sequence is X(m) = {x(1), x(2), . . . , x(m)}
of length m and the PAA approach is utilized to trans-
form the sequence. The sequence can be written as X =
{x(1), x(2), . . . , x(w)}. Formally,
m
wi

w
x(i) = x(j ) (1)
m
j= m
w (i−1)+1
where w is the number of segments after transformation.
Besides, the size of each segment is equal. In (1), the dimen-
sionality of a sequence is reduced from m to w(w < m). By
sorting the means of w segments according to the time order,
the PAA representations of a sequence is obtained. If we
extract subsequences by a sliding window for the PAA rep-
resentations of a whole sequence, the PAA representations
of any subsequences are acquired.
Compared with the DWT, MA and PLA methods, the
procedure in the PAA approach is simple. Accompany-
ing with merits, a problem is also presented in the PAA
technique. For example, given two segments with same or
similar average values but different oscillation amplitudes,
the PAA method is invalid to describe their property. Given
the number of segments w = 10, Fig. 1 illustrates an exam-
ple of the PAA representations of a sequence. Figure 1
shows that the PAA representation method divides time
series on the direction of time axis. However, the sequence
in Fig. 1 is smoothed out with amplitude information lost.
To improve the representation quality of the PAA
method, different methods are presented. Guo et al. in
[16] suggest an improved PAA by adding variance infor-
mation of each equal size segment, which is an approach
−1.0
data value
−1.5
−2.0
−2.5
0 20 40 60 80
Fig. 1 The PAA representations

that supplies different information directly. Since various
information in each segment grows, the difficulty for data
analysis is increased. In fact, diverse information such as
the extreme value can be appended to the PAA representa-
tion, but it is difficult to decide what information is useful.
Keogh et al. in [7] propose the Adaptive Piecewise Con-
stant Approximation (APCA) technique using breakpoints
to decide the best linear segments and then capturing the
mean value of each segment. Since its segmentation size
is unfixed, the APCA approach is adapted to the shape of
a sequence. With unfixed size for tracking the shape of
a sequence, the mean value of each segment plays a bet-
ter role in the time axis. However, when the single mean
value is used for each segment, the amplitude domain is
still probably lost in the APCA method. On the basis of
the APCA method, the work in [17] proposes the Piece-
wise Liner Aggregate Approximation (PLAA) technique.
That is to say, the adaptive division by selecting breakpoints
in the PLAA method is the same as the APCA method.
Meanwhile, both mean and slope are employed to repre-
sent each unfixed size segment in a sequence. Hence, the
information in the PLAA method is increased by using
the slope information. In addition, some problems of the
APCA and PLAA approaches are exposed by using break-
points. To choose optimal breakpoints, the procedure for the
APCA and PLAA techniques is complex. If the APCA and
PLAA methods are used for anomaly detection, it is difficult
to establish the correlations among subsequences. Further-
more, the improved works only capture the local change of
a sequence in the time axis. Aimed at highlighting the local
change of a sequence in the amplitude axis, a concise rep-
resentation method is proposed. In addition, by dividing a
sequence according to the amplitude domain, the process in
the brevity representation method to be adapted to the shape
of a sequence is unnecessary. This paper reports a compact
real-value representation method for anomaly detection.
3 Definition statement
To state the issue of anomaly detection concretely, we give
the related definitions used in this paper.
Definition 1 Sequence: A sequence X(m) = amplitude information domain to describe the local infor-
{x(1), x(2), . . . , x(m)} is a time series, where data elements
are ordered by time, and m stands for the length of X(m).
Definition 2 Sliding Window: Sliding window is a time
window of a user-defined length n ≤ m whose movement
follows a sequence.
Definition 3 Subsequence: Given a sequence, the subse-
quences of length n are extracted by a sliding window.
H. Ren et al.
If a sliding window moves l steps each time, the k-th
subsequence is expressed as:
Xk = {x(1 + l(k − 1)), x(2 + l(k − 2)), . . . , x(n + l(k − 1))} (2)
where the number of subsequences k is computed by:
m−n
k= +1 (3)
l
Specially, if the number of the moving steps l of a sliding
window is equal to the length n of the subsequences, the
k-th subsequence is alternatively denoted as:
Xk = {x(1 + n(k − 1)), x(2 + n(k − 1)), . . . , x(nk)} (4)
where k = m/n. A subsequence is a part of a sequence with
length n ≤ m. Indeed, it is can been seen as a new sequence too.
Definition 4 Amplitude domain: Given a subsequence Xi ,
the amplitude domain of a subsequence is defined by Ai =
[Xil , Xiu ], where Xil (Xiu ) is the minimum (maximum)
value of Xi .
Definition 5 Subsections: Given a subsequence Xi , its sub-
sections are generated by dividing the amplitude domain Ai
of the subsequence Xi into equal size subsections. The t-th
subsection of a subsequence is defined by:
Ait = [at−1 , at ) 1≤t ≤q (5)
where at−1 and at are the lower and upper bounds of t-th
subsection, respectively, and q is the number of subsections.
4 Piecewise Aggregate Approximation
in the amplitude domain
In this section, a representation method called the AD-PAA
is introduced. Unlike the PAA method that completes the
division on the direction of the time axis merely, the AD-
PAA method focuses on the division on the direction of the
amplitude axis. The division process and the suitable form
for this representation method are introduced in detail.
4.1 Division
The inspiration of the AD-PAA method is to divide the
mation in the direction of amplitude. Considering the time
attribute of a sequence and the local property of anomalies,
the division starts from subsequences which are achieved by
a sliding window. And then a sequence is composed of a
series of subsequences. Given a subsequence Xi of length n,
the amplitude domain of Xi is determined according to Def-
inition 4. Then we divide Xi into q equal size subsections.
Based on the division, points are assigned to the correspond-
ing subsection. In other words, when the data value of a
Anomaly detection using piecewise aggregate approximation...
point in the subsequence Xi is within [at−1 , at ), it belongs
to the t-th subsection.
To introduce the AD-PAA division frame clearly, we con-
tinue to use the sequence in Fig. 1 to give statement. The
division frame of the AD-PAA method is shown in Fig. 2,
illustrating two subsequences of length 40 (40 points) that
are transformed to length four (four subsections). That is
to say, the subsequence is reduced to 10% of its raw sub-
sequence. The AD-PAA method is competitive in reducing
dimensionality when a data set is large.
4.2 Representation
A vital representation step is to capture useful information.
Indeed, each subsection is a dispersed point set. To assess
the whole trend of points within each subsection, the mean
value is beneficial. Accordingly, we employ mean values of
points within each subsection to construct the AD-PAA rep-
resentation of a subsequence. Consequently, several average
values in subsections are calculated for a subsequence. Let
μit (1 ≤ t ≤ q) denote the mean value in the t-th subsection of
a subsequence Xi . The representation of a subsequence is
written as a vector of the mean elements in subsections.
Formally,
 T
Xi = μi1 , μi2 , . . . , μiq (6)
The sequence previously mentioned is still adopted in
this step. With length four of the subsequence in the
PAA representation, which is equal to the length of sub-
sequence in the AD-PAA approach, the first subsequence
is represented as [−1.40, −1.47, −1.21, −0.96]. In real-
ity, the amplitude domain of the first subsequence is
[−2.28, −0.63]. The elements in the PAA representations
gather in a narrow range in the amplitude domain. In the
AD-PAA technique, the first subsequence is transformed to
[−2.14, −1.60, −1.46, −1.05]T . It is close to the original
amplitude of the first subsequence [−2.28, −0.63]. Thus,
compared with the PAA method, the amplitude oscillation
−1.0
data value
−1.5
−2.0
−2.5
0 20 40 60
Fig. 2 The division in the AD-PAA representation
information of the first subsequence in the AD-PAA method
is reserved.
5 The AD-PAA for anomaly detection
According to the concept of pattern anomalies, the goal is
to find the most unusual subsequences. Hence, an approach
by computing anomaly scores for subsequences is proposed.
Before discussing anomaly scores, building a similarity
measure is an essential step. A similarity measure is used
to describe the differences among subsequences. Given two
subsequences Xi and Xj , we apply the AD-PAA method
to Xi and Xj firstly. Consequently, subsequences Xi and
Xj are transformed to vectors [μi1 , μi2 , . . . , μiq ]T and
[μj 1 , μj 2 , . . . , μj q ]T , as expressed by (6), respectively. The
similarity between these two vectors reflects the difference
between Xi and Xj . Hence, we define the similarity for Xi
and Xj according to Euclidean Distance as follows:

 q
k 
Sμ (X1 , Xj )/k =  (μit − μj t )2 (7)
j =1 t=1
where q is the number of subsections. If two sequences are
similar, the values will be small, and vice versa. Given a
sequence X(m), we divide it into k subsequences by a slid-
ing window firstly and then the AD-PAA method represents
each subsequence. Aimed at detecting anomalous subse-
quences, we calculate the similarities between two arbitrary
subsequences, and the results are denoted as:
⎡ ⎤
Sμ (X1 , X1 ) Sμ (X1 , X2 ) . . . Sμ (X1 , Xk )
⎢ Sμ (X2 , X1 ) Sμ (X2 , X2 ) . . . Sμ (X2 , Xk ) ⎥
⎢ ⎥
S=⎢ .. ⎥ (8)
⎣ . ⎦
Sμ (Xk , X1 ) Sμ (Xk , X2 ) . . . Sμ (Xk , Xk )
which is called the similarity matrix S. Finally, we employ
the similarity matrix S to compute anomaly scores of sub-
sequences. The anomaly score of the i-th subsequence Xi is
calculated by:

k
Sμ (X1 , Xj )/k
j =1
hi = k k (9)
2
i=1 j =1 Sμ (Xi , Xj )/k
In (9), the numerator indicates the mean of a column (a
row) in the similarity matrix S, and the denominator indi-
cates the mean of all elements in the similarity matrix S.
Obviously, if a subsequence Xi is an anomaly, its similarity

k
Sμ (X1 , Xj )/k(j ∈ [1, k]) in a column (a row) is larger
j =1
than that of other columns (rows) in the similarity matrix
80
S. Hence, the computed results of anomaly scores highlight
anomalies. Since the anomaly score of an anomaly deviates

that of the rest subsequences, it must be larger than the aver-
age level of anomaly scores of the whole subsequences. A
threshold is crucial to make a distinction between normal
and abnormal subsequences. Indeed, the threshold depends
on a performance index, which is called the confidence
index in next section. By conducting theoretical analysis and
extensive experiments, the threshold is set to an experienced
value of the confidence index. The process of the proposed
method is shown as follows:
Step 1. Divide a sequence into subsequences by a sliding
window.
Step 2. Construct the AD-PAA representation of each sub-
sequence.
Step 3. Compute the distances between two arbitrary sub-
sequences by (7) and then a similarity matrix is
achieved by (8).
Step 4. Calculate anomaly scores for subsequences by (9).
Step 5. Use a threshold to determine anomalies.
6 Experiment
We conduct various experiments on extensive data sets
in this section. The performance of the presented method
focuses on effectiveness. In this section, the setting of
parameters is discussed by synthetic data. To verify the per-
formance of the proposed approach, experiments on real
data are launched. In addition, comparison methods are also
applied for further discussion.
6.1 Performance indices
To evaluate the performance of detection methods, the
indices Det.rate [20], F alse.rate and confidence index
[18] are introduced. The Det.rate for a sequence is the
positive detection rate, which is denoted as follows:
tp
Det.rate = (10)
ta
where ta is the number of anomalies to detect in a sequence
and tp is the number of anomalies detected correctly in practice.
From the definition above, the greater the parameter tp is, the
greater Det.rate is. Specially, Det.rate = 1(ta =tp ) means
ta anomalies are detected successfully, while Det.rate = 0
means that no subsequences are detected correctly.
Except ta abnormal sequences, the rest (k − ta ) subse-
quences are normal, where k is the number of all subse-
quences. If tf normal subsequences are detected as anoma-
lies, the F alse.rate for a sequence is defined by
tf
F alse.rate = (11)
(k − ta )
where the F alse.rate for a sequence is the false detec-
tion rate. When the F alse.rate is equal to zero, no normal
H. Ren et al.
subsequences are regarded as anomalies. However, if the
F alse.rate is a positive value, some mistakes are made
for normal subsequences. The Det.rate and F alse.rate
are given to evaluate the performance of the accurate and
false results respectively. For determining the Det.rate and
F alse.rate, the confidence index for an detection method
to detect an anomaly is computed. Let us consider a set
hn that contains anomaly scores of all subsequences. The
confidence index for a sequence is given by
hj
CI = (12)
hn
where CI is the confidence index, hj stands for the anomaly
score of the j -th element in the whole subsequences, and
hn is the mean of hn . According to (13), CI is the ratio
of anomaly score of a subsequence to the mean value
of anomaly scores of all subsequence. Certainly, with a
large CI obtained by an anomaly detection method for an
anomaly in a sequence, the anomaly to be detected deviate
far from normal subsequences. Thus, the anomaly scores of
anomalies are larger than those of normal subsequences and
the average value of that of all subsequences. According to
(9), it is easy to infer that the mean value of anomaly scores
of all subsequences is one. Consequently, if anomalies exist
in a sequence, the confidence index CI of an algorithm for
detecting an anomaly in a sequence is much large than one.
Conversely, the confidence index CI of a normal subse-
quence is close to one. Hence, the setting threshold for the
proposed method must be larger than one. Extensive exper-
iments show that the threshold two, which is equal to the
twice of the average value of anomaly scores of the whole
subsequences, is effective for anomaly detection. Moreover,
the confidence index CI is helpful to evaluate an algorithm
to discover an anomaly in a sequence. To evaluate the ability
to differentiate multiple anomalies in a sequence, the aver-
age confidence index, which is denoted as CI , is calculated
by
ha
CI = (13)
hn
Specially, if the number of anomalies is equal to one, the
average confidence index is identical to the confidence
index of the anomaly to be detected, namely CI = CI .
From the definition of the average confidence index, the
larger the average confidence index CI is, the stronger the
ability of the method to differentiate the normal and abnor-
mal subsequences. In addition, the average confidence index
CI is conducive to estimate the missing detection situation.
If the average confidence index CI is lower than the thresh-
old, there must exist missing detection. On the contrary, the
missing detection may or may not exist.
Anomaly detection using piecewise aggregate approximation...

6.2 Synthetic data
According to introduction of the proposed method, the
parameter q, standing for the number of subsections, is
significant to the quality of representation and anomaly
detection. To determine the optimal parameter q, the syn-
thetic data is designed in this section. Waves have been used
for anomaly detection in [11]. The first sequence is built on
a sine signal of cycle 60 and length 1200. Assigning a Gauss
noise n(t) with zero mean and a standard deviation of 0.1 to
the whole sine wave, the resulting signal, denoted by Y1 (t),
is generated, i.e.,
 
40π
Y1 (t) = sin t + n(t) (14)
N score of the event e1 (t) is great when q = 2. Since the
Then we add an anomalous portion in [601,630] of the
signal with a noise e1 (t) that obeys the distribution of
N(0, 0.3). The resulting signal Y2 (t) is written as follows:
 
40π
Y2 (t) = sin t + n(t) + e1 (t) (15)
N
where t = 1, 2, . . . , 1200, and N = 1200.
Considering the quasi-period property of the first syn-
thetic data, we set the length of subsequence to the cycle 60.
The number of subsections q, namely the parameter in the
proposed method, starts from two. We gradually increase
data value
the parameter q by one each time. Several detection results
with different parameter q are illustrated in Fig. 3.
Figure 3a–d show the detection results of the first syn-
thetic data with different values of parameter q (the num-
ber of subsections) and each sub-figure is composed of
two parts. The top part is a raw sequence and the other
is anomaly score obtained by the proposed method and
assigned to each subsequence. To make the effect of detec-
tion results obvious, a threshold line is added in the below
part. The threshold line stands for twice the mean value of
the whole anomaly scores in a sequence. When an anomaly
score exceeds the threshold, its corresponding subsequence
is regarded as an anomaly. For clarity, anomalies discovered
successfully are also highlighted. In Fig. 3a, the anomaly
anomaly score of the first subsequence is also close to the
threshold line, q = 2 is not an optimal choice for the first
synthetic data. In Fig. 3b–d, the anomalies are discovered
successfully, and their performance is better compared with
Fig. 3a.
To learn the function of parameter q for the proposed
method roundly, the performance indices of the Det.rate,
F alse.rate and CI (the average confidence index) are
shown in Table 1. Generally, the larger Det.rate and CI
are, and the smaller F alse.rate is, the better the parame-
ter q is. In Table 1, the Det.rate of 1/1 and F alse.rate of
0/1 appear conformably when q is increased. Although the

data value
0.5

0.5
−1.0

−1.0

0 200 400 600 800 1000 1200 0 200 400 600 800 1000 1200
4

4
anomaly score

anomaly score
3

3
2

2
1

1
0

(a) (b)
data value

data value
0.5

0.5
−1.0

−1.0

0 200 400 600 800 1000 1200 0 200 400 600 800 1000 1200
4

4
anomaly score

anomaly score
3

3
2

2
1

1
0

(c) (d)
Fig. 3 Detection results with different numbers of subsections q in the first synthetic data
 H. Ren et al.

Table 1 Performance indices with different numbers of subsections q in the first synthetic data

q 2 3 4 5 6 7 8 9 10

Det.rate 1/1 1/1 1/1 1/1 1/1 1/1 1/1 1/1 1/1
False.rate 0/19 0/19 0/19 0/19 0/19 0/19 0/19 0/19 0/19
CI 2.38 2.81 2.76 2.91 3.07 2.69 2.90 2.51 2.59

Det.rate and the F alse.rate are the same in various values
of q, the results of the CI vary. Since a large CI is help-
ful for detection, the parameter q from three to ten is better
than two in Table 1. Furthermore, when the number of sub-
sections is six, CI reaches the maximum value in Table 1.
Hence, the best value of q for the first synthetic data is six.
In the first synthetic data, its anomaly is different from
other parts obviously. When anomalies are weak in a
sequence, it is interesting to understand the effect of the
parameter q on the proposed method. Next we expand an
experiment on the second synthetic data. By adding an event
e2 (t) that obeys the distribution N(0, 0.22) in [601,630] of
the signal Y1 (t) as an anomaly, the second sequence is yielded.
Figure 4 shows the detection results for the second syn-
thetic data under difference values of parameter q (the
number of subsections). In Fig. 4a, no anomaly scores are
greater than the threshold when q is three. Although the
anomaly score of the event e2 (t) is the maximum, there are
some other anomaly scores close to it. In other words, the
data value
anomaly is hidden in normal subsequences in this case. In
Fig. 4b and c, the event e2 (t) reaches a value exceeding
the threshold. Besides, in each of these two sub-figures, the
anomaly scores of others are less than the threshold, which
leads to the successful detection of e2 (t) easily. In Fig. 4d,
the anomaly score of the subsequence with the anomaly is
lower than the threshold when q is ten. Hence, the anomaly
is not detected correctly. More detection results are listed in
Table 2 for selecting the optimal parameter q.
In Table 2, the F alse.rate is zero under different values
of q. Since the Det.rate is 1/1 means that the anomaly is
detected correctly by a method, q from five to eight is fea-
sible in the second synthetic data. Furthermore, the values
of CI (the average confidence index) are larger by using
q from five to eight than that of the rest situations. Hence,
when the parameter q is from five to eight, its detection
results are better than other situations according to the over-
all performance indices in Table 2. In addition, on the basis
of the maximum CI in results, the best value of q is also six.

data value
0.5

0.5
−1.0

−1.0

0 200 400 600 800 1000 1200 0 200 400 600 800 1000 1200
4

4
anomaly score

anomaly score
3

3
2

2
1

1
0

(a) (b)
data value

data value
0.5

0.5
−1.0

−1.0

0 200 400 600 800 1000 1200 0 200 400 600 800 1000 1200
4

4
anomaly score

anomaly score
3

3
2

2
1

1
0

(c) (d)
Fig. 4 Detection results with different numbers of subsections q in the second synthetic data
Anomaly detection using piecewise aggregate approximation...

Table 2 Performance indices with different numbers of subsections q in the second synthetic data

q 2 3 4 5 6 7 8 9 10

Det.rate 0/1 0/1 0/1 1/1 1/1 1/1 1/1 0/1 0/1
F alse.rate 0/19 0/19 0/19 0/19 0/19 0/19 0/19 0/19 0/19
CI 0.93 1.57 1.91 2.21 2.29 2.05 2.13 1.89 1.90

The experiments of the first and the second synthetic data
reveals that an appropriate q is of paramount importance.
The prime value of q in the first and the second synthetic
data is six. Therefore, we set the value of parameter q to be
six in this paper.
6.3 Real data
Considering real data is more complex than synthetic data,
the experiments will be applied to real data. The data come
from the UCR time series Data Mining Archive [23], which
is an open resource for sharing and were used in [20, 24]
as well as some others paper. A portion of the real data
which involves (Electrocardiogram) ECG data sets and a
video data set are utilized in this experiment. The ECG data
sets involve various anomalies, such as Premature ventric-
ular contraction, Supraventricular escape beat and Bundle
branch block beat. The video data set is extracted from an
actor shooting action with a replica gun. In the video data
set, the X and Y coordinates of the actor’s right hand is
described. The repeated actions of the actor include drawing
a replica gun from a hip mounted holster, aiming it at a tar-
get and returning it. Since different data sets may involve a
different cycle, they may be segmented in various length of
subsequences. We list two parameters m and n of data sets
in Table 3 subsequently displayed, where m is the length of
a sequence and n is that of subsequences. Several data sets
contain multiple columns, but their parameters are fixed for
each column in a data set. For example, chfdbchf01 275 2
is the second column of sequence chfdbchf01 275 whose
length m is 3700 and length n of each subsequence is 230.
The parameter q discussed previously is still set to six in
real data. Given the parameters m and n of real data sets, the
proposed algorithm is applied.
Figure 5 shows the detection results of the proposed
method on two ECG sequences. In Fig. 5a, a sub-region
[2000, 2600] of sequence 231 which is different from oth-
ers. The abnormal part of sequence 231 involves the seventh
and the eighth subsequences. As illustrated in Fig. 5, two
anomalies are detected successfully. Due to the fact that
two anomalies are much large than the threshold, the power
of the proposed method to differentiate normal and abnor-
mal subsequences is strong. Next a video data set is used
for the certification of the proposed method. The detection
result of video 2 (the second column of the video data set)
is visualized in Fig. 5b. As shown in Fig. 5b, two parts in

Table 3 The performance indices of the PAA method and the proposed method on various data

Data sets m n PAA method Proposed method

(sequence) (subsequence) Det.rate F alse.rate CI Det.rate False.rate CI

chfdbchf01 275 2 3700 230 1/1 0/15 2.12 1/1 0/15 4.97
chfdbchf01 275 3 3700 230 1/1 0/15 4.51 1/1 0/15 4.21
chfdbchf13 45590 2 3650 165 0/1 1/21 1.26 1/1 1/21 3.17
chfdbchf13 45590 3 3650 165 0/1 1/21 0.74 1/1 1/21 5.88
xmitdbx108 2 5100 340 0/1 1/14 1.20 1/1 1/14 2.95
xmitdbx108 3 5100 340 0/1 1/14 0.69 1/1 1/14 2.70
231 8500 330 0/2 1/23 0.83 2/2 0/23 4.02
234 3 8500 170 0/1 3/49 0.73 1/1 0/49 6.82
qtdbsele0606 3 9000 150 3/6 0/55 2.62 5/6 0/55 3.45
qtdbsel102 3 10000 200 1/2 0/46 0.98 2/2 0/46 4.72
video 1 6000 150 1/4 2/36 1.91 3/4 0/36 3.12
video 2 6000 150 1/4 2/36 1.96 4/4 0/36 3.72
Total 72900 2620 8/25(32%) 12/345(3.5%) 19.55 23/25(92%) 0/345(0%) 49.73
Average 6075 218 N.A. N.A. 1.63 N.A. N.A. 4.14
 H. Ren et al.

data value

data value
300
0.5

150
−1.0
0 2000 4000 6000 8000 0 1000 2000 3000 4000 5000 6000

6
anomaly score

anomaly score
4

4
2

2
0

0
(a) (b)
Fig. 5 Detection results of the proposed algorithm on ECG data

[2000, 3000] are tremendously inconsistent with the others,
which are included in four subsequences. When it comes
to the proposed method, four subsequences exceed thresh-
old line and correspond to anomalies to be detected. Hence,
anomalies are discovered correctly without falsehood by the
proposed method.
In order to reveal the performance of the proposed
approach profoundly, comparison methods which involve
the PAA method (Euclidean distance), the direct detection
(Euclidean distance) method [25] and the brute force algo-
rithm [24] are adopted to prove the performance of the
proposed method. To compare these methods, a sequence
−1.0
is partitioned into subsequences whose length is identi-
cal to that in the AD-PAA method. After applying the
PAA representation method to each subsequence, distances
between two arbitrary subsequences are calculated by (7),
(8) in the PAA (Euclidean distance) method. Besides, in
the direct detection (Euclidean distance) method, the dis-
tances between subsequences are computed by the sum of
distances of all points in them. To compare detection results
of different methods, anomaly scores of the four methods
are achieved by (9).
Two ECG data sets are exhibited to verify the proposed
method. Figure 6a–d show the detection results of the four

−1.0
data value

data value
−2.5

−2.5

0 1000 2000 3000 0 1000 2000 3000

4

4
anomaly score

anomaly score
3

3
2

2
1

1
0

(a) (b)
−1.0

−1.0
data value

data value
−2.5

−2.5

0 1000 2000 3000 0 1000 2000 3000

4

4
anomaly score

anomaly score
3

3
2

2
1

1
0

(c) (d)
Fig. 6 Detection results of four methods on sequence chfdbchf13 45590 2
Anomaly detection using piecewise aggregate approximation...

5.2

5.2
data value

data value
4.6

4.6
4.0

4.0
0 1000 2000 3000 4000 5000 0 1000 2000 3000 4000 5000
4

4
anomaly score

anomaly score
3

3
2

2
1

1
0

0
(a) (b)
5.2

5.2
data value

data value
4.6

4.6
4.0

4.0
0 1000 2000 3000 4000 5000 0 1000 2000 3000 4000 5000
4

4
anomaly score

anomaly score
3

3
2

2
1

1
0

0
(c) (d)
Fig. 7 Detection results of four methods on sequence xmitdbx108 2

methods on sequence chfdbchf13 45590 2, in which one
anomaly is involved. From the results of Fig. 6a, c and
d, the maximum anomaly score points to the anomaly in
the sequence. In other words, the anomaly is discovered by
the PAA method, the brute force method and the proposed
method. However, anomaly scores in Fig. 6b are lower
than the threshold. It is concluded that the direct detection
method fails to detect the anomaly. Moreover, for the reason
that the column of the maximum anomaly score corresponds
to a normal subsequence, the PAA method generates false
detection result. Compared with other methods, the differ-
ence between anomaly scores of the abnormal and normal

Table 4 The performance indices of the direct detection method, the brute force method and the proposed method on various data

Data sets Direct detection method Brute force method Proposed method

Det.rate False.rate CI Det.rate False.rate CI Det.rate False.rate CI

chfdbchf01 275 2 1/1 0/15 3.86 1/1 0/15 6.60 1/1 0/15 4.97
chfdbchf01 275 3 0/1 0/15 1.89 1/1 0/15 3.30 1/1 0/15 4.21
chfdbchf13 45590 2 0/1 0/21 1.94 1/1 0/21 2.30 1/1 0/21 3.17
chfdbchf13 45590 3 0/1 0/21 1.23 0/1 0/21 1.56 1/1 0/21 5.88
xmitdbx108 2 0/1 0/14 0.90 0/1 0/14 1.28 1/1 0/14 2.95
xmitdbx108 3 0/1 0/14 0.92 0/1 1/14 0.46 1/1 0/14 2.70
231 0/2 0/23 0.90 1/2 0/23 1.47 2/2 0/23 4.02
234 3 0/1 0/49 0.97 1/1 0/49 2.22 1/1 0/49 6.82
qtdbsele0606 3 1/6 0/55 1.65 5/6 0/55 3.97 5/6 0/55 3.45
qtdbsel102 3 0/2 0/46 0.92 1/2 2/46 3.83 2/2 0/46 4.72
video 1 1/4 0/36 1.86 4/4 1/36 2.66 3/4 0/36 3.12
video 2 3/4 0/36 2.00 4/4 0/36 3.27 4/4 0/36 3.72
Total 6/25(24%) 1/345(0.3%) 19.04 19/25(76%) 5/345 = (1.5%) 32.92 23/25(92%) 0/345(0%) 49.73
Average N.A. N.A. 1.59 N.A. N.A. 2.64 N.A. N.A. 4.14

subsequences is large in the proposed method. Hence, the
proposed method is superior in discriminating normal and
abnormal subsequences.
Figure 7a–d demonstrate the detection results of four
methods on sequence xmitdbx108 2 of one anomaly. In the
view of Fig. 7a–c, anomaly scores are lower than the thresh-
old. Hence, the PAA method, the direct detection method
and the brute force method are invalid to detect the anomaly.
When it comes to our method, one column of anomaly
scores in Fig. 7d points to the anomaly. It is concluded
that the proposed method is effective to detect the anomaly
in sequence xmitdbx108 2. In addition, there are no false
detection results when the proposed method is used. Con-
sidering the difference between the abnormal and normal
subsequences, the proposed method shows the strong ability
to differentiate the abnormal and normal subsequences.
Except the previous results, other experiments are
expanded to compare the accuracy of the PAA method, the
direct detection method, the brute force method and the pro-
posed method. Table 3 shows results of experiments of the
PAA method and the proposed method. Parameter m and n
stand for the length of sequence and subsequences in exper-
iments, respectively. In Table 3, the performance indices
of Det.rate, F alse.rate and CI (the average confidence
index) of 12 data sets are recorded. According to Table 3,
we are engaged in the analysis from three steps. Firstly,
the Det.rate of the proposed approach is 92%, while the
Det.rate of the PAA method is 32%. That is to say, our
method is adapted to some cases where the PAA method
does not work well. Totally, the Det.rate is improved by
60% in the developed algorithm. Secondly, the F alse.rate
of the PAA method is about 3.5%. Compared with it, the
proposed method is superior with its F alse.rate 0% in this
experiment. Although the F alse.rate is reduced by 3.5%,
it keeps the results more accurate. Finally, we evaluate the
confidence index of the two methods for different data sets.
In most data sets, the CI for anomalies in our method are
greater than those in the PAA method. A large CI indicates
the stronger ability to discriminate the normal and abnormal
subsequences. In turn, if a method has a stronger differen-
tiation ability in seeking out anomalies from a sequence, its
detection effect will be better. It is verified in Table 4 that
the average value of CI , i.e., 4.14 of the proposed method is
greater than 1.63 of the PAA method. In summary, the pro-
posed method is more accurate than the PAA method with
less false results.
Table 4 counts the Det.rate, F alse.rate and CI (the
average confidence index) of the direct detection approach,
the brute force approach and the proposed algorithm. By
comparing the performances indices in the three methods,
the quality of the proposed method is explored further.
Besides, the parameter setting is the same as Table 3. In
Table 4, the parameters Det.rate of the direct detection
H. Ren et al.
method and the brute force method are 24% and 76%,
respectively. Compared with these two approaches, the
index Det.rate of the proposed method is improved by 68%
and 16% respectively. When it comes to the F alse.rate of
three methods, the direct detection method is 0.3%, the brute
force algorithm is 1.5% and the proposed method is 0%.
Although the parameters F alse.rate of three methods are
small, the advantage of the proposed algorithm is still pre-
sented. In comparison with the direct detection method and
the brute force method, F alse.rate of the proposed method
is reduced by 0.3% and 1.5% respectively. Furthermore, the
average value of CI , i.e., 4.14, of the proposed method is
greater than 1.59 of the direct detection method and 2.64
of the brute force method. The overall performance indices
above indicate that the proposed method is excellent in
accuracy and its ability to differentiate anomalies.
7 Conclusion
In this paper, an effective approach is proposed for anomaly
detection. We realize the goal of anomaly detection based
on a real-value representation method, which is called the
AD-PAA. It is a novel representation method that its divi-
sion is developed according to the amplitude domain. Then
mean values of points within subsections are utilized to rep-
resent subsequences. After the AD-PAA method is applied
to subsequences, a similarity measure is constructed for
two arbitrary subsequences. As the similarity results are
transformed to anomaly scores, anomalies are discovered
by a threshold. We experimentally evaluated the proposed
method in synthetic data and real data. Experiments show
that the accuracy of the proposed algorithm is 92% on real
data. Compared with the PAA method, its effectiveness is
improved by 60%. Meanwhile, its false results is reduced
by 3.5%. The ability of the proposed method to distin-
guish normal and abnormal is also outstanding. When more
approaches are applied to experimental data for comparison,
the superiority of the proposed method is still exhibited in
accuracy and its ability to differentiate anomalies.
Acknowledgements The authors extend their appreciation to the
International Scientific Partnership Program ISPP at King Saud Uni-
versity for funding this research Work through ISPP#0799.
References
1. Akouemo HN, Povinelli RJ (2016) Probabilistic anomaly detec-
tion in natural gas time series data. Int J Forecast 32(3):948–956.
doi:10.1016/j.ijforecast.2015.06.001
2. Andrysiak T (2016) Machine learning techniques applied to data
analysis and anomaly detection in ecg signals. Appl Artif Intell
30(6):610–634. doi:10.1080/08839514.2016.1193720
Anomaly detection using piecewise aggregate approximation...
3. Avazbeigi M, Doulabi SHH, Karimi B (2010) Choosing the appro-
priate order in fuzzy time series: a new N-factor fuzzy time series
for prediction of the auto industry production. Expert Syst Appl
37(8):5630–5639. doi:10.1016/j.eswa.2010.02.049
4. Balasooriya U (1989) Detection of outliers in the exponential
distribution based on prediction. Commun Stat- Theory Methods
18(2):711–720. doi:10.1080/03610928908829929
5. Breunig MM, Kriegel H, Ng RT, Jsander (2000) Lof: iden-
tifying density-based local outliers. In: ACM SIGMOD inter-
national conference on management of data, pp 93–104.
doi:10.1145/342009.335388
6. Buu HTQ, Anh DT (2011) Time series discord discovery based on
iSAX symbolic representation. In: Proceedings of the third inter-
national conference on knowledge and systems engineering, pp
11–18. doi:10.1109/KSE.2011.11
7. Chakrabarti K, Keogh E, Mehrotra S, Pazzani M (2002)
Locally adaptive dimensionality reduction for indexing large
time series databases. ACM Trans Database Syst 27(2):188–228.
doi:10.1145/568518.568520
8. Chan FKP, Fu AWC, Yu C (2003) Haar wavelets for
efficient similarity search of time-series: with and without
time warping. IEEE Trans Knowl Data Eng 15(3):686–705.
doi:10.1109/TKDE.2003.1198399
9. Chang PC, Fan CY, Lin JL (2011) Trend discovery in financial
time series data using a case based fuzzy decision tree. Expert Syst
Appl 38(5):6070–6080. doi:10.1016/j.eswa.2010.11.006
10. Chaovalit P, Gangopadhyay A, Karabatis G, Chen ZY (2011) Dis-
crete wavelet transform-based time series analysis and mining.
ACM Comput Surv 43(2):33–63. doi:10.1145/1883612.1883613
11. Chen XY, Zhan YY (2008) Multi-scale anomaly detection algo-
rithm based on infrequent pattern of time series. J Comput Appl
Math 214(1):227–237. doi:10.1016/j.cam.2007.02.027
12. Esling P, Agon C (2012) Time-series data mining. ACM Comput
Surv 45(1):12–45. doi:10.1145/2379776.2379788
13. Fu AWC, Leung OTW, Keogh E, Lin J (2006) Finding time series
discords based on haar transform. In: Proceedings of international
conference on advanced data mining and applications, pp 31–41.
doi:10.1007/11811305 3
14. Fuchs E, Gruber T, Nitschke J, Sick B (2010) Online segmentation
of time series based on polynomial least-squares approxima-
tions. IEEE Trans Pattern Anal Mach Intell 32(12):2232–2245.
doi:10.1109/TPAMI.2010.44
15. Guerrero JL, Berlanga A, Garc J, Molina JM (2010) Piece-
wise linear representation segmentation as a multiobjective
optimization problem. Adv Intell Soft Comput 79:267–274.
doi:10.1007/978-3-642-14883-5 35
16. Guo CH, Li HL, Pan DH (2010) An improved piece-
wise aggregate approximation based on statistical features for
time series mining. In: International conference on knowl-
edge science, engineering and management, pp 234–244.
doi:10.1007/978-3-642-15280-1 23
17. Hung NQ, Anh DT (2008) An improvement of PAA for dimen-
sionality reduction in large time series databases. In: Proceedings
of pacific rim international conference on artificial intelligence,
pp 698–707. doi:10.1007/978-3-540-89197-0 64
18. Izakian H, Pedrycz W (2013) Anomaly detection in time series
data using a fuzzy C-means clustering. In: Proceedings of
IFSA world congress and NAFIPS meeting, pp 1513–1518.
doi:10.1109/IFSA-NAFIPS.2013.6608627
19. Jaing MF, Tseng SS, Su CM (2001) Two-phase clustering pro-
cess for outliers detection. Pattern Recogn Lett 22(6–7):691–700.
doi:10.1016/S0167-8655(00)00131-8
20. Jones M, Nikovski D, Imamura M, Hirata T (2016) Exem-
plar learning for extremely efficient anomaly detection in
real-valued time series. Data Min Knowl Disc 30(6):1–28.
doi:10.1007/s10618-015-0449-3
21. Keogh E, Chakrabarti K, Pazzani M, Mehrotra S (2001a)
Dimensionality reduction for fast similarity search in
large time series databases. Knowl Inf Syst 3(3):263–286.
doi:10.1007/PL00011669
22. Keogh E, Chu S, Hart D, Pazzani M (2001b) An online
algorithm for segmenting time series. In: Proceedings of
IEEE international conference on data mining, pp 289–296.
doi:10.1109/ICDM.2001.989531
23. Keogh E, Lin J, Fu AWC (2005) Details about time series discords.
http://www.cs.ucr.edu/eamonn/discords
24. Keogh E, Lin J, Fu AW, Herle HV (2006) Finding unusual
medical time-series subsequences: algorithms and appli-
cations. IEEE Trans Inf Technol Biomed 10(3):429–439.
doi:10.1109/TITB.2005.863870
25. Knorr EM, Ng R, Tucakov V (2000) Distance-based out-
liers: algorithms and applications. VLDB J 8(3):237–253.
doi:10.1007/s007780050006
26. Lemire D, 2007 A better alternative to piecewise linear time series
segmentation. In: Proceedings of SIAM international conference
on data mining, pp 985–993. doi:10.1137/1.9781611972771.59
27. Leng MW, Lai XS, Tan G, Xu X (2009) Time series represen-
tation for anomaly detection. In: IEEE international conference
on computer science and information technology, pp 628–632.
doi:10.1109/ICCSIT.2009.5234775
28. Leng MW, Yu W, Wu S, Hu H (2013) Anomaly detection algo-
rithm based on pattern density in time series. Lecture Notes Electr
Eng 236:305–311. doi:10.1007/978-1-4614-7010-6 35
29. Li GL, Bräysy O, Jiang LX, Wu ZD, Wang YZ (2013) Finding
time series discord based on bit representation clustering. Knowl-
Based Syst 54(4):243–254. doi:10.1016/j.knosys.2013.09.015
30. Lin J, Keogh E, Lonardi S, Chiu B (2003) A symbolic repre-
sentation of time series, with implications for streaming algo-
rithms. In: Proceedings of the eighth ACM SIGMOD workshop on
research issues in data mining and knowledge discovery, pp 2–11.
doi:10.1145/882082.882086
31. Lin J, Keogh E, Wei L, Lonardi S (2007) Experiencing SAX: a
novel symbolic representation of time series. Data Min Knowl
Disc 15(2):107–144. doi:10.1007/s10618-007-0064-z
32. Lippi M, Bertini M, Frasconi P (2013) Short-term traffic flow
forecasting: an experimental comparison of time-series analysis
and supervised learning. IEEE Trans Intell Transp Syst 14(2):871–
882. doi:10.1109/TITS.2013.2247040
33. Lonardi S, Lin J, Keogh E, Chiu B (2006) Efficient discovery
of unusual patterns in time series. N Gener Comput 25(1):61–93.
doi:10.1007/s00354-006-0004-2
34. Luo W, Gallagher M, Wiles J (2013) Parameter-free search
of time-series discord. J Comput Sci Technol 28(2):300–310.
doi:10.1007/s11390-013-1330-8
35. Ma J, Perkins S (2003) Online novelty detection on tem-
poral sequences. In: ACM SIGKDD international confer-
ence on knowledge discovery and data mining, pp 613–618.
doi:10.1145/956750.956828
36. Ma JG, Sun L, Wang H, Zhang YC, Aickelin U (2016) Supervised
anomaly detection in uncertain pseudoperiodic data streams. ACM
Trans Internet Technol 16(1):1–20. doi:10.1145/2806890
37. Mok MS, Sohn SY, Ju YH (2010) Random effects logistic regres-
sion model for anomaly detection. Expert Syst Appl 37(10):7162–
7166. doi:10.1016/j.eswa.2010.04.017
38. Quinn JA, Sugiyama M (2014) A least-squares approach to
anomaly detection in static and sequential data. Pattern Recogn
Lett 40(1):36–40. doi:10.1016/j.patrec.2013.12.016
39. Shahabi C, Tian XM, Zhao WG (2000) TSA-tree: a wavelet-based
approach to improve the efficiency of multi-level surprise and
trend queries on time-series data. In: Proceedings of the twelfth
international conference on scientific and statistical database man-
agement, pp 55–68. doi:10.1109/SSDM.2000.869778

40. Tewatia DK, Tolakanahalli RP, Paliwal BR, Tomé WA (2011)
Time series analyses of breathing patterns of lung cancer
patients using nonlinear dynamical system theory. Phys Med Biol
56(7):2161–2181. doi:10.1118/1.4734982
41. Truong CD, Anh DT (2015) An efficient method for motif and
anomaly detection in time series based on clustering. Int J Bus Intell
Data Min 10(4):356–377. doi:10.1504/IJBIDM.2015.072212
42. Viinikka J, Debar H, Mé L, Lehikoinen A, Tarvainen M
(2009) Processing intrusion detection alert aggregates with time
series modeling. Inf Fusion 10(4):312–324. doi:10.1016/j.inffus.
2009.01.003
43. Yan QY, Chen XT (2013) A novel never-ending uncertain Top-
k discord detection method. Inf Technol J 12(19):4906–4910.
doi:10.3923/itj.2013.4906.4910
44. Yang Y, Hu HP, Xiong W, Ding F (2011) A novel network traf-
fic anomaly detection model based on superstatistics theory. J
Networks 6(2):311–318. doi:10.4304/jnw.6.2.311-318
45. Yi BK, Faloutsos C (2000) Fast time sequence indexing for arbi-
trary Lp Norms. In: Proceedings of the twenty-sixth international
conference on very large data bases, pp 385–394
46. Zhao J, Liu K, Wang W, Liu Y (2014) Adaptive fuzzy clustering
based anomaly data detection in energy system of steel industry.
Inf Sci Int J 259(3):335–345. doi:10.1016/j.ins.2013.05.018
Huorong Ren received his
BS, MS, and PhD degrees in
electronic engineering rom Xi-
dian University, Xi’an, China,
in 1994, 1999, and 2004, res-
pectively. Currently, he is an
Associate Professor with the
School of Electro-Mechanical
Engineering, Xidian Univer-
sity, China. His research inter-
ests include face recognition,
data mining, pattern recogni-
tion, computer vision, and bio-
security.
Xiujuan Liao received her BS
degree in measurement and
control technology and ins-
trument from Xi’an Univer-
sity of Posts and Telecom-
munications, China, in 2014.
Currently, she is a postgrad-
uate student with the School
of Electro-Mechanical Engi-
neering, Xidian University,
China. Her research interests
include data mining, and pat-
tern recognition.
H. Ren et al.
Zhiwu Li received his BS,
MS, and PhD degrees in
mechanical engineering, auto-
matic control, and manufac-
turing engineering, respective-
ly, all from Xidian Univer-
sity, Xi’an, China, in 1989,
1992, and 1995, respectively.
He joined Xidian University
in 1992 and now he is also
with the Institute of Systems
Engineering, Macau Univer-
sity of Science and Technol-
ogy, Taipa, Macau. Over the
past decade, he was a Visiting
Professor at the University of
Toronto, Technion (Israel Institute of Technology), Martin-Luther Uni-
versity, Conservatoire National des Arts et Métiers (Cnam), Meliksah
Universitesi, and King Saud University. His current research inter-
ests include Petri net theory and application, supervisory control
of discrete event systems, workflow modeling and analysis, system
reconfiguration, game theory, and data and process mining.
He is a member of Discrete Event Systems Technical Committee
of the IEEE Systems, Man, and Cybernetics Society, and a member
of IFAC Technical Committee on Discrete Event and Hybrid Systems
from 2011 to 2014. He serves as a frequent reviewer for 50+ inter-
national journals including Automatica and a number of the IEEE
Transactions as well as many international conferences. He is listed
in Marquis Who’s Who in the world, 27th Edition, 2010. Dr. Li is a
recipient of an Alexander von Humboldt Research Grant, Alexander
von Humboldt Foundation, Germany, and Research in Paris, France.
He is the founding chair of Xi’an Chapter of IEEE Systems, Man, and
Cybernetics Society.
Abdulrahman AI-Ahmari re-
ceived his PhD degree in ma-
nufacturing systems engineer-
ing from the University of
Sheffield, Sheffield, U.K., in
1998. He is currently a Profes-
sor of Industrial Engineering
with King Saud University
(KSU), Riyadh, Saudi Arabia.
He led a number of funded
projects from different organi-
zations at KSU. His research
interests include advanced
manufacturing technologies,
analysis, and design of manu-
facturing systems; computer-
integrated manufacturing; optimization of manufacturing operations;
applications of simulation optimization; flexible manufacturing sys-
tems and cellular manufacturing systems; and applications of decision
support system in manufacturing.