## 4 Proposed Anomaly Detector
### Normal Model  
The heart of a semi-supervised AD algorithm is, of course, the model of normal behavior. For the case of semi-supervised contextual AD, one can design the normal model by either reducing the contextual AD problem to a point AD one or by designing a model of the contextual problem. In the latter case, the model is then used to forecast normal behavior, and the AD algorithm will treat deviations from the forecast as anomalies. For the specific case of AD in time series data, a number of studies have employed regression-based forecasting algorithms, often from the Auto-Regressive Integrated Moving Average (ARIMA) family, as normal models [5]. An ARIMA(\(p\),\(d\),\(q\)) model is given by  
\[(1-\sum_{i=1}^{p}a_{i}L^{i})\cdot(1-L)^{d}X_{t}=(1-\sum_{i=1}^{q}\beta_{i}L^{i} )\cdot\epsilon_{t} \tag{1}\]  
where \(p\) lags are taken, \(\alpha_{i}\) is the auto-regression coefficient of the \(i\)-th lag, \(L\) is the lag operator (representing a previous observation \(X_{t-i}\)), \(d\) is the order of differencing, \(X_{t}\) is the \(t\)-th element of a time series, \(q\) is the width of the moving-average window, \(\beta_{i}\) is the moving-average coefficient of the \(i\)-th lag, and \(\varepsilon_{t}\) is the \(t\)-th error term; errors are assumed to be i.i.d. random variables drawn from a zero-mean normal distribution [59]. The topic of auto-regressive models is well-known in statistics, and we direct the reader to those sources for further information. Numerous shallow machine learning algorithms have also been trained as forecasters for this role. Generally, ML algorithms are adapted for time series forecasting by making use of [PERSON] results [54] on dynamical systems. It was shown that the unknown state space for the dynamical system that produced a time series can be reconstructed at a chosen point by taking a sufficient number of lags of the time series. A time series is thus \"embedded\" into a set of ordered vectors of previous observations leading up to each point  
Figure 4: Proposed anomaly detector. in the time series (less a few points at the beginning). At the \(n\)-th observation of the time series, a delay vector has the form  
\[\vec{x}_{n}=\left(x_{n-(m-1)d},x_{n-(m-2)d},\ldots,x_{n}\right) \tag{2}\]  
where \(m\) is the number of lags (equivalently, the number of dimensions in the reconstructed state space), and \(d\) is a \"delay\" parameter that allows for subsampling of the time series (allowing one to control the temporal correlations between elements of the vector); both are integers. Per [PERSON] (2016), if a sufficient number of lags are taken, the embedding space is related to the unknown original one by a smooth, invertible mapping; they are thus equivalent, and the future values of the time series can be predicted from the lags. All values of the \(d\) parameter are mathematically equivalent, but in practice, excessive temporal correlations obscure the _spatial_ correlations that define an attractor in state space (Kal  
is to determine the maximum-margin hyperplane separating the training data points from the origin point (zero vector) of the space \(F\). The key parameters for learning the hyperplane are the chosen kernel and its parameters and the margin parameter \(\
u\) (which represents the probability of a normal example in the test dataset appearing outside the class boundary). Drawing these points together, we therefore find that the occurrence of a large number of false positives with OC-SVM as our AD algorithm would be due to the empirical distribution in the test set not matching the empirical distribution in the training set; i.e., a covariate shift occurs. Covariate shifts are a subclass of the general sample-selection bias problem, sometimes also called learning from imbalanced data. As such, the techniques for learning under imbalanced data appear to be reasonable candidates for modifying our hybrid AD algorithm.