# Outlier Detection for Multivariate Time Series Using Dynamic Bayesian Networks
## 3 Methods
### Scoring  
After the pre-processing and modeling phases, the proposed method starts a scoring phase. Outliers are considered to be observations that do not fit well the DBN trained model. The goal is to score portions or entire subject observations according to the tDBN structure. **Definition 4** (Window). : _Given subject observations \(D^{h}\), a \(m\)-th-order window \(D_{t-m:t}^{h}\) is defined as the subset of the \(h\)-th subject observations concerning time transition \(t-m\to t\) in \(D\)._  
Please note that \(m\)-\(th\)-order windows have a size equal to \(n\times(m+1)\). Given a \(m\)-\(th\)-order DBN, a window is scored according the its transition network \(B_{t-m}^{t}\) as  
\[s_{t-m:t}^{h}=\sum_{i=1}^{n}\log P(X_{i}[t]=x_{i}^{h}[t]|\Pi_{X_{i}[t]}=w_{i} ^{h}[t]), \tag{4}\]  
where \(x_{i}^{h}[t]\in\mathcal{X}_{i}\) is the value of \(X_{i}\) observed at time \(t\) for subject \(h\) and \(w_{i}^{h}\) the observed configuration of the set of parents \(\Pi_{X_{i}[t]}\) which comprises observations ranging from slices \(t-m\) to \(t\) according to \(B_{t-m}^{t}\). Equation (4) is referred as a transition score, representing the log-likelihood (LL) of the observed window computed using the network's conditional probabilities. Every procedure is akin when considering both stationary and non-stationary DBNs. If a window possesses a configuration unseen in the modeling phase, the probability of that configuration is zero, nullifying the LL score associated to it. A technique known as probability smoothing is thus employed to prevent score disruption [36]. Probabilities are transformed according to  
\[P_{i}^{h}=(1-r_{i}\cdot y_{\min})p_{i}^{h}+y_{\min}, \tag{5}\]  
where \(p_{i}^{h}\) is a conditional probability \(P(X_{i}[t]=x_{i}^{h}[\Pi_{X_{i}[t]}=w_{i}^{h})\), \(y_{\min}\) a parameter expressing the degree of probability uncertainty and \(r_{i}\) the granularity of the \(X_{i}\). Such means that when \(p_{i}\) is zero, the new probability will be equal to \(y_{\min}\), which is typically 0.001. Additionally, Equation (5) ensures that probabilities with value 1 are decreased according not only to \(y_{\min}\) but also the size of the alphabet \(r_{i}\) related to that attribute, reducing thus overfitting. Consequently, the LL scores are computed using the smoothed probabilities. To acquire the outlierness of every MTS transition, a sliding window is employed. The mechanism gradually captures all equally sized windows, \(D_{t-m}^{t}\) with \(t\in\mathcal{T}\), of a subject to compute the LL scores \(s_{t-m:t}^{h}\) for each transition. Since the trained model possesses an initial network \(B^{0}\), time frames \(t\leq m\) cannot be explained by windows of size \(n\times(m+1)\). Hence, according to the order of the model, only transitions from slice \(m+1\) forward are captured. However, the initial frames influence the scores of the next consecutive windowswhich include them, having the ability of inducing anomalies. The whole procedure is depicted in Algorithm 3. It is worth noting that the stationarity of the DBN modeled influences the way data is scored. Non-stationary models adapt to each transition, meaning that windows are not scored according to the series general behavior. Such allows the adaptation of the system to data whose behavior is time variant. ```
0: A tDBN storing conditional probabilities for each transition network \(B_{t-m}^{t}\), a (discretized) MTS dataset \(D\), and a threshold \(thr\) to discern abnormality. 0: The set of anomalous transitions \(t-m\to t\) with scores below \(thr\).