Li Wei Nitin Kumar Venkata Lolla Eamonn Keogh Stefano Lonardi Chotirat Ann Ratanamahatana
University of California, Riverside
Department of Computer Science & Engineering
Riverside, CA 92521, USA
{wli, nkumar, vlolla, eamonn, stelo, ratana}@cs.ucr.edu
This web page contains full color examples and dataset of the figures presented in the paper along with many others that follow this work.
Data sets used for experimental evaluation in the paper:
Figure 1. ECG Dataset 1
Figure 3. DNA Data
Figure 6. ECG Dataset 2
Figure 7. ECG Dataset 3
Anomaly Detection Tool
Description: a tool to detect anomalies in time series.
Instructions to use this tool:
The tool requires the input time series to be in a specific format, that is, it has only one column and each row represents a data point.
There are two ways to use the tool: unsupervised (one time series) and supervised (two time series).
For unsupervised use, you must specify how much memory of the past you use to judge the future. This is the size of the lag window parameter.
For supervised use, you must specify a time series file that you believe contains normal behavior for the system. This is the example time series parameter.
Feature window size should be about the size at which events happen. For example, for heartbeat data it should be about the length of one heartbeat.
Number of symbols per window is the number of equal sized sections in which to divide the feature window. A good value for this depends on the complexity of the signal.
Level size is the desired level of recursion of the bitmap.
Lag window size is how much memory the algorithm should keep to compare to the data in the lead window. It needs only be specified for the unsupervised case, for supervised case the entire training dataset can be imagined as being inside the lag window.
Lead window size is how far to look ahead. A reasonable value would be 2 or 3 times the length of feature window size.
After setting all the parameters, press "Go" button to begin detection.
The original time series and the corresponding abnormal degree will be displayed in the applet. You could click in the area of "Abnormal Degree" plot, two bitmaps which represent the time instance before and after the place you clicked respectively will be displayed. If you want to save the bitmaps, press "Save Bitmaps" button.
Press "Exit" button will close the current window.
Before running the applet, you should
Have Java (TM) 2 Runtime Environment installed. Java (TM) 2 Runtime Environment provides Java Plug-in support for applet. You will not be able to see the applet without installing it. You can download it here.
Give the applet permission to access your local
files if you want to test on a local file. Go to the directory where Java (TM)
2 Platform is installed (for example, mine is "C:\Program
Files\Java\"), find the file "java.policy"
(on my machine, it's under "C:\Program
Files\Java\j2re1.4.2_06\lib\security\")
and add following sentence to it:
grant {
permission java.security.AllPermission;
};
Note: You must shut down your web
browser and reopen it to grant the applet the access permission.
Sample datasets and settings
For ecg_anom.txt, choose "unsupervised" learning, and set Feature window size = 20, Number of symbols per window = 5, Level size = 3, Lag window size = 200, and Lead window size = 40.
For ecg_anom.txt, choose "supervised" learning, use ecg_normal.txt as the training file, and set Feature window size = 20, Number of symbols per window = 5, Level size = 3, and Lead window size = 40.
For pattern_anom.txt, choose "unsupervised" learning, and set Feature window size = 50, Number of symbols per window = 5, Level size = 2, Lag window size = 200, and Lead window size = 100.
For pattern_anom.txt, choose "supervised" learning, use pattern_normal.txt as the training file, and set Feature window size = 50, Number of symbols per window = 5, Level size = 2, and Lead window size = 100.
The anomaly detection applet