# Anomaly Detection in Financial Time Series by Principal Component Analysis and Neural Networks +
## 2 The PCA NN Anomaly Detection Approach
### Contaminated Time Series Identification
#### 2.4.1 Naive Approach  
A naive and natural approach to defining the anomaly score is to consider the \(\ell^{2}\)-norm of the reconstruction errors \(\widetilde{\epsilon}_{i}=\|\varepsilon^{i}\|_{2}\), \(i=1,\ldots,n\). This anomaly score represents the propensity of a time series to be contaminated. The scores are first split into two sets depending on whether or not the corresponding time series is contaminated. We use \(\widetilde{\epsilon}^{x}\) and \(\widetilde{\epsilon}^{u}\) to denote the set of contaminated and uncontaminated time series anomaly scores, i.e.,  
\[\widetilde{\epsilon}^{x} :=\{\|\varepsilon^{i}\|_{2};\ A^{i}=1\}=\{\widetilde{\epsilon}_{ i},\,i\in I_{c}\}\] \[\widetilde{\epsilon}^{u} :=\{\|\varepsilon^{i}\|_{2};\ A^{i}=0\}=\{\widetilde{\epsilon}_{ i},\,i\
ot\in I_{c}\}.\]  
The density distribution function of each class of time series \(f^{u}\) and \(f^{c}\), i.e., for both \(\widetilde{\epsilon}^{x}\) and \(\widetilde{\epsilon}^{u}\), is then estimated using the kernel density estimation [5]. For \(l=\{c,u\}\), let \(\varepsilon^{l}\) be an i.i.d sample of \(n^{l}\) observations from a population with an unknown density \(f^{l}\). The corresponding kernel estimator is given by  
\[\widehat{f}^{l}(s)=\frac{1}{n^{l}\mathfrak{h}}\sum_{k=1}^{n^{l}}\mathcal{K} \left(\frac{s-\widetilde{\epsilon}^{x}_{k}}{\mathfrak{h}}\right), \tag{4}\]  
where \(\mathcal{K}\) is a kernel function and \(\mathfrak{h}\) is a smoothing parameter.  
The cutoff value \(s\) is then chosen as the intersection between the two empirical density functions, i.e.,  
\[\hat{s}=\arg\min_{s}\left\{|\hat{f}^{u}(s)-\hat{f}^{c}(s)|<\eta\right\},\]  
where \(\eta\) is a to-be-tuned precision level. The selected cutoff value \(\hat{s}\) represents the value of the score for which the area under the curve of the density of uncontaminated time series above \(\hat{s}\) and the area under the curve of contaminated time series below \(\hat{s}\) are as small as possible. We expect it to correspond to a value exceeded by a relative low number of \(\overline{\hat{\epsilon}_{i}}\) with \(i\
ot\in L_{c}\) as \(\hat{f}^{u}(s)\) is expected to be flat around the cutoff value exceedance region and exceeded only by a few \(\overline{\hat{\epsilon}_{i}}\) with \(i\in L_{c}\).  
As shown in Figure 1, the naive approach results in a non-negligible overlapping region between the two densities, for both the training set (left) and test set (right). This region represents the anomaly score associated with time series that could be either contaminated or uncontaminated. The uncertainty regarding the nature of the observation when its anomaly score belongs to this region is relatively high in comparison with the observations whose anomaly scores lie on the extreme left-hand or right-hand side of the calibrated cutoff value. Moreover, because we are not able to provide a clear separation between the scores of uncontaminated and contaminated time series, we may expect the model to mislabel future observations, resulting in a high rate of false positives and true negatives.