# Uncertainty-Aware Time Series Anomaly Detection
## 3 Proposed Approach
### Thresholding Mechanism  
The final task for the algorithm to achieve is to translate the anomaly score, and if so also additional scores, into binary anomaly labels. Therefore, we can define an anomaly as in Definition 4. **Definition 4** (Anomaly). : _An anomaly is defined as a prediction that fulfills the following conditions:_  
\[s>s*\]  
_where_  
* \(s\) _is the anomaly score,_
* \(s^{*}\) _is the anomaly score threshold._```
input sequence \(x=\{x_{1},x_{2},\dots,x_{T}\}\), MC dropout sample size S, encoder \(\mathcal{E}(\cdot)\), decoder data \(\hat{\mathcal{D}}_{d}(\cdot)\), decoder uncertainty \(\mathcal{D}_{u}(\cdot)\) \(A\), \(U_{p}\) \(\hat{x}\leftarrow\{\}\) \(\hat{\sigma}\leftarrow\{\}\) MC Dropout sampling for\(s\gets 1\) to \(S\)do \(z\leftarrow\mathcal{E}(x)\)\(\triangleright\) encode input sequence \(\hat{x}\leftarrow\hat{x}\cup\mathcal{D}_{d}(z)\)\(\triangleright\) reconstruct encoding z \(\hat{\sigma}\leftarrow\hat{\sigma}\cup\mathcal{D}_{u}(z)\)\(\triangleright\) predict aleatoric uncertainty endfor Bayesian Approximation over MC Dropout Samples \(\hat{x}\leftarrow\frac{1}{5}\sum_{s=1}^{S}\hat{x}_{s}^{2}\) \(\hat{\sigma}\leftarrow\frac{1}{5}\sum_{s=1}^{S}\hat{\sigma}_{s}^{2}\) Anomaly and Uncertainty Metrics \(A\leftarrow\frac{1}{1}\sum_{s=1}^{S}\hat{\sigma}_{s}^{-2}||x_{s}-\hat{x}_{s}||^ {2}+\frac{1}{2}\log\hat{\sigma}_{i}^{2}\)\(\triangleright\) anomaly score \(U_{a}\leftarrow\frac{1}{5}\sum_{s=1}^{S}\hat{\sigma}_{s}^{2}\)\(\triangleright\) aleatoric uncertainty \(U_{e}\leftarrow\frac{1}{5}\sum_{s=1}^{S}\hat{\sigma}_{s}^{2}-(\frac{1}{5}\sum_ {s=1}^{S}\hat{\tau}_{s})^{2}\)\(\triangleright\) epistemic uncertainty \(U_{p}\gets U_{e}+U_{a}\)\(\triangleright\) predictive uncertainty return A, \(U_{p}\)
```

**Algorithm 1** Algorithm to produce anomaly score. Thresholding is an orthogonal task to anomaly score calculation and an algorithm-independent problem. To choose an appropriate mechanism, we first set up two assumptions about anomalies in the data:

* **Assumption 1: Rare Events. ** We begin by assuming anomalies are rare events. This means the proportion of anomalous labeled data points is vanishingly small compared to the total number of data points. * **Assumption 2: Random Occurrence. ** Despite their rarity, we cannot predict when or where an anomaly will appear within a time series. Anomalies are assumed to occur at random times. Since the threshold for anomaly detection is set based on the training data, Assumption 2 becomes crucial. Because anomalies are assumed to occur randomly (Assumption 1), the training data themselves might contain some anomalies, even though they are rare. This can affect the model's ability to detect future anomalies effectively. Consequently, we decided to adopt a thresholding mechanism that sets the threshold at the 0.999\(th\) quartile based on the anomaly score of the training data. This means in practice that 99.9% of the training data are seen as normal with 0.1% considered anomalous. This is a hyperparameter that can be tuned, based on prior knowledge of the dataset. This of course holds the risk of setting a threshold slightly lower than necessary and labeling some data points as false positives. On the other side, when longer anomalies occur in the training set, they can be labeled as false negatives. However, this approach tries to keep both sides low while trying not to overcomplicate this task. ## 4 Experiments

This section describes the experiments that we have conducted in order to evaluate our approach. We recall the following research questions:How do uncertainty quantification measures react when different levels of uncertainty are introduced into the data? 2. How do the uncertainties react to different types of anomalies? 3. What is the impact of considering uncertainty on the performance of anomaly detection models? ### Uncertainty Detection Capabilities

We built two uncertainty estimation techniques into the model--one to detect aleatoric uncertainty--and the other one to detect epistemic uncertainty.