# Outlier Detection for Multivariate Time Series Using Dynamic Bayesian Networks
## 4 Experimental Results
### Ecg  
A common application of anomaly detection in medical scenarios is in electrocardiogram (ECG) alert systems [33]. These have the capability of detecting unusual patterns in signals measured from patients. Data is usually continuous and present expected patterns in healthy patients.  
Figure 5: Subject outlierness using METEOR (**a**) and PST approach (**b**) for a same experiment of a dataset of 10,000 subjects (\(N=10,000\)) with 20% anomalies generated by model \(C\). Histograms display thresholds using both score-analysis strategies. Scores below the threshold are classified as abnormal (in red) while the rest are classified as normal (in green), being the presented color representation for the Tukey’s thresholds.  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline  & \multicolumn{6}{c}{**Tukey’s Strategy**} \\ \hline \multicolumn{6}{c}{**Model B**} \\ \hline \(\mathbf{P_{O}}\) & **PPV** & **TPR** & **ACC** & \(\mathbf{F_{1}}\) & **PPV** & **TPR** & **ACC** & \(\mathbf{F_{1}}\) \\ \hline
5 & 0.96 & 0.73 & 0.98 & 0.83 & 0.96 & 0.94 & 0.99 & 0.95 \\
10 & 0.70 & 0.02 & 0.90 & 0.04 & 0.98 & 0.39 & 0.94 & 0.56 \\
20 & 0.42 & 0.00 & 0.80 & 0.00 & 1.00 & 0.03 & 0.81 & 0.06 \\ \hline \multicolumn{6}{c}{**GMM Strategy**} \\ \hline \multicolumn{6}{c}{**Model B**} \\ \hline \(\mathbf{P_{O}}\) & **PPV** & **TPR** & **ACC** & \(\mathbf{F_{1}}\) & **PPV** & **TPR** & **ACC** & \(\mathbf{F_{1}}\) \\ \hline
5 & 0.86 & 0.88 & 0.99 & 0.87 & 0.94 & 0.95 & 0.99 & 0.94 \\
10 & 0.20 & 0.87 & 0.65 & 0.33 & 0.88 & 0.68 & 0.96 & 0.77 \\
20 & 0.25 & 0.67 & 0.53 & 0.36 & 0.763 & 0.883 & 0.92 & 0.82 \\ \hline \hline \end{tabular}
\end{table}
Table 3: PST results using Tukey and GMM strategies on simulated data for experiments with \(N=10,000\).  
An ECG dataset, available at [43], is composed by 200 MTS (\(N=200\)) each with 2 distinct variables (\(n=2\)). A representation of the normalized data can be seen in Figure 6 together with the breakpoints \(\beta\) of the performed SAX discretization. The location of the ventricular contraction peaks typically occur around time frames 3 and 10. Tests are performed using non-stationary DBNs since specific phenomena occurs in particular time instances. The experiments have the objective of testing the system behavior to inconsistent data.  
Series are discretized with an alphabet of size 5 (\(r_{i}=5\) for all \(i\)) and modeled using a second-order DBN (\(m=2\)) with one inter-slice connectivity per node (\(p=1\)). Score distributions are negatively skewed, advising the use of Tukey's thresholds. An experiment, depicted in Figure 7, shows that METEOR has difficulty evaluating time slices with higher variance. To further test the aforementioned, 10% of the subjects are flipped horizontally and mixed together in the original set; therefore, the ventricular contraction peaks in these series occur in their last time frames. Results demonstrate the detection of such transitions present on subjects with higher id.  
The system has the ability of detecting unusually behaved sections in ECGs which coincide with the high variance portions. The latter is due to not existing a predominant pattern in the location of the peaks, observable as vertical red stripes, since these vary intensively from subject to subject contrary to more advanced slices. SAX discretization offers low definition in such locations.  
Figure 6: Mean and standard deviation of normalized ECG variables along time using a SAX alphabet \(r_{i}=5\) for \(i=1,2\).  
Figure 7: ECG transitions arranged by subject. A non-stationary second-order tDBN (\(m=2\)) model with inter-slice connectivity (\(p=1\)) is used together with [PERSON]’s score-analysis. Flipped subjects are associated to the highest subject ids. Data is discretized using SAX with an alphabet of 5 symbols (\(r_{i}=5\) for all \(i\)). Transitions displayed in red are classified as abnormal while in green are classified as normal.