# Anomaly Detection in High-Dimensional Time Series Data with Scaled Bregman Divergence
## 2 Materials and Methods
### Algorithm and Computational Complexity Analysis
#### 2.3.1 Anomaly Detection Algorithm
In our studies, we select \(\alpha=0.1\) in most cases because this choice achieves a good balance between the training and testing distributions, ensuring stable and robust divergence calculations. Larger \(\alpha\) values tend to dilute the algorithm's ability to detect anomalies, as observed in the subsequent parameter sensitivity studies and consistent with [PERSON] et al. 's findings [40]. A sliding window approach is employed, with the window size for testing data fixed at 3 and the step size at 1, based on our preliminary studies for consistency analysis. These parameters may be adjusted to suit specific datasets and application requirements. The threshold \(\tau\) is set to a value of 0.9, representing the percentile above which a score is classified as a potential anomaly. The choice of \(\tau\) depends on the specific application and the acceptable trade-off between false positives and false negatives. A larger \(\tau\) value results in fewer identified anomalies, focusing on high-confidence detections; therefore, it is often preferred in high-stakes scenarios to minimize false alarms. Conversely, a smaller \(\tau\) value may classify a larger number of points as anomalies, potentially increasing false positives. This makes smaller \(\tau\) values more suitable for exploratory or less critical analyses, where capturing more potential anomalies for further investigation is a priority. ### Simulation Dataset

**Dataset 1: 1-dimensional data. ** We generate 300 observations, in which 298 data points were sampled from standard normal distribution, \(\mathcal{N}(0,1)\), and 2 anomalies were introduced at indices 34 and 68, which were generated from a shifted normal distribution, \(\mathcal{N}(10,1)\), with values 15 and 20, respectively. The first \(n_{tr}=200\) observations were taken as training data. Figures 1 and 2 illustrate the frequency of anomaly candidates and their mean dissimilarity scores across 100 repeated runs. The results are presented for the uLSIF (a, d), RuLSIF (b, e), and PLsBD (c, f) measures. Both the \(L_{1}\) (Figure 1) and \(L_{2}\) (Figure 2) loss function methods are evaluated. The mixing parameter \(\alpha\) is set to 0 for uLSIF, and 0.1 for RuLSIF and PLsBD. In the frequency plots, black bars indicate how often an observation in the test dataset is flagged as an anomaly in 100 runs. Red dashed vertical lines mark the true anomaly indices (34, 68). In the mean dissimilarity score plots, the black curve shows the mean normalized anomaly scores for each candidate, with red dashed vertical lines marking the true anomaly indices. Figure 1: Cont. Figure 1 demonstrates that when using the absolute error as the loss function, only the second anomaly is detected by the uLSIF, RuLSIF, and PLsBD methods. However, as shown in Figure 2, employing the squared error as the loss function enables uLSIF, RuLSIF, PLsBD to identify both anomalies. This highlights the superior performance of the scaled Bregman

Figure 1: Anomaly detection results in Dataset 1 using uLSIF, RuLSIF, and PLsBD methods with \(L_{1}\) loss function, and the mixing parameter \(\alpha\) is set to be 0.1 for RuLSIF and PLsBD. The black bars indicate the frequencies that an observation is flagged as an anomaly in 100 runs. Red dashed vertical lines mark the true anomaly indices (34, 68). \[\hat{\boldsymbol{\theta}}=(\widehat{\mathbf{H}}+\lambda\mathbf{I}_{n})^{-1} \widehat{\mathbf{h}}_{tr},\]0 Anomaly detection results in Dataset 1 using uLSIF, RuLSIF, and PLsBD methods with the \(L_{2}\) loss function, and the mixing parameter \(\alpha\) is set to be 0.1 for RuLSIF and PLsBD. The black bars indicate the frequencies that an observation is flagged as an anomaly in 100 runs. Red dashed vertical lines mark the true anomaly indices (34, 68). divergence-based anomaly detection methods (PLsBD and RuLSIF), which successfully detect the outliers at indices 34 and 68. The observations in Figures 1 and 2 suggest that the \(L_{2}\) loss is more effective in detecting anomalies than the \(L_{1}\) loss.