## 4 Double-Criteria Drift Streaming Peaks over Threshold (DCDSPOT)
### Multi-Tier Thresholds  
The original threshold-based anomaly detection often sets a single threshold. Once the threshold is exceeded, the value here is determined to be an anomaly, such as setting threshold based on threshold library [30], setting threshold based on expert experience [31], \(3\sigma\) criterion, and mixture Gaussian distribution [32]. The original methods are simple and fast, but they have poor robustness, because the setting of the threshold is not completely automatic, some risk parameters (such as \(q\) in SPOT) need to be set manually, and the selection is often subjective and instable. To enhance the robustness, we introduce multi-tier thresholds based on biDSPOT, which is suitable for multivariate time series. First, we define the high-tier, medium-tier, and low-tier thresholds \(TU_{h}\), \(TU_{m}\), and \(TU_{l}\) of the target parameter. \(TU_{h}\) is the limit of the threshold, once the value of the target parameter exceeds \(TU_{h}\), then it can be concluded to be an anomaly. \(TU_{l}\) is a safety threshold,and if the value of the target parameter does not exceed \(TU_{l}\), it can be concluded that it is not an anomaly. \(TU_{m}\) can be regarded as an \"alarm\" threshold, when the value of the target parameter exceeds \(TU_{m}\), it is likely to be anomalous. The \"high-tier, medium-tier, and low-tier\" thresholds mentioned above are applicable to anomaly detection of \"exceeding upper limit\". To detect values that exceed low limit, we use lower thresholds denoted by \(TL_{h}\), \(TL_{m}\), and \(TL_{l}\). All thresholds are computed using the biDSPOT by setting different risk parameters (see Equation (11)). \[ \begin{array}{l}X=[x_{1},x_{2},...,x_{n},x_{n+1},...,x_{N}]\\ thu_{h},thl_{l}=biDSPOT(X,q_{1})\\ thu_{m},thl_{m}=biDSPOT(X,q_{2})\\ thu_{l},thl_{h}=biDSPOT(X,q_{3})\\ TU_{h},TU_{m},TU_{l}=\max,med,\min\{thu_{h},thu_{m},thu_{l}\}\\ TL_{h},TL_{m},TL_{l}=\max,med,\min\{thl_{h},thl_{m},thl_{l}\}\end{array}  \tag{11}\]  
\(q_{1}\), \(q_{2}\)and \(q_{3}\) denote high, medium, and low risk parameters, and \(q_{1}<q_{2}<q_{3}\). The reason for using the last two sub-equations in Equation (11) is that due to the error of parameter estimation, the threshold computed by \(q_{1}<q_{2}<q_{3}\) does not necessarily lead to \(TU_{h}>TU_{m}>TU_{l}\), so we need to reorder them to get the result we want. \"\(\max,\min,med\)\" means to find the maximum, minimum, and median of numbers. \(biDSPOT(\cdot)\) denotes using Algorithm 1 and methods illustrated in Section 2.3 to compute upper and lower thresholds. Similarly, we can also define high-tier, medium-tier, and low-tier thresholds for the WSP. The \"exceeding upper limit\" thresholds are denoted by \(STU_{h}\), \(STU_{m}\), and \(STU_{l}\). The \"exceeding low limit\" thresholds are denoted by \(STL_{h}\), \(STL_{m}\), and \(STL_{l}\). \[ \begin{array}{l}\mathbf{V}_{X}=\mathbf{w}^{T}\mathbf{U}=[v_{1},v_{2},...,v_ {n},v_{n+1},...,v_{N}]\\ sthu_{h},sthl_{l}=biDSPOT(\mathbf{V_{X}},p_{1})\\ sthu_{m},sthl_{m}=biDSPOT(\mathbf{V_{X}},p_{2})\\ sthu_{l},sthl_{h}=biDSPOT(\mathbf{V_{X}},p_{3})\\ STU_{h},STU_{m},STU_{l}=\max,med,\min\{sthu_{h},sthu_{m},sthu_{l}\}\\ STL_{h},STL_{m},STL_{l}=\max,med,\min\{sthl_{h},sthl_{m},sthl_{l}\}\end{array}  \tag{12}\]  
\(p_{1}\), \(p_{2}\), and \(p_{3}\) denote high, medium, and low risk parameters, and \(p_{1}<p_{2}<p_{3}\). Generally, we set \(p_{i}=q_{i}(i=1,2,3)\). For WSP, we only need two tiers of threshold, but we still compute the thresholds using three risk parameters, because we must ensure that the thresholds of target parameter and WSP are determined at the same risk levels. In order to detect anomaly according to the multi-tier thresholds, we formulate two criteria for WSP and target parameter, which are given in Table 1. When the values of target parameter and the WSP meet the two criteria respectively at the same time, the value of the target parameter is judged to be an anomaly.