## 2 Related Work
### Peaks over Threshold and Its Derived Methods  
[PERSON] [12] proposed a POT method based on extreme value theory, which do not require manual threshold setting, and no assumptions are made on the distribution. POT is inspired by the Pickands-Balkema-de Haan theorem [25]. The POT approach tries to fit a Generalized Pareto Distribution (GPD) to the extreme values of \(X-t\), \(t\) is the initial \"over-limit\" threshold set as the high empirical quantile. Equation (1) shows that exceeding the initial threshold obeys the GPD \(G(x)\) with parameters \(\mu\), \(\sigma\) and \(\gamma\), namely:  
\[G(x)=\exp(-(1+\gamma\frac{x-\mu}{\sigma})_{+}^{-1/\gamma}) \tag{1}\]  
Here \(\mu\) is a location parameter but set null, \(\sigma>0\) is a scale parameter, \(\gamma\) is a shape parameter, and the \"+\" signifies that if the expression in parentheses is negative then it should be replaced by 0.  
Using the method proposed by [PERSON] [25] to estimate \(\widehat{\gamma}\), \(\widehat{\sigma}\), the final threshold \(z_{q}\) is computed via Equation (2).  
\[z_{q}\simeq t+\frac{\widehat{\sigma}}{\widehat{\gamma}}((\frac{q\mu}{N_{t}})^ {-\widehat{\gamma}}-1) \tag{2}\]  
\(q\) is the risk parameter, \(n\) is the length of time series, \(N_{t}\) is the number of peaks (that is, the number of \(x_{i}>t,\forall i\in\{1,2,...,n\}\)), \(z_{q}\) is the updated threshold determined according to the confidence level \(1-q\), and Algorithm 1 shows the steps of POT.  
```
0: time series \(X=(x_{1},x_{2},...,x_{n},x_{n+1},...,x_{N})\), risk parameter \(q\), quantile \(\alpha\)
0:\(z_{q},t\)
1:functionPOT(\(X,q,\alpha\))
2:\(t\gets SetInitialThreshold(X_{1},X_{2},...,X_{n})\) # set by low \(\alpha\) quantile
3:\(Y_{t}\leftarrow\{X_{i}-t|X_{i}>t\}\)
4:\(\widehat{\gamma},\widehat{\sigma}\leftarrow\text{Grimshav}(Y)\) a method for the maximum likelihood estimation of parameter, see [26]
5:\(z_{q}\gets t+\frac{\widehat{\sigma}}{\widehat{\gamma}}[(\frac{qk}{N_{t}})^ {-\widehat{\gamma}}-1]\)
6: return \(z_{q}\)
7:endfunction
```  
**Algorithm 1** Peaks Over ThresholdBesides, [PERSON] proposed Streaming POT (SPOT), Drift SPOT (DSPOT), bidirectional SPOT (biSPOT), and bidirectional DSPOT (biDSPOT) based on POT.  
**SPOT** works in stationary cases assuming that the distribution of the \(X_{i}\) does not change over time. The principle of the SPOT is the following: we want to detect abnormal events in a stream \(X_{i}>0\) in a blind way (without knowledge about the distribution). Firstly, we perform a POT estimate on the \(n\) first values and we get an initial threshold \(z_{q}\) (initialization). Then, for all the next observed values we can flag the events or update the threshold (see Figure 3a). If a value exceeds threshold \(z_{q}\) then we consider it as abnormal.  
**DSPOT** takes a drift component into account to be applied in sequences with non-static distribution. DSPOT makes SPOT run not on the absolute values \(X_{i}\) but on the relative ones \(X^{\prime}_{i}=X_{i}-M_{i}\), where \(M_{i}\) models the local behavior at time \(i\). \(M_{i}=(1/d)\sum\limits_{k=1}^{d}X^{*}_{i-k}\) with \(X^{*}_{i-1},X^{*}_{i-2},...,X^{*}_{i-d}\) the last \(d\) \"normal\" values (see Figure 3b), \(d\) can be viewed as a window size.  
SPOT and DSPOT can detect upper outliers but not lower outliers, so they may lead to a large number of false negatives. **biSPOT** and **biDSPOT** can effectively overcome the above shortcomings of SPOT and DSPOT. \"bi\" denotes \"both sides\", which takes upper and lower thresholds updates into account.  
POT and its derived methods achieve outstanding performance in detecting extreme values without any label-related information, which has the potential to solve the unsupervised anomaly detection problem in large-scale time series. Figure 4 shows examples of anomaly detection using SPOT, biSPOT, DSPOT, and biDSPOT.  
Figure 4: _Cont._  
Figure 3: Principles of anomaly detection using SPOT and DSPOT.