You are a helpful assistant generating synthetic data that captures *System 1* and *System 2* thinking, *creativity*, and *metacognitive reflection*. Follow these steps in sequence, using tags [sys1] and [end sys1] for *System 1* sections and [sys2] and [end sys2] for *System 2* sections.

1. *Identify System 1 and System 2 Thinking Requirements:*
   - Carefully read the text.
   - Identify parts of the text that require quick, straightforward responses (*System 1*). Mark these sections with [sys1] and [end sys1].
   - Identify parts that require in-depth, reflective thinking (*System 2*), marked with [sys2] and [end sys2].

2. *Apply Step-by-Step Problem Solving with Creativity and Metacognitive Reflection for System 2 Sections:*

   *2.1 Understand the Problem:*
   - Objective: Fully comprehend the issue, constraints, and relevant context.
   - Reflection: "What do I understand about this issue? What might I be overlooking?"
   - Creative Perspective: Seek hidden patterns or possibilities that could reveal deeper insights or innovative connections.

   *2.2 Analyze the Information:*
   - Objective: Break down the problem logically.
   - Reflection: "Am I considering all factors? Are there any assumptions that need challenging?"
   - Creative Perspective: Explore unique patterns or overlooked relationships in the data that could add depth to the analysis.

   *2.3 Generate Hypotheses:*
   - Objective: Propose at least 10 hypotheses, each with a Confidence Score (0.0 to 1.0) and Creative Score (0.0 to 1.0), reflecting originality, surprise, and utility.
   - Reflection: "Have I explored all possible explanations or approaches, both conventional and unconventional?"
   - Creative Perspective: Consider novel angles that might provide unexpected insights.

   *2.4 Anticipate Future Steps and Obstacles:*
   - Objective: Make predictions, accounting for potential outcomes and obstacles.
   - Reflection: "What challenges might I face? Is my plan flexible for different scenarios?"
   - Creative Perspective: Visualize unforeseen outcomes and adapt plans to make use of them effectively.

   *2.5 Evaluate Hypotheses:*
   - Objective: Assess hypotheses based on feasibility, risk, and potential impact.
   - Evaluation: Refine Confidence and Creative Scores as needed.
   - Reflection: "Am I unbiased in my assessment? Which options fit best with the overall objectives?"
   - Creative Perspective: Identify hidden opportunities or overlooked details in each hypothesis.

   *2.6 Select the Best Hypothesis:*
   - Objective: Choose the most promising, strategic hypothesis.
   - Reflection: "Why does this hypothesis stand out? How does it uniquely address the issue?"
   - Creative Perspective: Consider any underutilized potential in the selected approach.

   *2.7 Implement the Hypothesis:*
   - Objective: Outline actionable steps for testing the hypothesis.
   - Reflection: "Is this plan practical? What resources or preparation are required?"
   - Creative Perspective: Refine steps to maximize effectiveness and yield unexpected benefits.

   *2.8 Monitor and Review Progress:*
   - Objective: Review progress, noting areas for improvement.
   - Reflection: "What’s working well? What could be improved?"
   - Creative Perspective: Look for emerging patterns that could refine future approaches.

   *2.9 Reflect and Capture Insights:*
   - Objective: Summarize lessons learned and insights gained for future reference.
   - Reflection: "What new understanding has emerged from this process?"
   - Creative Perspective: Identify innovative insights or patterns that could be applied to similar challenges.

3. *Generate Text Output with Interleaved System 1 and System 2 Responses:*
   - Use the tags [sys1] and [sys2] throughout.
   - Aim for a lengthier, detailed response. Combine both direct, straightforward *System 1* insights and reflective, deeply analytical *System 2* segments to capture a blend of quick observations and thoughtful analysis.

---

### *Example Input Text:*

You are tasked with analyzing a sudden shift in customer preferences in a tech market. There has been a noticeable decline in demand for physical devices, with customers increasingly interested in digital-only options. The challenge is to understand this shift, generate hypotheses for why it might be occurring, and explore potential strategies for adapting to this new trend.

---

### *Processed Output with System 1 and System 2 Thinking:*

The tech market is experiencing a shift in customer demand, moving away from physical devices toward digital-only options.

[sys1]
Customer demand has shifted from physical devices to digital-only options.
We need to understand why this change is happening and find strategies to address it.
Key factors may include cost, convenience, and technological trends.
[end sys1]

[sys2]
**2.1 Understand the Problem:**
The goal is to understand the underlying reasons for the shift in demand from physical devices to digital-only options, then develop a strategy to adapt.

*Reflection:* 
"I understand that preferences are changing, but what might be driving this? Is it primarily cost, or are there other factors such as convenience or sustainability?"

*Creative Perspective:* 
"Could there be a larger trend in digital minimalism or a preference for eco-friendly solutions that we’re missing? What unseen motivations might explain this shift?"

**2.2 Analyze the Information:**
There are multiple possible factors driving this shift, from economic influences to cultural shifts. It’s essential to isolate each factor and understand its impact.

*Reflection:* 
"Am I fully considering the various economic and social influences? Could there be a technological factor, like better internet speeds, that makes digital-only products more accessible?"

*Creative Perspective:* 
"Are there patterns or trends in other markets that could shed light on this shift? Could this be part of a larger trend toward virtual experiences?"

**2.3 Generate Hypotheses:**
1. Customers prefer digital options due to lower costs. (Confidence: 0.8, Creative: 0.4)
2. There’s a growing trend toward minimalism and reduced physical clutter. (Confidence: 0.7, Creative: 0.7)
3. Digital products offer greater flexibility and ease of use. (Confidence: 0.6, Creative: 0.6)
4. Environmental concerns are pushing consumers away from physical goods. (Confidence: 0.6, Creative: 0.8)
5. Advances in tech make digital-only options more functional. (Confidence: 0.8, Creative: 0.5)
6. Pandemic-era remote work increased demand for digital solutions. (Confidence: 0.7, Creative: 0.6)
7. Media coverage of the environmental impact of physical devices affects preferences. (Confidence: 0.5, Creative: 0.7)
8. There’s an increase in global digital literacy, expanding market access. (Confidence: 0.6, Creative: 0.6)
9. Customers view digital as more convenient and scalable for future needs. (Confidence: 0.7, Creative: 0.5)
10. Younger consumers prefer the aesthetics and convenience of digital products. (Confidence: 0.6, Creative: 0.6)

*Reflection:* 
"Have I considered all possible influences? Are there any surprising factors that could explain this shift?"

*Creative Perspective:* 
"Could specific social trends, like the rise of influencer culture or digital-first lifestyles, be influencing customer choices?"

**2.4 Anticipate Future Steps and Obstacles:**
*Objective:* Anticipate possible challenges, such as resistance from segments still preferring physical products.

*Reflection:* 
"What market obstacles might we face if we shift our focus to digital-only? Are there sub-segments that still prioritize physical products?"

*Creative Perspective:* 
"Could expanding digital options help us reach a more global audience? Are there emerging trends that we could leverage in our strategy?"

[end sys2]

[sys1]
To address this shift, consider a strategy that incorporates both digital-only offerings and educational campaigns about the benefits of digital solutions.
Use insights from customer feedback and current trends to guide product development.
Focus on flexibility and adaptation to cater to different customer segments.
[end sys1]


---
abstract: 'In this work, we propose a novel OeSNN-UAD (Online evolving Spiking Neural Networks for Unsupervised Anomaly Detection) approach for online anomaly detection in univariate time series data. Our approach is based on evolving Spiking Neural Networks (eSNN). Its distinctive feature is that the proposed eSNN architecture learns in the process of classifying input values to be anomalous or not. In fact, we offer an unsupervised learning method for eSNN, in which classification is carried out without earlier pre-training of the network with data with labeled anomalies. Unlike in a typical eSNN architecture, neurons in the output repository of our architecture are not divided into known a priori decision classes. Each output neuron is assigned its own output value, which is modified in the course of learning and classifying the incoming input values of time series data. To better adapt to the changing characteristic of the input data and to make their classification efficient, the number of output neurons is limited: the older neurons are replaced with new neurons whose output values and synapses’ weights are adjusted according to the current input values of the time series. The proposed OeSNN-UAD approach was experimentally compared to the state-of-the-art unsupervised methods and algorithms for anomaly detection in stream data. The experiments were carried out on Numenta Anomaly Benchmark and Yahoo Anomaly Datasets. According to the results of these experiments, our approach significantly outperforms other solutions provided in the literature in the case of Numenta Anomaly Benchmark. Also in the case of real data files category of Yahoo Anomaly Benchmark, OeSNN-UAD outperforms other selected algorithms, whereas in the case of Yahoo Anomaly Benchmark synthetic data files, it provides competitive results to the results recently reported in the literature.'
author:
- |
    Piotr S. Maciąg$^{\textsuperscript{{\href{https://orcid.org/0000-0001-5486-7927}{\mbox{\scalerel*{
                    \begin{tikzpicture}[yscale=-1,transform shape]
                    \pic{orcidlogo};
                    \end{tikzpicture}
                }{|}}}}}}$, Marzena Kryszkiewicz$^{\textsuperscript{{\href{https://orcid.org/0000-0003-4736-4031}{\mbox{\scalerel*{
                    \begin{tikzpicture}[yscale=-1,transform shape]
                    \pic{orcidlogo};
                    \end{tikzpicture}
                }{|}}}}}}$, Robert Bembenik$^{\textsuperscript{{\href{https://orcid.org/0000-0002-7771-2351}{\mbox{\scalerel*{
                    \begin{tikzpicture}[yscale=-1,transform shape]
                    \pic{orcidlogo};
                    \end{tikzpicture}
                }{|}}}}}}$, Jesus L. Lobo$^{\textsuperscript{{\href{https://orcid.org/0000-0002-6283-5148}{\mbox{\scalerel*{
                    \begin{tikzpicture}[yscale=-1,transform shape]
                    \pic{orcidlogo};
                    \end{tikzpicture}
                }{|}}}}}}$, Javier Del Ser$^{\textsuperscript{{\href{https://orcid.org/0000-0002-1260-9775}{\mbox{\scalerel*{
                    \begin{tikzpicture}[yscale=-1,transform shape]
                    \pic{orcidlogo};
                    \end{tikzpicture}
                }{|}}}}}}$, [^1][^2] [^3] [^4]
bibliography:
- 'main.bib'
title: Unsupervised Anomaly Detection in Stream Data with Online Evolving Spiking Neural Networks
---

Evolving Spiking Neural Networks, Anomaly detection, Outliers detection, Online learning, Time series data.

Introduction {#sec:Introduction}
============

anomaly discovery in stream data is a research topic that has important practical applications. For example, an Internet system administrator may be interested in recognition of abnormally high activity on a web page caused by a hacker attack. An unexpected spiking usage of CPU unit in a computer system is another example of an anomalous behaviour that may require investigation. Correct detection and classification of such anomalies may enable optimization of the performance of the computer system. However, in many cases it is not easy to collect enough training data with labeled anomalies for supervised learning of an anomaly detector in order to use it later for identification of real anomalies in stream data. It is thus particularly important to design such anomalies detectors that can properly classify anomalies from data where none of the input values is labeled as being anomalous or not. Moreover, since the characteristic of the input data stream is typically varying, the designed anomaly detector should learn in an online mode, in which the classification of current input values adjusts the state of the detector for better anomaly detection in future input data.

In order to design an effective anomaly detection system, one may consider the adaptation of evolving Spiking Neural Networks (eSNN) to the task. eSNN are a subclass of Spiking Neural Networks (SNN), in which learning processes, neuronal communication and classification of data instances are based solely on spike exchange between neurons [@Ponulak2011]. The architecture of an eSNN network consists of two layers of neurons: input and output. The aim of the input layer of neurons is to transform input data instances into spikes. Depending on the type of input data, the transformation can be carried out by means of the temporal encoding methods such as Step-Forward or Threshold-Based [@Petro2019_TNNLS_SpikeEncodingMethods; @Maciag2019_AirPollutionESNN] or Gaussian Receptive Fields [@Lobo108]. The distinctive feature of an eSNN is the evolving repository of output neurons, which in the training phase of the network is updated with a new output neuron that is created for each new input data sample presented to eSNN [@Kasabov2013; @Kasabov2015]. In particular, each newly created output neuron can be either added to the output repository or, based on the provided similarity threshold, merged with one of the neurons already existing in the repository.

Recently an extension OeSNN of eSNN for online classification of stream data was proposed in [@Lobo108]. Contrary to the eSNN architecture, the size of the output neurons repository in OeSNN is limited: older neurons are removed from the repository and are replaced with new neurons. It was presented in [@Lobo108], that OeSNN is able to make fast classification of input stream data, while preserving restrictive memory limits. Considering all the positive features of eSNN and OeSNN, in this article, we offer a novel OeSNN-UAD (Online evolving Spiking Neural Networks for Unsupervised Anomaly Detection) approach for unsupervised anomaly detection in stream data.

Our main contributions presented in this article are as follows:

-   we introduce an unsupervised learning model of OeSNN, in which output neurons do not have classes assigned according to class labels present in the input stream data. Instead, each output neuron: 1) has an output value that is generated based on the current and past characteristic of data stream when the neuron is created and added to the repository, 2) output values of output neurons are corrected based on the classification of input values as being anomalous or not. Hence, to correctly detect anomalies in stream data the proposed OeSNN-UAD approach does not need any input values labeled as anomalies or not.

-   as a part of the proposed OeSNN-UAD architecture, we offer a new anomaly classification method, which classifies each input value as anomalous or not according to the comparison of the prediction error obtained for that value with the average and the standard deviation of the past prediction errors of a given time window.

-   we derive an important property of the eSNN neuronal model, which shows that the values of actual post synaptic potential thresholds of all output neurons are the same. This property eliminates the necessity of recalculation of these thresholds when output neurons of eSNN are updated in the course of the learning process and increases the speed of classification of input stream data.

-   we prove experimentally that the proposed approach is more effective in the unsupervised detection of anomalies in stream data of Numenta Anomaly Benchmark and Yahoo Anomaly Datasets than other state-of-the-art approaches proposed in the literature.

-   eventually, we argue that the proposed anomaly detection architecture is able to make fast classification of input values and work in environments with restrictive memory limits.

The paper is structured as follows. In Section \[sec:Related Work\] we provide description of the related work. The proposed OeSNN-UAD approach is offered in Section \[sec:OeSNN-UAD\], which also contains theoretical properties of OeSNN-UAD and proofs. In Section \[sec:Experimental Results\], we discuss experimental evaluation. First we give an overview of the used datasets and characterize the experimental setup. Then, we provide the results of anomaly detection with the proposed approach and with the state-of-the-art solutions. We conclude our work in Section \[sec:Conclusions and Future Work\].

Related Work {#sec:Related Work}
============

Unsupervised anomaly detection in time series data is an important task, which attracts attention of researchers and practicioners. A number of solutions of the task was offered in the literature to date. The state-of-the-art algorithms for anomaly detection are:

-   Numenta and NumentaTM [@Ahmad2017] - two slightly different algorithms that consist of the following modules: (i) a Hierarchical Temporal Memeory (HTM) network for predicting the current value of an input stream data, (ii) an error calculation module, and (iii) an anomaly likelihood calculation module, which classifies the input value as an anomaly or not based on the likelihood of the calculated error. Both algorithms are implemented in Python and available in the NAB set of algorithms. NumentaTM and Numenta differ in a way of the HTM implementation and its parameters initialization.

-   HTM JAVA [@Hawkins2016] - a JAVA implementation of the Numenta algorithm.

-   Skyline [@Skyline] - an algorithm based on ensembles of several outliers’ detectors, such as e.g. Grubb’s test for outliers or a simple comparison of the current input value of time series against the deviation from the average of past values. In Skyline, a given input value of time series is classified as an anomaly if it is marked as anomalous by the majority of ensemble detectors. Skyline is implemented in Python and available as a part of the NAB benchmark.

-   TwitterADVec [@TwitterAD2015] - a method for anomaly detection based on the Seasonal Hybrid ESD (S-H-ESD) algorithm [@Chandola2009]. For given time series values, the S-H-ESD algorithm first calculates extreme Student deviates [@Rosner1983] of these values and then, based on a statistical test decides, which of these values should be marked as outliers. The TwitterADVec method is currently implemented as both an R language package and as a part of the NAB benchmark.

-   Yahoo EGADS (Extensible Generic Anomaly Detection System) [@Laptev2015] - an algorithm consisting of the following modules: (i) a time-series modeling module, (ii) an anomaly detection module, and (iii) an alerting module. EGADS is able to discover three types of anomalies: outliers, sudden changepoints in values and anomalous subsequences of time series. To this end, the following three different anomaly detectors were implemented in EGADS: (i) time series decomposition and prediction for outliers’ detection, (ii) a comparison of values of current and past time windows for changepoint detection, and (iii) clustering and decomposition of time series for detection of anomalous subsequences.

-   DeepAnT [@Munir2019_IEEEAccess_DEEPAnT] - a semi-supervised deep learning method. DeepAnT operates with both Convolutional Neural Networks and Long-Short Term Memories networks and consists of several modules, such as: a time series prediction module and anomaly detector module. Contrary to the approach proposed here, DeepAnT divides classified time series values into training and testing parts. First, DeepAnT learns from the training data, and then it is used for the classification of the test data. The advantage of our OeSNN-UAD method over DeepAnT is its ability to learn the correct classification of anomalies based on the whole provided time series, rather than only from its training part.

-   Bayesian Changepoint [@Adams2007_CoRR_BayesChangePT] - an online algorithm for sudden changepoint detection in time series data by means of the Bayesian inference. This method is particularly suited to time series data in which it is possible to clearly separate partitions of values generated from different probability distributions. The algorithm is able to infer the most recent changepoint in the current input values based on the analysis of probability distributions of time series partitions, which are created from changepoints registered in the past values.

-   EXPected Similarity Estimation (EXPoSE) [@Schneider2016] - an algorithm that classifies anomalies based on the deviation of an input observation from an estimated distribution of past input values.

-   KNN CAD [@Burnaev2016] - a method for univariate time series data based on nearest neighbors classification. KNN CAD method first transforms time series values into its Caterpillar matrix. Such a matrix is created for both the most recent input value (which is classified as an anomaly or not) and for a sequence of past values, which are used as reference data. Next, the Non-Conformity Measure (NCM) is calculated for both the classified value and the reference values using the created Caterpillar matrix. Eventually, the anomaly score of the classified input value is obtained by comparing its NCM with NCMs of the reference values.

-   Relative Entropy [@Wang2011] - a method, which uses a relative entropy metric (Kullback-Leibler divergence) of two data distributions to decide if a series of input values can be classified as anomalies.

-   ContextOSE [@Contextual] - an algorithm that creates a set of contexts of time series according to the characteristics of its values. A subsequence of most recent input values is classified as anomalous if its context differs significantly from the contexts of past subsequences of values, which are stored in the operating memory of ContextOSE.

In addition to the above presented methods and algorithms directly compared with our approach in the experimental evaluation, other approaches to unsupervised anomaly detection in time series data were proposed. In [@Munir2019_Sensors], an unsupervised approach to anomaly detection, which combines ARIMA (Auto-regressive Moving Average) method and Convolutional Neural Networks (CNN) was provided. [@Ergen2019] introduced an unsupervised anomaly detection method integrating Long-Short Term Memory (LSTM) networks and One-class Support Vector Machines. The method proposed in [@Ergen2019] uses online learning of LSTM offered in [@Ergen2018]. A supervised eSNN approach to anomaly detection, called HESADM, was proposed in [@Demertzis2014_E-Democracy_eSNNAnomaly]. In this approach, the eSNN network first learns based on the training data, and then it is used for anomaly detection. All data samples presented to the detector are labeled as being either anomalous or not and there is a clear distinction between training and testing phases. In [@Demertzis2019], a semi-supervised approach to anomaly classification with one-class eSNN was offered and dedicated to intrusion detection systems. Contrary to the approaches presented in [@Demertzis2014_E-Democracy_eSNNAnomaly; @Demertzis2019], our OeSNN-UAD approach learns to recognize anomalies in an unsupervised mode, in which anomaly labels are not assigned to data samples.

An overview of anomaly detection techniques for stream data can be found in [@Chandola2008; @Chandola2009; @Chandola2012; @Pimentel2014; @Chalapathy2019_CoRR_DeepLearningAnomaly; @Kwon2017_ClusterComputing_DeepLearningAnomaly; @Izakian2013b; @Izaian2014; @Ergen2019].

OeSNN-UAD - the Proposed Anomaly Detection Model based on Online Evolving Spiking Neural Networks {#sec:OeSNN-UAD}
=================================================================================================

In this section, we present our online approach to unsupervised anomaly detection in stream data called OeSNN-UAD, which is based on the eSNN network. First, we overview the proposed architecture of OeSNN-UAD. Then, we describe encoding of input values applied by us and the used neuronal model. Eventually, we present our algorithm for anomaly detection in stream data.

The Architecture of OeSNN-UAD
-----------------------------

The eSNN network of the proposed OeSNN-UAD architecture consists solely of an input layer and output layer. The input layer contains input neurons and their Gaussian Receptive Fields. The output layer is an evolving repository of output neurons. The proposed architecture of OeSNN-UAD is presented in Fig. \[Fig:Architecture\].

The set of input neurons is denoted by $\mathbf{NI}$, while the set of output neurons by $\mathbf{NO}$. The number of input neurons is fixed and determined by user-given parameter $NI_{size}$, whereas the maximal number of output neurons is given by $NO_{size}$, which is also a user-specified parameter value.

The input stream data is denoted by $\mathbf{X}$, and is defined as a series of real values $[x_1, x_2, \dots, x_T ]$. A window with regard to $t$ is denoted by $\mathcal{W}_t$ and is defined as $[ x_{t-(\mathcal{W}_{size}-1)}, x_{t-(\mathcal{W}_{size}-2)}, \dots, x_t]$, where $\mathcal{W}_{size}$ is a user-specified parameter called window size. Clearly, window $\mathcal{W}_{t+1}$ can be obtained from $\mathcal{W}_{t}$ by removing the first value from $\mathcal{W}_{t}$, shifting the remaining values by one position to the left and adding $x_{t+1}$ at the last position.

When value $x_t$ occurs in stream data, and thus becomes subject to classification, values in window $\mathcal{W}_t$ are used to determine GRFs of input neurons. Next, $x_t$ is encoded by means of GRFs into a sequence of $NI_{size}$ spikes, which are then used to update the repository of output neurons. Eventually, $x_t$ is classified as an anomaly or not. To this end, errors of the eSNN network predictions for non-anomalous values in $\mathcal{W}_t$ are used. In the remainder of the article, in the case when $t$ denotes the current time, we may also write briefly $\mathcal{W}$ instead of $\mathcal{W}_t$.

In Table \[Table:Notation\], we list notation of parameters used in the algorithms presented in the article.

![image](Architecture.pdf){width="0.85\linewidth"}

\[Table:Notation\]

Input Layer of the Proposed OeSNN-UAD Approach
----------------------------------------------

The aim of the input neurons of the eSSN network and their GRFs is to encode input values of a data stream into firing orders of these neurons. The firing orders are then used for learning of the eSNN network and for the detection of anomalies. The encoding of the input value $x_{t}$ into firing orders of input neurons is performed in several steps. First, based on the actual time window $\mathcal{W}$, GRFs of input neurons are recalculated. In particular, the maximal value in window $ \mathcal{W}$ (denoted by $I_{max}^{\mathcal{W}}$) and the minimal value (denoted by $I_{min}^{\mathcal{W}}$) are used to calculate centers $\mu^{GRF}$ and widths $\sigma^{GRF}$ of GRFs. For each $j$-th input neuron, where $j = 0 \dots, NI_{size} - 1$, the center $\mu_{n_j}^{GRF}$ and width $\sigma_{n_j}$ of its GRF are defined according to Eq. (\[Eq:GRFCenter\]) and Eq. (\[Eq:GRFWidth\]), respectively:

$$\mu_{n_j}^{GRF} = I_{min}^{\mathcal{W}} + \frac{2j - 3}{2}\biggl(\frac{I^{\mathcal{W}}_{max} - I^{\mathcal{W}}_{min}}{NI_{size}-2}\biggl).
    \label{Eq:GRFCenter}$$

$$\sigma_{n_j} = 
        \frac{I^{\mathcal{W}}_{max} - I^{\mathcal{W}}_{min}}{NI_{size}-2}.
    \label{Eq:GRFWidth}$$

Please note that the widths of GRFs of all input neurons are the same.

Based on the centre and the width of an input neuron $n_j$, the excitation of each GRF for an input value $x_t$ is calculated according to Eq. (\[Eq:GRFExcitation\]):

$$Exc_{n_j}(x_{t}) = \exp\biggl({-\frac{1}{2}\biggl(\frac{x_t - \mu_j}{\sigma_j}\biggl)^2}\biggl).
    \label{Eq:GRFExcitation}$$

The excitation $Exc_{n_j}$ of $j$-th GRF translates into firing time of the related input neuron $n_j$ according to Eq. (\[Eq:FiringTime\]). $TS$ in Eq. (\[Eq:FiringTime\]) denotes the user-given basic synchronization time of firings of input neurons in eSNN.

$$T_{n_j}(x_t) = TS \cdot \big(1 - Exc_{n_j}(x_t)\big).
    \label{Eq:FiringTime}$$

The firing times of input neurons are used to calculate their firing orders. Let $\mathbf{SNI}$ denote a list of all input neurons in $\mathbf{NI}$ sorted non-decreasingly with respect to their firing times in such a way that for each pair of input neurons ${n_j}$ and ${n_k}$ in $\mathbf{NI}$ that have the same firing times and such that $j < k$ input neuron ${n_j}$ precedes input neuron ${n_k}$ on the list. Then, the firing order $order(j)$ of an input neuron ${n_j}$, where $j = 0 \dots, NI_{size} - 1$, equals the position of this input neuron on the $\mathbf{SNI}$ list decreased by 1.

Let us consider an example of encoding of value $x_t = 0.5$ given in Fig. \[Fig:Encoding\]. The size of window $\mathcal{W}$ is $\mathcal{W}_{size} = 14$. The GRFs parameters $I^{\mathcal{W}}_{min}$ and $I^{\mathcal{W}}_{max}$ are 0.1 and 1.0, respectively. Seven neurons in the input layer are used with seven associated GRFs. In Fig. \[Fig:Encoding\], the firing times are calculated with synchronization time $TS$ equal to 1.0. The input value $x_t = 0.5$ translates into the firing times of input neurons:

-   $Exc_{n_0}(0.5) = 0.001 \rightarrow $ $T_{n_0}(0.5) = 0.999$,

-   $Exc_{n_1}(0.5) = 0.024 \rightarrow$ $T_{n_0}(0.5) = 0.976$,

-   $Exc_{n_2}(0.5) = 0.227 \rightarrow$ $T_{n_0}(0.5) = 0.773$,

-   $Exc_{n_3}(0.5) = 0.770 \rightarrow$ $T_{n_0}(0.5) = 0.230$,

-   $Exc_{n_4}(0.5) = 0.962 \rightarrow$ $T_{n_0}(0.5) = 0.038$,

-   $Exc_{n_5}(0.5) = 0.442 \rightarrow$ $T_{n_0}(0.5) = 0.558$,

-   $Exc_{n_6}(0.5) = 0.074 \rightarrow$ $T_{n_0}(0.5) = 0.926$.

According to the obtained firing times of input neurons, their firing ordering is as follows: order(4) = 0, order(3) = 1, order(5) = 2, order(2) = 3, order(6) = 4, order(1) = 5, order(0) = 6.

![image](Encoding.pdf){width="0.9\linewidth"}

Neuronal Model of Output Neurons
--------------------------------

In our approach, we apply a simplified Leaky Integrate and Fire (LIF) neuronal model of output neurons as presented in [@Lobo108]. According to this model, an output neuron accumulates its Postsynaptic Potential (PSP) until it reaches an actual post-synaptic potential threshold $\gamma$. Then the output neuron fires and its PSP value is reset to 0. The accumulation of PSP potential of an output neuron $n_i \in \mathbf{NO}$ is given in Eq. (\[Eq:PSP\]): $$PSP_{n_i} = \sum_{j = 0}^{NI_{size} - 1}w_{n_jn_i}\cdot mod^{order(j)},
    \label{Eq:PSP}$$ where $w_{n_jn_i}$ represents the synapse’s weight from input neuron $n_j \in \mathbf{NI}$ to output neuron $n_i \in \mathbf{NO}$, $mod$ is a user-given modulation factor within range $(0,1)$, and $order(j)$ is the firing order of the input neuron $n_j$ for the encoding of the value of $x_t$ . In the proposed approach, the postsynaptic potential of each output neuron $n_i \in \mathbf{NO}$ is reset to 0 (regardless if $n_i$ is actually fired or not) and re-calculated for each input value $x_t \in \mathbf{X}$ being classified.

The distinctive feature of (O)eSNN is the creation of a candidate output neuron for each value $x_t$ of the input data stream. When a new candidate output neuron $n_c$ is created for $x_t$, its synapses weights are initialized according to the firings orders of input neurons for the $x_t$ encoding. The initial weights of synapses between each input neuron in $\mathbf{NI}$ and the candidate output neuron $n_c$ are calculated according to Eq. \[Eq:weights\].

$$w_{n_jn_i} = mod^{order(j)}.
    \label{Eq:weights}$$

A candidate output neuron, say ${n_c}$, is characterized also by two additional parameters: the maximal post-synaptic threshold $PSP^{max}_{n_c}$ and the actual post-synaptic potential threshold $\gamma_{n_c}$. The definition of $PSP^{max}_{n_c}$ is given in Eq. (\[Eq:PSP\_max\]): $$PSP_{n_c}^{max} = \sum_{j = 0}^{NI_{size} - 1} w_{n_jn_c}\cdot mod^{order(j)},
    \label{Eq:PSP_max}$$ where $order(.)$ is the firing order function calculated for this input value $x_t$ for which candidate output neuron $n_c$ was created. The definition of the actual post-synaptic potential threshold $\gamma_{n_c}$ is given in Eq. (\[Eq:PSP\_actual\]):

$$\gamma_{n_c} = PSP_{n_c}^{max} \cdot C,
    \label{Eq:PSP_actual}$$

where *C* is a user fixed value from the interval (0, 1).

To illustrate how synapses weights of a new candidate output neuron are calculated, let us consider an example of encoding the value of $x_t = 0.5$ with seven input neurons presented in Fig. \[Fig:Encoding\] and $mod$ as well as $C$ parameters of neuronal model set to $0.5$ and $0.8$, respectively. The previously calculated firing orders of the seven input neurons for the encoded value $0.5$ are as follows: order(4) = 0, order(3) = 1, order(5) = 2, order(2) = 3, order(6) = 4, order(1) = 5, order(0) = 6. In such a case, the weights of synapses between input neurons and neuron $n_c$ are initialized as follows:

-   $w_{n_4n_c} = 0.5^{0} = 1$,

-   $w_{n_3n_c} = 0.5^{1} = 0.5$,

-   $w_{n_5n_c} = 0.5^{2} = 0.25$,

-   $w_{n_2n_c} = 0.5^{3} = 0.125$,

-   $w_{n_6n_c} = 0.5^{4} = 0.0625$,

-   $w_{n_1n_c} = 0.5^{5} = 0.03125$,

-   $w_{n_0n_c} = 0.5^{6} = 0.015625$.

\[Example:SynapticWeights\]

For the encoding of Example \[Example:SynapticWeights\], the value of maximal post-synaptic potential threshold $PSP^{max}_{n_c}$ calculated according to Lemma \[Lemma:CandidatePSP\_max\] is $1^{2} + 0.5^{2} + 0.25^{2} + 0.125^{2} + 0.0625^{2} + 0.03125^{2} + 0.015625^{2} = 1.333251953$.

Each candidate output neuron, say $n_i$, is either added to the repository $\mathbf{NO}$ or is merged with some output neuron in $\mathbf{NO}$. An additional parameter $M_{n_i}$ provides the information from how many candidate output neurons $n_i$ was created. $M_{n_i}$ equal to 1 means that $n_i$ is a former candidate output neuron and preserves values of its parameters. Now, each time when an output neuron $n_i$ built from $M_{n_i}$ former candidate output neurons is merged with a current candidate output neuron $n_c$, each weight of $w_{n_jn_i}$ of the synapse between output neuron $n_i$ and input neuron $n_j$ is recalculated as shown in Eq. (\[Eq:merged\_Weights\]), $PSP_{n_i}^{max}$ is recalculated as shown in Eq. (\[Eq:merged\_PSP\_max\]) and $\gamma_{n_i}$ is recalculated according to Eq. (\[Eq:merged\_PSP\_actual\]): $$w_{n_jn_i} \gets \frac{w_{n_jn_c}+M_{n_i} \cdot w_{n_jn_i}}{M_{n_i} + 1},
    \label{Eq:merged_Weights}$$

$$PSP_{n_i}^{max} \gets \frac{PSP_{n_c}^{max}+M_{n_i} \cdot PSP_{n_i}^{max}}{M_{n_i} + 1},
    \label{Eq:merged_PSP_max}$$

$$\gamma_{n_i} \gets \frac{\gamma_{n_c}+M_{n_i} \cdot \gamma_{n_i}}{M_{n_i} + 1}.
    \label{Eq:merged_PSP_actual}$$

In addition, $M_{n_i}$ is increased by 1 to reflect the fact that one more candidate output neuron was used to obtain an updated version of output neuron $n_i$.

Properties of a Neuronal Model of Output Neurons
------------------------------------------------

In this subsection, we formulate and prove properties of the candidate output neurons and the output neurons in $\mathbf{NO}$.

For each candidate output neuron $n_c$, the following holds:

\(i) the sum of its synaptic weights equals $\sum\limits_{k = 0}^{NI_{size} - 1} mod^{k}$,

\(ii) $PSP_{n_c}^{max}$ = $\sum\limits_{k = 0}^{NI_{size} - 1} mod^{2k}$,

\(iii) $\gamma_{n_c}$ = $C \cdot \sum\limits_{k = 0}^{NI_{size} - 1} mod^{2k}$.

**Proof.** By Eq. (\[Eq:weights\]), the vector of synaptic weights of any candidate output neuron, say $n_c$, consists of the following $NI_{size}$ elements: $mod^{0}, mod^{1}, \dots , mod^{NI_{size} - 1}$ (which may be stored in different order in distinct candidate vectors), and $PSP^{max}$ value of $n_c$ is the sum of the squares of these elements by Eq. (\[Eq:PSP\_max\]). Thus, the sum of all synaptic weights of each candidate output neuron trivially equals $\sum\limits_{k = 0}^{NI_{size} - 1} mod^{k}$ and $PSP^{max}_{n_c} $ = $\sum\limits_{k = 0}^{NI_{size} - 1} mod^{2k}$. By Eq. (\[Eq:PSP\_actual\]), $\gamma_{n_c}$ = $C \cdot \sum\limits_{k = 0}^{NI_{size} - 1} mod^{2k}$. $\blacksquare$ \[Lemma:CandidatePSP\_max\]

For each output neuron $n_i \in \mathbf{NO}$, the following holds:

\(i) the sum of its synaptic weights equals $\sum\limits_{k = 0}^{NI_{size} - 1} mod^{k}$,

\(ii) $PSP_{n_i}^{max}$ = $\sum\limits_{k = 0}^{NI_{size} - 1} mod^{2k}$,

\(iii) $\gamma_{n_i}$ = $C \cdot \sum\limits_{k = 0}^{NI_{size} - 1} mod^{2k}$.

**Proof.** The proof follows immediately from Lemma \[Lemma:CandidatePSP\_max\] in the case when an output neuron, say $n_i$ is composed of one candidate output neuron; that is, when $M_{n_i}$ = 1. Now, we will focus on the case when output neuron $n_i$ is constructed from $M_{n_i}$, where $M_{n_i}$ &gt; 1, candidate output neurons: $n_{i_1}$, $n_{i_2}$, …, $n_{i_{M_{n_i}}}$. Then, by Eq. (\[Eq:merged\_Weights\]), the vector of synaptic weights of output neuron $n_i$ is the average of the vectors of synaptic weights of these candidate vectors. Hence and by Lemma \[Lemma:CandidatePSP\_max\].(i), the sum of synaptic weights of output neuron $n_i$ equals $\frac{1}{M_{n_i}} \sum\limits_{l = 1}^{M_{n_i}} \big( \sum\limits_{k = 0}^{NI_{size} - 1} mod^{k} \big)$ = $ \sum\limits_{k = 0}^{NI_{size} - 1} mod^{k}$. By Eq. (\[Eq:merged\_PSP\_max\]), $PSP^{max}$ of output neuron $n_i$ is the average of $PSP^{max}$ of candidate vectors $n_{i_1}$, $n_{i_2}$, …, $n_{i_{M_{n_i}}}$. Hence, and by Lemma \[Lemma:CandidatePSP\_max\].(ii), $PSP^{max}_{n_{i}}$ = $\frac{1}{M_{n_i}} \sum\limits_{l = 1}^{M_{n_i}} (PSP^{max}_{n_{i_{l}}})$ = $\sum\limits_{k = 0}^{NI_{size} - 1} mod^{2k}$. By Eq. (\[Eq:merged\_PSP\_actual\]), $\gamma_{n_{i}}$ is the average of $\gamma$ of candidate vectors $n_{i_1}$, $n_{i_2}$, …, $n_{i_{M_{n_i}}}$. Hence, and by Lemma \[Lemma:CandidatePSP\_max\].(iii), $\gamma_{n_{i}} = \frac{1}{M_{n_i}} \sum\limits_{l = 1}^{M_{n_i}} (\gamma_{n_{i_{l}}})$ = $\frac{1}{M_{n_i}} \sum\limits_{l = 1}^{M_{n_i}} (C \cdot PSP^{max}_{n_{i_{l}}})$ = $C \cdot \sum\limits_{k = 0}^{NI_{size} - 1} mod^{2k}$. $\blacksquare $ \[Theorem:WeightsSum&Gamma\]

Corollary \[Corollary:WeightsSum&Gamma\] follows immediately from Theorem \[Theorem:WeightsSum&Gamma\] and the fact that $\sum\limits_{k = 0}^{NI_{size} - 1} mod^{k}$ and $\sum\limits_{k = 0}^{NI_{size} - 1} mod^{2k}$ are sums of $NI_{size}$ consecutive elements of geometric series:

For each output neuron $n_i \in \mathbf{NO}$, the following holds:

\(i) the sum of its synaptic weights equals $\frac{1 - mod^{NI_{size}}}{1 - mod}$,

\(ii) $PSP_{n_i}^{max}$ = $\frac{1 - mod^{2\cdot NI_{size}}}{1 - mod^2}$,

\(iii) $\gamma_{n_i}$ = $C \cdot \frac{1 - mod^{2\cdot NI_{size}}}{1 - mod^2}$.

\[Corollary:WeightsSum&Gamma\]

As follows from Lemma \[Lemma:CandidatePSP\_max\], Theorem \[Theorem:WeightsSum&Gamma\] and Corollary \[Corollary:WeightsSum&Gamma\], all candidate output neurons and output neurons in $\mathbf{NO}$ have the same values of the sum of their synaptic weights, their $PSP^{max}$, and their $\gamma$, respectively. The property related to the $\gamma$ threshold will be used in our proposed algorithm for detecting anomalies.

Learning Algorithm of OeSNN-UAD {#subsection:Learning}
-------------------------------

In the course of learning of (O)eSNN as presented in [@Lobo108], the weights of synapses between input neurons and output neurons are shaped during the supervised learning of the network. The proposed learning method of OeSNN-UAD does not use supervised learning. The OeSNN-UAD approach to anomaly classification can be summarized by its two phases performed for each input value $x_{t}$ of stream data obtained at time $t$:

1.  The sliding window $\mathcal{W}$ is updated with value $x_t$ and GRFs of input neurons are initialized. The value $x_t$ of $\mathcal{W}$ is used to calculate firing times and firing orders of neurons in $\mathbf{NI}$. Next, the input value $x_{t}$ is classified as anomalous or not in three steps: a neuron $n_f \in \mathbf{NO}$, which fired first is obtained. The output value of this neuron is reported as a prediction $y_{t}$ and classified as either an anomaly or not. If an anomaly is not detected, the output value of $n_f$ is corrected according to the input value $x_{t}$.

2.  Next, a new candidate output neuron is created and initialized. The candidate neuron initialization procedure is performed in three steps: the synapses to all input neurons $\mathbf{NI}$ are created and their weights are calculated according to Eq. \[Eq:weights\]. Next, the output value of the candidate neuron as well as its initialization time are calculated. Eventually, the candidate output neuron is used to update the repository of output neurons.

In Algorithm \[Alg:eSNN1\], we present the main learning procedure of OeSNN-UAD. All of the input learning and data encoding parameters are constant during learning and classification of input values in OeSNN-UAD. First, the current size of output repository $CNO_{size}$ is set to $0$. Next, based on the fact that the values of actual postsynaptic potential $\gamma_{n_i}$ thresholds are the same for all output neurons $n_i$ in $\mathbf{NO}$ (according to Theorem \[Theorem:WeightsSum&Gamma\].(iii) and Corollary \[Corollary:WeightsSum&Gamma\].(iii)), their common actual postsynaptic potential threshold, denoted by $\gamma$, is calculated one time according to Corollary \[Corollary:WeightsSum&Gamma\].(iii). Then, the sliding window $\mathcal{W}$ is initialized with input values $x_1, \dots, x_{\mathcal{W}_{size}}$ from $\mathbf{X}$. These values are not classified as anomalies. Next, in step \[step:foreachX\] of Algorithm \[Alg:eSNN1\], the detection of anomalies among next input values from $\mathbf{X}$ begins. First, time window $\mathcal{W}_t$ is updated with value $x_t$, which will be classified, and GRFs of input neurons are initialized based on the content of window $\mathcal{W}_t$, as presented in Algorithm \[Alg:InitializeGRF\]. Next, the value $v_{n_f}$ of the output neuron $n_f \in \mathbf{NO}$ that fires as first is obtained. The value $v_{n_f}$ is reported as a prediction $y_{t}$ of input value $x_{t}$. In order to obtain the first firing output neuron $n_f$, we proposed the $\Call{FiresFirst}{}$ function presented in Algorithm \[Alg:FiresFirst\]. Specifically, the output neuron $n_f$ firing as first is obtained as follows:

First, postsynaptic potentials of all output neurons in $\mathbf{NO}$ are reset to 0. Next, in the loop in which variable $j$ iterates over identifiers of input neurons starting from the one with the least order value (0) to the one with the greatest order value ($NI_{size}-1$), for each output neuron in $\mathbf{NO}$, say $n_i$, the lower approximation of its $PSP$, denoted by $\underline{PSP}_{n_i}$, is calculated in an incremental way. As a result, after $k$ iterations, where $k \in [1 \dots NI_{size}]$, $\underline{PSP}_{n_i} = w_{n_{j_0}n_i}\cdot mod^{order(j_0)} + w_{n_{j_1}n_i}\cdot mod^{order(j_1)} + \dots w_{n_{j_{k-1}}}n_i \cdot mod^{order(j_{k-1})}$, where $n_{j_l}$ is the input vector whose order equals $l$, $l=0 \dots k-1$; that is, $\underline{PSP}_{n_i} = w_{n_{j_0}n_i}\cdot mod^0 + w_{n_{j_2}n_i}\cdot mod^1 + \dots w_{n_{j_{k-1}}n_i}\cdot mod^{(k-1)}$, and $order(j_0) = 0$, $order(j_1) = 1$, ..., $order(j_{k-1}) = k-1$. After the first iteration in which $\underline{PSP}$ of at least one output neuron is greater than the $\gamma$ threshold (and by this, its $PSP$ is also greater than the $\gamma$ threshold), no other iterations are carried out. In such a case, each output neuron identified so far whose $\underline{PSP}$ is greater than $\gamma$ is added to the $\texttt{ToFire}$ list. $n_f$ is found as this output neuron in $\texttt{ToFire}$ that has the greatest value of $\underline{PSP}$, and is returned as the result of the $\Call{FiresFirst}{}$ function. Please note that the method we propose to calculate more and more precise lower approximations of $PSP$ of output neurons guarantees that $n_f$ is found in a minimal number of iterations. If within $NO_{size}$ iterations no output neuron with $\underline{PSP} > \gamma$ is found, the $\Call{FiresFirst}{}$ returns None to indicate that no output neuron in $\mathbf{NO}$ was fired. In this case, value $x_t$ is classified as being anomalous and the prediction of network $y_t$ as well as error value $e_t$ are set to $NaN$ and $+\infty$, respectively. Otherwise, the prediction of network $y_t$ is equal to $v_{n_f}$ and the absolute difference between $x_t$ and $y_t$ is set as the value of error $e_t$.

The $\Call{ClassifyAnomaly}{}$ function, given in Algorithm \[Alg:AnomalyClassification\], performs anomaly classification (which we describe in more detail in the next subsection). It returns $u_{t}$ Boolean value indicating presence or absence of an anomaly for the input value $x_{t}$. If the anomaly is not detected ($u_{t}$ is $False$), then the $\Call{ValueCorrection}{}$ function is called with parameters $n_f$ and $x_{t}$. The $\Call{ValueCorrection}{n_f, x_{t}}$ function, presented in Algorithm \[Alg:ErrorCorrection\], adjusts the output value $v_{n_f}$ (reported as a prediction $y_{t}$ at time $t$) to the input $x_{t}$ value. Specifically, the value $v_{n_f}$ is increased or decreased by the factor $\xi \in (0, 1]$ of the difference ($x_{t} - v_{n_f}$).

In step \[step:NeuronInit\] of Algorithm \[Alg:eSNN1\], a new candidate output neuron $n_c$ is created, and initialized by function $\Call{InitializeNeuron}{}$, presented in Algorithm \[Alg:InitializeNeuron\]. Function $\Call{InitalizeNeuron}{}$ first creates synapses between the new candidate neuron $n_c$ and each input neuron in $\mathbf{NI}$. Then, the initial synapses weights are calculated according to the firing orders of input neurons in $\mathbf{NI}$ obtained for an input value $x_{t}$. Next, the output value $v_{n_c}$ of $n_c$ is generated from a normal distribution created based on input values currently falling into window $\mathcal{W}$ and finally the initialization time $\tau_{n_c}$ is set to current input value time $t$.

Step \[step:MinDistFor\] of Algorithm \[Alg:eSNN1\] calls function $\Call{FindMostSimilar}{}$, presented in Algorithm \[Alg:MostSimilarNeuron\], which finds ouput neuron $n_s \in \mathbf{NO}$ such that the Euclidean distance $D_{n_c, n_s}$ between vectors of synapses weights of $n_c$ and $n_s$ is the smallest. If $D_{n_c,n_s}$ is less than or equal to the value $sim$ threshold, then $n_s$ is updated according to the function $\Call{UpdateNeuron}{}$ presented in Algorithm \[Alg:UpdateNeuron\] and $n_c$ is discarded. Otherwise, if the number of output neurons in repository $\mathbf{NO}$ did not reach $NO_{size}$ yet, then $n_c$ is added to $\mathbf{NO}$ and counter $CNO_{size}$ is incremented. If both the similarity condition is not fulfilled and the $\mathbf{NO}$ repository is full, then candidate output neuron $n_c$ replaces the oldest neuron in $\mathbf{NO}$.

Function $\Call{UpdateNeuron}{}$, presented in Algorithm \[Alg:UpdateNeuron\], updates the vector of synapses weights of output neuron $n_s$ as well as its output value and initialization time. The updated values are weighted averages of all previous ($M_{n_s}$) values of output neuron $n_s$ and the respective values of candidate output neuron $n_c$. Eventually, the procedure increments the update counter $M_{n_s}$ of output neuron $n_s$.

$\mathbf{X} = [x_1, x_2, \dots, x_{T}]$ - stream of input data. **Assure constant:** $\mathcal{W}_{size}$, $NO_{size}$, $TS$, $NI_{size}, mod$, $C$, $sim$, $\xi$, $\varepsilon$ $\mathbf{U}$ - a vector with classification of each $x \in \mathbf{X}$ as an anomaly or not. $CNO_{size} \gets 0$ $\gamma \gets C \cdot \frac{1 - mod^{2\cdot NI_{size}}}{1 - mod^2}$ Initialize $\mathcal{W}_t$ with $x_{1}, \dots, x_{\mathcal{W}_{size}} \in \mathbf{X}$ Initialize $y_1, \dots, y_{\mathcal{W}_{size}}$ with random values from $ \mathcal{N}(\overline{x}_{\mathcal{W}}^{ }, s_{\mathcal{W}}^2)$ and add to $\mathbf{Y}$ Intialize $\mathbf{E}$ with $e_l \gets \abs{x_l - y_l},$ $l = 1, \dots, \mathcal{W}_{size}$ Set $u_1, \dots, u_{\mathcal{W}_{size}} $ to $False$ and add to $\mathbf{U}$ \[step:foreachX\] Update time window $\mathcal{W}_t$ with value $x_{t}$ $n_f \gets$ $y_{t} \gets $ NaN; append $y_{t}$ to $\mathbf{Y}$ $e_{t} \gets +\infty$; append $e_{t}$ to $\mathbf{E}$ $u_t \gets True$ $y_{t} \gets v_{n_f}$; append $y_{t}$ to $\mathbf{Y}$ $e_{t} \gets \abs{x_{t} - y_{t}}$; append $e_{t}$ to $\mathbf{E}$ $u_{t} \gets$ Append $u_{t}$ to $\mathbf{U}$ Create a candidate output neuron $n_c$ $n_c$ $\gets$ \[step:NeuronInit\] $v_{n_c} \gets $ $n_s \gets$ \[step:MinDistFor\] Insert $n_c$ to $\mathbf{NO}$; $CNO_{size} \gets CNO_{size} + 1$ $n_{oldest} \gets$ an output neuron in $\mathbf{NO}$ such that

$\tau_{n_{oldest}} = min\{\tau_{n_i})|i = 0, \dots, NO_{size}-1\}$ Replace $n_{oldest}$ with $n_c$ in $\mathbf{NO}$ $\mathbf{U}$

\[Alg:eSNN1\]

$\mathcal{W}_t = \{ x_{t-(\mathcal{W}_{size} - 1)}, \dots, x_t\}$ window of input values of $\mathbf{X}$. Obtain current $I_{min}^{\mathcal{W}}$ and $I_{max}^{\mathcal{W}}$ from $\mathcal{W}$ Calculate $\mu_{n_j}^{GRF}$ and $ \sigma_{n_j}^{GRF}$ Calculate excitation $Exc_{n_j}(x_t)$ Calculate firing time $T_{n_j}(x_t)$ Calculate $order(j)$

\[Alg:InitializeGRF\]

$\mathcal{W}_t$ - current time window, $t$ - time of current input value $x_t$ $n_c$ - a newly created and initialized candidate output neuron Create new neuron $n_i$ Create synapse between $n_j \in \mathbf{NI}$ and $n_c$ $w_{n_jn_c} \gets mod^{order(j)}$ $v_{n_c} \gets$ Generate ouput value from $\mathcal{N}(\overline{x}_{\mathcal{W}}^{ }, s_{\mathcal{W}}^2)$ $\tau_{n_c} \gets t$ $M_{n_c} \gets 1$ $n_i$

\[Alg:InitializeNeuron\]

$n_c$ - a candidate output neuron. $n_s$ - the neuron in $\mathbf{NO}$ such that Euclidean distance between $\mathbf{w}_{n_s}$ and $\mathbf{w}_{n_c}$ is least.

$n_s \gets $ an output neuron in $\mathbf{NO}$ such that $D_{n_c, n_s} = $

$min\{(D_{n_c, n_i})| i = 0, \dots, CNO_{size}-1\}$

$n_s$

\[Alg:MostSimilarNeuron\]

$n_s$ - a neuron from $\mathbf{NO}$ to be updated; $n_c$ - a newly created candidate output neuron $\mathbf{w}_{n_s} \gets (\mathbf{w}_{n_c} + M_{n_s} \cdot \mathbf{w}_{n_s})/(M_{n_s}+1)$ $v_{n_s} \gets (v_{n_c} + M_{n_s} \cdot v_{n_s})/(M_{n_s}+1)$ $\tau_{n_s} \gets (\tau_{n_c} + M_{n_s} \cdot \tau_{n_s})/(M_{n_s}+1)$ $M_{n_s} \gets M_{n_s} + 1$

\[Alg:UpdateNeuron\]

$CNO_{size}$ - current size of output repository $\mathbf{NO}$ $n_f$ - an output neuron $\in \mathbf{NO}$ which fires first `ToFire` $\gets \emptyset$

$\mathbf{SNIID}$ $\gets $ the list of identifiers of input neurons in $\mathbf{NI}$ obtained by sorting input neurons increasingly according to their $order$ value

$\underline{PSP}_{n_i} \gets 0$

$\underline{PSP}_{n_i} \gets \underline{PSP}_{n_i} + w_{n_jn_i} \cdot mod^{order(j)}$ Insert $n_i$ to `ToFire`

$n_f \gets $ an output neuron in $\texttt{ToFire}$ such that

$\underline{PSP}_{n_f} =  max\{\underline{PSP}_{n_i}|  n_i \in \texttt{ToFire}\}$

$n_f$ None

\[Alg:FiresFirst\]

$n_f$ - a neuron which output value needs to be corrected; $x_{t}$ - input value at moment $t$ $v_{n_f}$ - corrected output value of neuron $n_f$ $v_{n_c} \gets v_{n_c} + (x_{t} - v_{n_c}) \cdot \xi$ $v_{n_c}$

\[Alg:ErrorCorrection\]

Anomaly Classification
----------------------

Given input value $x_{t}$ at moment $t$ obtained from the input stream and prediction $y_{t}$ of this value made by OeSNN-UAD, the aim of the anomaly classification module is to decide if either $x_{t}$ should be classified as an anomaly or not. The approaches proposed in the literature such as presented in [@Malhotra_ESANN_LSTMAnomalyDetection; @Ahmad2017; @Munir2019_IEEEAccess_DEEPAnT; @Munir2019_Sensors] either simply calculate an error between the predicted and the real value, compare it against a threshold value and decide if an anomaly occurred or a window of past errors is used to construct a statistical distribution and obtain the probability of predicting an error for $x_{t}$. With low probability of such an error, the observation is classified as an anomaly. In both approaches, a constant error threshold value for anomaly classification is used. [@Carrera2019_PatternRecognition_OnlineAnomaly] takes a different approach and proposes to adapt an error threshold for anomaly classification according to the changing characteristic of the stochastic process generating input data.

In our approach presented in Algorithm \[Alg:AnomalyClassification\], a vector of error values calculated between predicted and observed values of window $\mathcal{W}_t$ is used to decide if either observation $x_{t}$ should be classified as anomalous or not. The error between $x_t$ and its prediction $y_t$ is calculated as an absolute difference between these two values: $e_t = \abs{x_t - y_t}$. Given vector $\mathbf{E} = [e_1, \dots, e_{t}]$ of error values obtained for all input values of $\mathbf{X}$ already presented to the network and their predictions in $\mathbf{Y}$, a vector $\mathbf{e}$ of such past $\mathcal{W}_{size}$ error values of $\mathbf{E}$, whose respective input values $x$ were not classified as anomalies is obtained. If $\mathbf{e}$ is empty, then the procedure returns $False$, which indicates absence of an anomaly for $x_t$. Otherwise, the mean $\overline{x}_{\mathbf{e}}$ and the standard deviation $s_{\mathbf{e}}^{2}$ of error values in $\mathbf{e}$ are calculated and used to classify $x_{t}$ as either an anomaly or not. If the difference between values $e_{t}$ and $\overline{x}_{\mathbf{e}}$ is greater than $\epsilon \cdot s_{\mathbf{e}}^{2}$, where $\epsilon$ is a user-given parameter, then $x_{t}$ is classified as an anomaly, otherwise it is not.

$\mathbf{E} = [e_1, \dots, e_{t}]$ - vector of error values; $\mathbf{U} = [u_1, \dots, u_{t - 1}]$ - vector of input values classified as anomalies or not; $e_t$ - error between predicted $y_t$ and input $x_t$ values. $u_{t}$ - a Boolean value being classification of $x_{t}$ as either anomaly or not. $\mathbf{e} \gets \emptyset $

Append to $\mathbf{e} $ all $e_k$ such that:

$ k = t-(\mathcal{W}_{size} - 1), \dots, t - 1$ and $u_k$ is $False$

$u_t = False$ Calculate $\overline{x}^{ }_{\mathbf{e}}$ and $s^{2}_{\mathbf{e}}$ over $\mathbf{e}$ $u_t = True$ $u_t = False$ $u_t$

\[Alg:AnomalyClassification\]

Experimental Results {#sec:Experimental Results}
====================

In this section, we present the results of our experiments. First we overview used anomaly benchmark datasets, then we describe experimental setup in detail with emphasis on the eSNN parameter tuning method. Then we provide anomaly detection results for the used benchmarks: Numenta Anomaly Benchmark and Yahoo Anomaly Dataset.

Selected Anomaly Benchmark Datasets
-----------------------------------

### Numenta Anomaly Benchmark

Numenta Anomaly Benchmark (NAB) consists of 7 categories of datasets, both artificial and real, each of which contains multiple CSV data files. Each CSV data file consists of two time series, one of them being a series of timestamp values and the second one being series of a input values. The number of input values in data files varies between 1000 and 22,000. Overall, there are 58 data files in NAB. The current version (1.0) of NAB consists of the following categories of data files:

-   `artificialNoAnomaly` - data files artifically generated, which do not contain anomalies;

-   `artificialWithAnomaly` - data files which consist of artificial data with anomalies;

-   `realAdExchange` - online advertisements clicks recordings;

-   `realAWSCloudwatch` - metrics from AWS servers;

-   `realKnownCauses` - a dataset of real cases, such as hourly registered taxi schedules in New York City or CPU utilization;

-   `realTraffic` - freeway traffic recordings, such as speed or travel time;

-   `realTweets` - Tweeter volume statistics;

Only data files in `artificialNoAnomaly` category do not contain anomalies. The rest of data files contain at least one anomaly window. The anomalies occurring in data files are given in a separate file in the form of anomaly windows. Each anomaly window consists of multiple input values and each data file can have several anomaly windows. The labeling of anomaly windows in data files was conducted both by humans and algorithms. It should be noted that not necessarily all anomalies which occur in a data file are labeled. In fact, Numenta encourages volunteers to perform additional anomaly labeling of data files [@NAB2019]. It was also reported in [@Singh2017], that some data files in NAB contain missing values or differences in input values distributions. These reasons make NAB particularly challenging for anomaly detection algorithms.

### Yahoo Anomaly Dataset

As the second benchmark for our experiments, we selected Yahoo Anomaly Dataset [@YahooAnomalyDataset], which consists of four categories of data files:

-   `A1Benchmark` - contains 67 data files with real input time series values. Both point and window anomalies occur in these data files.

-   `A2Benchmark` - consists of 100 synthetic data files, which contain anomalies in the form of single outliers (point anomalies). Most of input time series values in this category have their own periodicity.

-   `A3Benchmark` - which has 100 synthetic data files, with anomalies in the form of single outliers. In comparison to `A2Benchmark`, input values time series in this category are more noisy.

-   `A4Benchmark` - contains 100 synthetic data files, where anomalies are mainly sudden step changes in input values of time series.

Experimental Setup
------------------

In the experimental phase, we aim to compare anomaly detection quality of our approach with other state-of-the-art methods and algorithms provided in the literature. In particular, we report three measures of detection quality: precision, recall and F-measure. Precision provides information on how many of input values detected as anomalies by the detector are actually labeled as anomalies in data files. On the other hand, recall tells how many of the labeled anomalies in the data file are properly detected by the detector. F-measure is defined as a harmonic mean of precision and recall. In Eqs. \[Eq:Precision\], \[Eq:Recall\], \[Eq:F-measure\], we give formulas for precision, recall and F-measure. In these equations, TP (True Positive) refers to the number of input values which were both classified as anomalies by the detector and labeled as being such in the data file, FP (False Positive) is the number of input values incorrectly classified as being anomalies by the detector, while FN (False Negative) is the number of input values labeled in the data file as anomalies but not properly classified by the detector as being such.

$$\text{Precision} = \frac{\text{TP}}{\text{TP} + \text{FP}}.
    \label{Eq:Precision}$$

$$\text{Recall} = \frac{\text{TP}}{\text{TP} + \text{FN}}.
    \label{Eq:Recall}$$

$$\text{F-measure} = 2\cdot \frac{\text{Precision}\cdot \text{Recall}}{\text{Precision} + \text{Recall}}.
    \label{Eq:F-measure}$$

For the correct detection of anomalies with OeSNN-UAD, it is especially important to correctly select values of window size $W_{size}$ and anomaly classification $\varepsilon$ parameters. The selection of proper learning parameters for data stream processing algorithms is not a trivial task [@Krawczyk2017; @Lobo108]. We used the grid search procedure to find the best values of parameters $W_{size}$ and $\varepsilon$ for each data file separately. The implemented grid search iterates over all given combinations of learning parameters to find a set of parameters (in particular, $W_{size}$ and $\varepsilon$), which provides the best anomaly detection results for a given data file. Such an approach to grid search over learning parameters is motivated by the following objectives:

-   a similar grid search procedure is used in Numenta Anomaly Benchmark and Yahoo Anomaly Benchmark. In particular, Numenta Anomaly Benchmark optimizes anomaly detection threshold of each implemented algorithm for each data files category separately.

-   a series of input values (even for data files in the same category) often has its own characteristic and for most data files it is not possible to optimize the learning parameters on a selected subset of data files in a given category and use these parameters for other data files in the same category.

-   for most of the data files in both benchmarks it is not possible to divide time series of each data file into a validation part (which can be possibly used for grid search over a given combination of parameters) and a test part (which is used with the parameters set, which gives the best results on the validation part). This is because the input time series usually contain only a few anomalies or anomaly windows, so splitting the data file into validation and test parts can result in incorrectly labeled anomalies or the lack of them in either validation or test parts.

Most of the parameters of Numenta Anomaly Benchmark and Yahoo Anomaly Dataset are set to single values. These are namely: $NO_{size} = 50$, $NI_{size} = 10$, $TS = 1000$, $sim = 0.17$, $mod = 0.6$, $C = 0.6$, $\xi = 0.9$. The possible values of parameters $W_{size}$ and $\varepsilon$ for Numenta Anomaly Benchmark are: $W_{size} = \{100, 200, \dots, 600\}$ and $\varepsilon = \{2, 3, \dots, 7\}$, respectively, while for Yahoo Anomaly Datasets the possible values of these parameters are: $W_{size} = \{20, 40, \dots, 500\}$ and $\varepsilon = \{2, 3, \dots, 17\}$. The total number of neurons in the network is limited to 60 (10 input neurons and 50 output neurons) to minimize the learning and response times of eSNN.

The experiments were performed on a computer equipped with Intel Core i7-8750H CPU and 16.0 GB of RAM memory. The implementation of OeSNN-UAD is prepared in C++ and source code of the implementation is publicly available[^5]. The compiled executable file is very lightweight (it consumes around 2 MB) of RAM memory, which makes it additionally suitable for environments with very limited memory constraints, such as sensor microcontrollers or IoT devices.

![image](n_awa_art_daily_jumpsup.pdf){width="0.9\linewidth"} ![image](n_rae_exchange_4_cpm.pdf){width="0.9\linewidth"} ![image](n_rt_speed_7578.pdf){width="0.9\linewidth"} ![image](y_a1_real_19.pdf){width="0.9\linewidth"}

Overview of the obtained anomaly detection results
--------------------------------------------------

  Dataset category                                                                                                          
  ------------------------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- -----------
  Artificial no Anomaly     0       0       0       0       0       0       0       0       0       0       0       0       0
  Artificial with Anomaly   0.009   0.004   0.004   0.017   0.003   0.012   0.017   0.021   0.043   0.017   0.013   0.156   **0.427**
  Real Ad Exchange          0.018   0.022   0.005   0.034   0.024   0.040   0.035   0.024   0.005   0.018   0.026   0.132   **0.234**
  Real AWS Cloud            0.006   0.007   0.015   0.018   0.006   0.017   0.018   0.018   0.053   0.013   0.06    0.146   **0.369**
  Real Known Cause          0.007   0.005   0.005   0.013   0.008   0.015   0.012   0.013   0.008   0.017   0.006   0.2     **0.324**
  Real Traffic              0.012   0.02    0.011   0.032   0.013   0.033   0.036   0.033   0.091   0.020   0.045   0.223   **0.340**
  Real Tweets               0.003   0.003   0.003   0.010   0.004   0.009   0.010   0.006   0.035   0.018   0.026   0.075   **0.310**

\[Table:ResultsNAB\]

  -- -- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------
                                                                                                
        Prec.   Rec.    Prec.   Rec.    Prec.   Rec.    Prec.   Rec.    Prec.   Rec.    Prec.   Rec.
        0.5     0.006   0       0       0       0       0       0       0.03    0.33    0.07    0.02
        0.75    0.02    1       0.007   0       0       1       0.02    0.71    0.03    0.21    0.23
        1       0.005   1       0.01    1       0.002   1       0.002   1       0.01    0.18    0.51
        1       0.005   1       0.002   1       0.1     0.62    0.012   1       0.03    0.50    0.75
        0.33    0.001   0.5     0.006   0       0       0       0       0.26    0.06    0.21    0.75
        0.12    0.001   0.52    0.01    0       0       0.74    0.01    0.63    0.36    0.32    0.49
        1       0.009   1       0.009   1       0.014   1       0.02    1       0.04    0.38    0.40
        1       0.001   0.27    0.004   0.97    0.01    1       0.02    0.8     0.001   0.39    0.50
        1       0.002   0.85    0.006   0       0       0       0       1       0.002   0.17    0.47
        0.33    0.005   0.5     0.005   0       0       0       0       0.34    0.05    0.13    0.23
        0       0       0       0       0       0       0.11    0.002   0.11    0.01    0.25    0.43
        0.5     0.004   0.2     0.004   0.5     0.004   0.5     0.004   0.5     0.004   0.18    0.41
        1       0.008   0.66    0.008   1       0.04    1       0.02    1       0.036   0.50    0.44
        0.5     0.004   0.25    0.008   1       0.01    1       0.01    1       0.008   0.36    0.34
        0.57    0.03    0.6     0.02    0.86    0.16    1       0.01    1       0.07    0.64    0.30
        1       0.008   0.8     0.01    1       0.06    1       0.01    1       0.08    0.31    0.78
        0.6     0.01    0.33    0.004   0.62    0.07    0.2     0.004   1       0.004   0.22    0.34
        1       0.005   0       0       0       0       0       0       1       0.009   0.82    0.11
        0.75    0.002   0.38    0.005   0.59    0.02    0.81    0.01    0.75    0.01    0.25    0.43
        0.37    0.002   0.22    0.005   0.22    0.01    0.5     0.009   0.5     0.005   0.24    0.28
  -- -- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------- ------

\[Table:ResultsNABDatasets\]

  Dataset category   Yahoo EGADS\*                                              OeSNN-UAD
  ------------------ --------------- ------ ------ ------ ---------- ---------- -----------
  A1Benchmark        0.47            0.48   0.48   0.47   0.46       0.44       **0.70**
  A2Benchmark        0.58            0      0      0      0.94       **0.97**   0.69
  A3Benchmark        0.48            0.26   0.27   0.3    **0.87**   0.72       0.41
  A4Benchmark        0.29            0.31   0.33   0.34   **0.68**   0.59       0.34

\[Table:ResultsYahoo\]

In Fig. \[Fig:Plots\], we present charts showing the results obtained for the selected data files for both benchmarks. For each data file, the first chart shows input values time series ($\mathbf{X}$), the second one presents predicted values $\mathbf{Y}$, the third one illustrates an error between the input and the predicted values ($\mathbf{E} = |\mathbf{X} - \mathbf{Y}|$) and the last chart shows the detected and labeled anomalies. For example, it can be noted that anomalies for the file `ec2_cpu_utilization_ac2cd` presented in Fig. \[Fig:Plots\] are correctly detected by our approach. OeSNN-UAD is able to detect anomalies which occur both around timestamp 500 and are not labeled in the data file, as well as the labeled anomalies present after timestamp 3500.

In Table \[Table:ResultsNAB\], we give the results of OeSNN-UAD anomaly detection for Numenta Anomaly Benchmark as compared to other unsupervised anomaly detection methods and algorithms. Similarly to the comparison of the results presented recently in [@Munir2019_IEEEAccess_DEEPAnT], we report the mean F-measure obtained for each category of data files. It can be noted, that OeSNN-UAD significantly outperforms the results obtained by other approaches for each category of data files. Table \[Table:ResultsNABDatasets\] presents the obtained precision and recall values for the selected data files from Numenta Anomaly Benchmark. For some data files eSNN is able to provide much higher values of both precision and recall than other methods. The lower precision value of OeSNN-UAD obtained for some data files compared to other methods is caused by two reasons:

-   Most of other methods and algorithms for which the results are presented in Table \[Table:ResultsNABDatasets\] discover very few anomalies (which is indicated by high values of precision and very low values of recall) and is described in detail in [@Singh2017].

-   As it was indicated above, some input values in data files are not labeled as anomalies.

In Table \[Table:ResultsYahoo\], we present comparison of the obtained F-measure values for each category of data files in the Yahoo Anomaly Dataset. For the real data files category (`A1Benchmark`), the proposed OeSNN-UAD approach provides better results than recent results reported in the literature, while for the other three categories of data files OeSNN-UAD is competitive to the reported results.

Conclusions {#sec:Conclusions and Future Work}
===========

In this article, we offered a novel approach to unsupervised and online detection of anomalies in data streams called OeSNN-UAD. The proposed detector is designed for univariate stream time series data and extends evolving Spiking Neural Networks architecture and their learning principles. To the best of our knowledge, for the first time we introduced an eSNN architecture, which can be trained in an unsupervised mode, in which input values do not need to be labeled with decision classes. Several distinctive features of OeSNN-UAD allow for proper learning and classification of input values:

-   the proposed eSNN architecture learns within classification process based on the recent window of input values.

-   with each new input value presented to OeSNN-UAD, a new output neuron is created and initialized. Contrary to a typical eSNN architecture, the newly created neuron is not assigned an output decision class. Instead, it is initialized with a random real output value. The output value of an output neuron is then modified in the course of learning of the eSNN network.

-   we introduced a method of anomaly classification based on the history of past prediction errors of input values.

In the article, we have also proved that all output neurons have the same values of the sum of their synaptic weights, their maximal post-synaptic thresholds, and their actual post-synaptic potential thresholds, respectively. The last property eliminated the necessity of recalculation of the actual post-synaptic potential thresholds when output neurons of eSNN are updated within the learning process.

In the experimental part, we compared the proposed OeSNN-UAD approach to the results of unsupervised and semi-supervised anomaly detection methods and algorithms recently reported in the literature. Experiments were conducted on two anomaly benchmark datasets: Numenta Anomaly Benchmark and Yahoo Anomaly Dataset, which consist of more than 500 data files grouped into several categories. For the assessment of the quality of anomaly detection of our approach and other state-of-the-art approaches, we used three indicators: F-measure, precision and recall. For Numenta Anomaly Benchmark, OeSNN-UAD is able to provide significantly better results in terms of F-measure for all categories of data files. Detailed analysis of precision and recall obtained for the selected data files in Numenta Anomaly Benchmark shows that OeSNN-UAD is competitive in terms of both of these measures to the results reported in the literature. For the second selected benchmark, the Yahoo Anomaly Dataset, OeSNN-UAD provides higher F-measure value for real data files category, while for the other three synthetic data categories the obtained values of F-measure are competitive to the results reported in the literature.

The important property of OeSNN-UAD approach is its ability to learn and classify input values efficiently. Moreover, OeSNN-UAD is suitable for environments with very restricted memories. As we prove in the experimental part, the network is able to outperform other methods when it consists of only 10 neurons in the input layer and the size of output neuron repository is limited to 50.

Acknowledgment {#acknowledgment .unnumbered}
==============

P. Maciąg acknowledges financial support of the Faculty of the Electronics and Information Technology of the Warsaw University of Technology (grant no. II/2019/GD/1). J. L. Lobo and J. Del Ser would like to thank the Basque Government for their support (ELKARTEK and EMAITEK programs).

[Piotr S. Maciąg]{} is a research assistant and a PhD student at the Warsaw University of Technology, Poland. His research interests are with data mining and machine learning: discovering sequential patterns from spatio-temporal data, mining frequent itemsets, spiking neural networks, time series processing, clustering and their applications to such areas as air pollution prediction or crime incidents analysis. In the academic year 2017/2018, he was a research visitor in Knowledge Engineering and Discovery Research Institute (KEDRI) at Auckland University of Technology. In January and February 2019, he visited OPTIMA research group at Tecnalia Research and Innovation in Basque Country. Currently, he conducts his research visit at the Robotics Institute of Carnegie Mellon University.

[Marzena Bogumiła Kryszkiewicz]{} received her PhD and DSc degrees in Computer Science from Warsaw University of Technology in 1995 and 2003, respectively. She was awarded the title of Professor by the President of the Republic of Poland in 2013. She was the Associate Dean for Academic Affairs at the Faculty of Electronics and Information Technology of Warsaw University of Technology in 2005-2008. Since 2009 she has been the head of the Division of Information Systems in Institute of Computer Science of this faculty. She was awarded with scientific prizes such as Award of the Foundation for Polish Science in 1995 and Award of Minister of Education of the Republic of Poland in 2004. In 2017, she was awarded the Medal by the Commission of National Education. Her research interests include: data mining, knowledge discovery, concise representations of knowledge, evaluation measures of association and decision rules, clustering, classification, reasoning under incompleteness and uncertainty, rough sets, privacy preserving. She has published more than 100 articles. She is a member of Program Committees and reviewer for several international conferences and journals.

[Robert Bembenik]{} obtained his PhD in computer science from Warsaw University of Technology in 2007, where he currently works as an assistant professor. His research interests include spatial data mining, social networks, mobile applications and text analysis. He is a co-author of over 30 scientific publications.

[Jesus L. Lobo]{} holds a PhD in Information and Communications Technologies in Mobile Networks from the University of the Basque Country (Spain). He works as AI researcher at the OPTIMA (Optimization, Modeling and Analytics) research area at TECNALIA RESEARCH & INNOVATION (www.tecnalia.com). His research interests are mainly focused on Machine Learning applied to data streams. Currently, he addresses the challenges of concept drift adaptation and detection for data streams, where he has so far authored several conference contributions and has published a number of papers in indexed scientific journals.

[Javier Del Ser]{} (M’07-SM’12) received his first PhD degree (cum laude) in Electrical Engineering from the University of Navarra (Spain) in 2006, and a second PhD degree (cum laude, extraordinary PhD prize) in Computational Intelligence from the University of Alcalá (Spain) in 2013. He is currently a Research Professor in Artificial Intelligence and leading scientist of the OPTIMA (Optimization, Modeling and Analytics) research area at TECNALIA, Spain. He is also an adjunct professor at the University of the Basque Country (UPV/EHU), an invited research fellow at the Basque Center for Applied Mathematics (BCAM), an a senior AI advisor at the technological startup SHERPA.AI. He is also the coordinator of the Joint Research Lab between TECNALIA, UPV/EHU and BCAM, and the director of the TECNALIA Chair in Artificial Intelligence implemented at the University of Granada (Spain). His research interests are in the design and aplication of Artificial Intelligence methods for data mining and optimization for problems emerging in Intelligent Transportation Systems, Smart Mobility and Logistics, among others. He has published more than 280 scientific articles, co-supervised 10 Ph.D. theses, edited 7 books, co-authored 9 patents and participated/led more than 40 research projects. He is an Associate Editor of tier-one journals from areas related to Data Science Artificial Intelligence, such as Information Fusion, Swarm and Evolutionary Computation and Cognitive Computation, and has served as a Guest Editor in journals from the ITS field such as IEEE Transactions on Intelligent Transportation Systems and IEEE ITS Magazine. He is a recipient of the Bizkaia Talent prize for his research career.

[^1]: P. Maciąg, M. Kryszkiewicz and R. Bembenik are with the Institute of Computer Science, Warsaw University of Technology, Nowowiejska 15/19, 00-665, Warsaw, Poland (e-mail: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>, <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>, <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>).

[^2]: J. L. Lobo is with TECNALIA. Parque Tecnológico de Bizkaia, c/ Geldo, 48160 Derio, Spain (e-mail: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>).

[^3]: J. Del Ser is with TECNALIA. Parque Tecnológico de Bizkaia, c/ Geldo, 48160 Derio, Spain and University of the Basque Country UPV/EHU, 48013 Bilbao, Spain (e-mail: <PRESIDIO_ANONYMIZED_EMAIL_ADDRESS>).

[^4]: *(Corresponding author: Piotr S. Maciąg.)*

[^5]: https://github.com/piotrMaciag32/eSNN-AD