# Outlier Detection for Multivariate Time Series Using Dynamic Bayesian Networks
## 3 Methods
### Pre-Processing  
METEOR modeling phase requires a discrete MTS. In the presence of an already discrete series, this phase can be skipped and follow directly to modeling (Section 3.2); the user can also pre-discretize its MTS with meaningful domain values or any other approach outside METEOR. However, if a continuous series is fed to METEOR, a representation known as Symbolic Aggregate approXimation (SAX) [32] is enforced prior to the modeling phase. SAX has already been validated in anomaly detection scenarios [33] providing discretization and dimensionality reduction. The procedure is applied separately to each univariate TS belonging to a continuous MTS. The processed series are then combined to form a discrete MTS dataset. The pseudo-code for the SAX pre-processing mechanism is available in Algorithm 1. For each real-valued TS \(x_{i}^{h}[t]_{0\leq t\leq T}\) of length \(T\) (steps 2-3), normalization (steps 4-5), dimensionality reduction (steps 5-11) and symbolic discretization (steps 12-14) are performed. Normalization is done to present zero mean and a standard deviation of one by employing Z-normalization. The mean of each TS is subtracted from every data point. The result is then divided by the TS standard deviation. The dimensionality reduction compresses the TS into an equivalent sequence of size \(w\ll T\). Such is assured by _piecewise aggregate approximation_ (PAA). The latter subdivides the normalized TS into \(w\) equally sized blocks. The mean of the data points in each block is computed, being the \(w\) mean values the new TS. Finally, symbolic discretization is done. In many applications, these normalized time series have a Gaussian distribution [34]. Hence, the TS domain can be divided into \(r_{i}\) equiprobable regions according to a Gaussian distribution \(\mathcal{N}(0,1)\), where \(r_{i}\) denotes the size of the alphabet \(\mathcal{X}_{i}=\{x_{i_{1}},\ldots,x_{i_{r}}\}\). Regions are identified by boundaries, known as breakpoints \(\beta\). The goal is to resolve in which of the regions each data point resides. A value falling in interval \((\beta_{j-1},\beta_{j})\) is associated with the symbol \(x_{i_{j}},1\leq j\leq r_{i}\). Figure 2: Scheme of the proposed outlier detection approach comprised of four phases. Datasets formed by MTS data can be directly applied to the modeling phase when discrete; otherwise, the pre-processing phase is applied before modeling. Discrete data is delivered to the modeling phase along with parameters \(p\), \(m\), and \(s\) of the DBN to be modeled. Afterward, a sliding window algorithm outputs a score distribution for the data (scoring entire MTS, called subjects, or only portions of it, called transitions, depending on the user’s choice). The score-analysis phase considers two distinct strategies providing thus two possible routes for outlier disclosure. ```
1:Input: A MTS dataset \(D\) of \(n\) variables along \(T\) instants; an alphabet size \(r_{i}\) for each attribute \(X_{i}[t]\), \(1\leq i\leq n\); desired length \(w\ll T\) of the resulting MTS. ```
2:The set of input MTS discretized.