# Online Detection and Fuzzy Clustering of Anomalies in Non-Stationary Time Series +
## 1 Introduction  
Real-time signal processing plays a predominant role in advanced industrial systems. Recently, the demand for high-speed signal processing for streaming data has significantly increased, especially in the fields of online surveillance, real-time communication, and intelligent control [1; 2; 3; 4; 5]. Online analysis of streaming data can reveal valuable timely information about a system and allow rapid interventions. Anomalies are patterns in data that differ substantially from an expected behaviour [6; 7; 8]. There are two types of anomalies prevalent in time series data: point anomalies, where single data points do not comply with the neighbouring local pattern, e.g., a banking transaction of a much larger monetary value than a client's norm, and collective anomalies, where groups of consecutive data points do not follow the general pattern, e.g., a period of reduced traffic intensity due to a car accident. Anomalies frequently arise in data as symptoms of undesirable events such as malicious activity, external attacks, emergencies, system faults, etc. Thus, detecting and diagnosing anomalies in a timely manner can help ensure the safety, efficiency, and optimality of critical systems [1; 3; 5]. Traditionally, anomaly detection methods have been classified into three groups based on the level of external information provided: _supervised_, where examples of previous (labelled) anomalies are used as a basis for detection; _unsupervised_, where no such information is available and artefacts are identified purely on the basis of their deviation from the bulkof the data; and _semi-supervised_, where some intermediate level of information is provided, e.g., labelling of portions of data that are definitively non-anomalous. Since supervised and semi-supervised approaches typically necessitate some human effort in segregating and labelling anomalies (which can be expensive and incompatible with large, streaming, multivariate data settings), much of modern anomaly detection, including this work, focuses on the unsupervised setting. However, most of the current unsupervised anomaly detection approaches fail on non-stationary signals, as the distribution of normal data points may shift with time but the approaches' partitioning methods are static [7; 8; 9]. Finally, it is worth mentioning in some other works [3; 9; 10], which explored anomaly detection in nonlinear signals via data distribution estimation or next state prediction. These methods can handle the task of separating anomalies from a changing baseline. However, they do not address the problem of classifying and identifying the different types of anomalies for early intervention. We propose a new three-part framework to _detect and cluster_ anomalies in non-stationary time series which can be used for unsupervised anomaly detection and analysis. We combine an online NARX (nonlinear autoregressive with exogenous input) detrending regime with anomaly detection (via SCAPA (sequential collective and point anomaly)) and a fuzzy clustering algorithm. NARX models are widely implemented due to their robust capabilities in the representation of complex systems that the standard ARIMA approaches cannot model [11]. SCAPA [12; 13; 14] simultaneously detects point anomalies and anomalous regions (_collective anomalies_) in the detrended series via an efficient dynamic programming regime. Finally, collective anomaly segments can be clustered via fuzzy c-means clustering [15] of their empirical distribution functions (ECDFs). In summary, our main contribution is the provision of a method (for the first time, as far as we are aware) that considers the entire end-to-end process of  
1. Detrending non-stationary time series,
2. Detecting anomalies in the residual series,
3. Grouping similar anomalies via fuzzy clustering. Each phase uses state-of-the-art techniques from its requisite literature and can be applied effectively to multivariate series across various variants of non-stationarity and many classes of anomalous artefacts.