# Spatiotemporal Road Traffic Anomaly Detection: A Tensor-Based Approach
## 4 Methodology
### Anomaly Detection  
When working with traffic data represented by the STM, the anomalous traffic can be represented by large deviations between origin and destination speeds, which highly depends on the represented pattern's position. These dangerous traffic situations can be identified by the vehicle's sudden braking, or a very high acceleration, with the corresponding positions in the STM, lower left, and the upper right corner. Then, normal traffic behavior can be represented if the position of the pattern is close to the diagonal of the STM. Those values represent normal traffic behavior, which extends from the congested (upper left corner) to the free traffic flow (lower right corner). All scenarios are illustrated in Figure 5.  
To amplify the importance of the location of the patterns, the method for the anomaly detection is based on (i) CoM estimation for the pattern represented by the characteristic STM, and (ii) measuring the relative distance between CoM and the diagonal of the STM. CoM is computed for every characteristic STM extracted from the tensor decomposition method. With this, extracted CoM represents the most probable speed transition in the characteristic STM. This approach is used because the position of the pattern represented by the STM is crucial for the traffic state estimation and the anomaly detection [40]. CoMs are computed based on the computation of the expected value, adopted from [41]. Firstly, marginal distribution for the coordinates (origin and destination speed) are computed using Equations (3) and (4):  
\[p_{x}(x_{j})=\sum_{i=1}^{m}p_{ij},j=1,2,...,n, \tag{3}\]  
\[p_{y}(y_{i})=\sum_{j=1}^{n}p_{ij},i=1,2,...,n, \tag{4}\]  
Figure 5: Regions in the STM that shows pattern location importance for anomaly detection. where \(p_{x}(x_{j})\) and \(p_{y}(y_{i})\) represent the marginal distributions for the coordinates. Then, the CoM coordinates are computed using:  
\[c_{x}=\sum_{j=1}^{n}p_{x}(x_{j})\cdot j, \tag{5}\]  
\[c_{y}=\sum_{i=1}^{m}p_{y}(y_{i})\cdot i, \tag{6}\]  
where \(c_{x}\) and \(c_{y}\) represent coordinates of the CoM. After the CoM estimation, the relative distance between the CoM and the diagonal is measured using the Euclidean distance. The most suitable anomaly detection method is chosen by comparison of the most used methods represented in Table 1, that reports the name of the anomaly detection method, number of anomalies detected, and the lower and upper bounds. Relative distance from the diagonal values that are placed outside of the computed bounds are considered as anomalous ones. The box plot method resulted in detecting the most anomalies, three sigma rule, and MAD resulted in detecting the same amount of anomalies, while, adjusted box plot detected eight anomalous characteristic matrices. After examining the relative distance distribution (Figure 6a), the adjusted box plot is chosen as an anomaly detection method. It is a method that does not take any parametric assumptions and uses med couple as a robust skewness estimator [42]. Other methods assume the normal distribution of the data and cannot be used in this case. The results of applying all the methods can be observed in Figure 6b, where the plotted lines show the upper bound of the anomaly detection methods with plotted CoMs for every calculated characteristic STM resulted in tensor decomposition. It can be observed that the adjusted box plot resulted in detecting only the most anomalous transitions regarding the anomaly definition presented in Section 3.1. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Method** & **N. Anomalies Detected** & **Bounds** \\ \hline Box plot & 261 & \([-15.00,25.00]\) \\ \hline Three sigma rule & 58 & \([-20.12,39.13]\) \\ \hline MAD & 58 & \([-24.38,38.52]\) \\ \hline Adjusted Box plot & 8 & \([-4.65,46.13]\) \\ \hline \hline \end{tabular}
\end{table}