# Semi-Supervised Time Series Anomaly Detection Based on Statistics and Deep Learning
## 1 Introduction  
Anomaly detection involves identifying data that do not conform to the pattern as expected [1, 2]. It is also known as outlier detection [3, 4] or novelty detection [5]. The research of anomaly detection can be traced back to the 18 th century when [PERSON] commented on the widespread practice of discarding discordant data in the absence of a priori information in 1777 [6, 7]. Undoubtedly, anomaly detection has attracted much research attention, bring about plenty of research results that can be utilized in various applications. Typical applications of anomaly detection research include outlier detection for big data [8], Internet of Things (IoT) [9], wireless sensor networks (WSNs) [10], network anomaly /intrusion/attack detection [11, 12, 13, 14, 15, 16], anomaly detection for manufacturing [17, 18, 19, 20, 21], video surveillance anomaly detection [22, 23], road network/highway traffic anomaly detection [24, 25], credit card fraud identification [26, 27], insurance fraud detection [28], ECG (electrocardiogram) monitoring [29], suspicious financial transaction detection [30], social media rumor detection [31], and so on. Thanks to the advances of novel technologies, such as sensor technologies and information and communication technologies, big amounts of data are continuously gathered over time. Data that are recorded chronologically constitute a time series. Typical examples of time series include the following gathered data: hourly temperatures of a machine, daily stock prices of a company, weekly interest rates, monthly sales of a store, and yearly GDP (gross domestic product) of a nation. Time series anomaly detection is very important; it is one of fundamental time series analysis tasks. Many studies have focused on such a research field in the last decades. The readers are referred to the survey papers [32, 33, 34, 35] for details. Time series can be categorized into two types: univariate time series and multivariate time series. The former can be regarded as a sequence of scalar values, whereas the latter as a sequence of multi-dimensional vectors. This paper focuses on univariate time series and proposes a semi-supervised anomaly detection framework, called Tri-CAD (standing for tri-class anomaly detection), for such time series. Tri-CAD is semi-supervised, as explained below. Anomaly detection methods can be broadly categorized into three types: supervised, unsupervised, and semi-supervised methods. A supervised method takes datasets that have data labeled as normal or abnormal (anomalous) to train or model a classifier. An unsupervised method takes unlabeled data as input under the assumption that the majority of data are normal. Data are identified as abnormal if they fit least to the rest of data. A semi-supervised method takes datasets of normal data as input to train a model representing the normal behavior of data. Test data are then fed into the trained model to check if they deviate from the normal behavior of data. If so, they are regarded as abnormal. Tri-CAD is semi-supervised in the sense that it takes the first \(D\) (say, \(D=1000\)) data of time series as input under the assumption that the first \(D\) data are normal. Tri-CAD adopts this assumption because of the following practical considerations. Time series associated with well-functioning systems usually contain a large amount of normal data. Abnormal data are very rare; they are even never observed or kept in time series. Specifically, Tri-CAD takes the first \(D\) data as training data (also called normal data), and the rest of the data are taken as test data. By the first \(D\) data, Tri-CAD divides time series into three classes according to the Pearson product-moment correlation coefficient [36] and Dickey-Fuller test [37]. The three classes of time series are (Class 1) periodic time series, (Class 2) stationary time series, and (Class 3) non-periodic and non-stationary time series.