# Anomaly Detection in High-Dimensional Time Series Data with Scaled Bregman Divergence
## 2 Materials and Methods
### Algorithm and Computational Complexity Analysis
#### 2.3.1 Anomaly Detection Algorithm
\(L_{1}\) loss can detect more pronounced anomalies like the one at index 68, which appears less sensitive to subtle outliers such as the one at index 34. The squared error tends to yield larger values when anomalies are present compared to the absolute error, which enhances its sensitivity to outliers. This explains why the least squared loss has been widely adopted in anomaly detection and change-point detection in prior studies. Our findings demonstrate that the performance of RuLSIF and PLsBD is sensitive to the choice of the mixing parameter \(\alpha\). Figure 3 presents the dissimilarity scores computed using RuLSIF and PLsBD with \(\alpha=0.5\). Notably, Figure 2(c) reveals significant fluctuations in the dissimilarity score when employing the \(L_{2}\) loss function with RuLSIF, whereas PLsBD exhibits comparatively greater stability under the same conditions. The introduction of the mixing distribution aims to address the unboundedness issue; however, a larger mixing rate indicates that the testing data contain too much influence from the training data, potentially diluting the ability to detect anomalies or distributional differences effectively, eventually increasing false positives. Therefore, we selected a smaller \(\alpha\) value for our subsequent data analysis to enhance performance. **Dataset 2: 2-dimensional data. ** Similar to Dataset 1, we generate 300 samples of 2-dimensional data drawn from a multivariate normal distribution \(\mathcal{N}(\mathbf{0},\mathbf{I})\), where \(\mathbf{0}\) is the zero mean vector, and \(\mathbf{I}\) is the identity covariance matrix. Two anomalies are introduced at indices 40 and 80 in the test set, with anomaly values shifted to \(\mathbf{10}\) in both dimensions. Figure 4 illustrates the frequency of anomaly candidates and their mean dissimilarity scores across 100 repeated runs using the uLSIF (a, d), RuLSIF (b, e), and PLsBD (c, f) measures, with parameters learned via the \(L_{1}\) loss function. Figure 3(a,d) reveals that the uLSIF method exhibits the weakest performance in anomaly detection. Numerous data points are incorrectly identified as anomalies in the frequency plot, while the mean dissimilarity score remains flat and fails to provide meaningful insights. In contrast, the

\[\hat{\boldsymbol{\theta}}=(\widehat{\mathbf{H}}+\lambda\mathbf{I}_{n})^{-1} \widehat{\mathbf{h}}_{tr},\]1 Dissimilarity score plots using RuLSIF and PLsBD methods with \(L_{1}\) and \(L_{2}\) loss functions, employing a mixing parameter of \(\alpha=0.5\). The analysis was conducted in a single run on Dataset 1. Red dashed vertical lines mark the true anomaly indices. introduction of a small mixing parameter \(\alpha=0.01\) in RuLSIF significantly enhances its performance. While PLsBD also identifies the two true anomalies, RuLSIF outperforms PLsBD by producing fewer false positives. This is evident in Figure 3(b),e, where RuLSIF displays two distinct peaks in the mean score plot, accurately corresponding to the true anomalies at indices 40 and 80. When using squared error as the loss function, as shown in Figure 5, all methods, uLSIF, RuLSIF, and PLsBD, demonstrate similar performance, consistently identifying the injected anomalies at indices 40 and 80 with minimal false positives. This result further supports the conclusion that the \(L_{2}\) loss is more effective for anomaly detection compared to the \(L_{1}\) loss. It is important to note that, since we employ a sliding window approach, an outlier candidate is treated as successfully detected if it falls within the interval \([i-\text{window size}+1,i]\). Our studies also indicate that larger window sizes and step sizes can decrease the sensitivity and overall performance of all anomaly detection algorithms. Consequently, in our studies, we have opted to use smaller window and step sizes to optimize detection sensitivity. In summary, the findings from Figures 1-5 indicate that anomaly detection using the \(L_{2}\) loss is generally more reliable than the \(L_{1}\) loss in most cases with both RuLSIF and PLsBD methods.