## 3 Proposed Method
### Time Series Analysis of Coefficients  
A time series is a sequence of chronologically ordered data, of which there are two varieties: discrete-time and continuous-time. Discrete-time indicates that data are collected in equally spaced time intervals (every hour, every day), whereas continuous-time indicates that data are collected non-stop. The motivation behind performing a time series analysis varies by field and by project. For example, in economics and meteorology the primary motivation is forecasting, whereas in machine learning and data mining, time series analysis can serve as a tool for anomaly detection, classification, and clustering.  
Our method utilizes the Autoregression Moving Average (ARMA) model [24] for the purpose of anomaly detection on the ERGM time series data. The ARMA model was chosen because it excels at modeling weakly stationary stochastic processes, such as network traffic data, which exhibits daily as well as weekly patterns. The ARMA model consists of two polynomials: an AR (autoregression) polynomial and an MA (moving average) polynomial. The autoregression polynomial can be expressed as follows:  
\[X_{t}=c+\sum_{i=1}^{p}\phi_{i}X_{t-i}+\epsilon_{t} \tag{5}\]  
where \(c\) is a constant, \(\epsilon_{t}\) is a white noise random variable, and \(\Phi_{1}\ldots\Phi_{p}\) are parameters. An AR model by itself forecasts future data points in a time series data set by learning the Partial Autocorrelation Function (PACF) for an order of \(p\) points, where \(p\) is a parameter representing the number of lagged values the PACF includes and the order of the AR model. For example, an order 8 AR model's prediction for point \(x_{100}\) would depend on the values of \(x_{92}\) to \(x_{99}\) and their respective learned coefficients \(\Phi\). This notation is usually represented as AR(8).  
The Moving Average portion of the model can be expressed as follows:  
\[X_{t}=\mu+\epsilon_{t}+\sum_{i=1}^{q}\theta_{i}\epsilon_{t-i} \tag{6}\]  
where \(\mu\) is the mean of the time series, \(\epsilon_{t}\ldots\epsilon_{t-q}\) are error terms, \(q\) is the order of the MA model, and \(\Theta_{1}\ldots\Theta_{q}\) are model parameters. The error term \(\epsilon_{i}\) for some point at index \(i\) is calculated as follows:  
\[\epsilon_{i}=f_{t}-\hat{f}_{t} \tag{7}\]  
where \(f_{t}\) is the actual value and \(\hat{f}_{t}\) is the predicted value. The error terms as a whole are assumed to be normally distributed with a mean of zero and are sometimes referred to as white noise error terms. The MA model makes predictions on future data points by tweaking its parameters according to the error in previous predictions.  
Combined, these two components make up the ARMA model. The notation ARMA(\(p\),\(q\)), therefore, refers to the following model:  
\[X_{t}=c+\epsilon_{t}+\sum_{i=1}^{p}\phi_{i}X_{t-i}+\sum_{i=1}^{q}\theta_{i} \epsilon_{t-i} \tag{8}\]  
In our approach, the ARMA is trained first; then. it calculates variable-sized prediction windows for a few points into the future; and if the observations fall outside the range, an alert is raised for an anomalous event. The anomaly detection technique is further described in Section 4.4.