# Semi-Supervised Time Series Anomaly Detection Based on Statistics and Deep Learning
## 3 Proposed Anomaly Detection Framework
### Non-Periodic and Non-Stationary Time Series Anomaly Detection  
A time series is regarded to be non-periodic and non-stationary if it is judged to be neither periodic nor stationary. For non-periodic and non-stationary time series, Tri-CAD adopts WT to extract the time-frequency features of the time series and then uses the AE to encode and then decode the time-frequency features. For WT and AE to execute properly, the standardization mechanism is used to standardize the original time series data so that the data follow the standard normal distribution with the mean of 0 and the  
Figure 5: A large global sliding time window and a small local sliding time window of a stationary time series for calculating the ratio of data means.  
standard deviation of 1. The standardization is performed by transforming each data value according to (11).  
\[x_{i}^{\prime}=\frac{x_{i}-\mu}{\sigma} \tag{11}\]  
where \(x_{i}\) is the original data value; \(x_{i}^{\prime}\) is the standardized data value; and \(\mu\) and \(\sigma\) are the mean and the standard deviation of the original data, respectively.  
Tri-CAD applies DWT and AE to the \(D\) data of the normal dataset. To be more specific, a moving sliding time window of size _ws_ (say _ws_ = 60) is used to get _ws_ data to go through DWT with Haar as the mother wavelet to get _ws_ DWT coefficients. The _ws_ coefficients are then taken as the input to train the AE model. The stride of the moving sliding time window is 1. So, there are \(D-ws+1\) sliding windows of data taken as the training data to train the AE model. The reconstruction errors of the AE are obtained, and the mean \(\mu\) and the standard deviation \(\sigma\) of the errors are calculated.  
The AE neural network structure is shown in Figure 6. The sizes of the input layer and the output layer are both _ws_ (say, 60). The numbers of neurons in the hidden layers are 32, 16, 8, 4, 2, 4, 8, 16, and 32, respectively. The code has the dimension of 2, as the number of neurons in the middle layer is 2. The encoder takes the scaled exponential linear unit (SELU) function as the activation function, whereas the decoder takes the hyperbolic tangent (Tanh) function as the activation function. The error function (or loss function) is the mean square error (MSE), and the optimizer is the adaptive moment estimation (Adam). To avoid overfitting, the early stop mechanism is used. Specifically, a part of the training dataset is split out to be the validation data set. The training process of the AE model proceeds epoch by epoch. Once the MSE value of the validation data starts to rise, the training stops, so that the AE model does not fit the training data too closely to avoid the overfitting problem.  
Similarly, Tri-CAD applies WT and AE to every data point \(x\) in the test dataset. The AE reconstruction error is assumed to be the anomaly score of x, and the SAS \(\lambda_{x}\) is derived according to Equation (9). Likewise, if \(\lambda_{x}\) is increasing and exceeds a pre-specified threshold, the data point \(x\) is regarded as anomalous.