# Time Series Anomaly Detection Using Signal Processing and Deep Learning
## 4 Experiment and Results
### Real-World Datasets  
We explore several real-world datasets as shown in Table 1 that have been used previously for time series anomaly detection tasks in the literature. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Dataset** & **\# of Training Data** & **\# of Test Data** & **Dimensions** & **Anomaly \%** \\ \hline MSL [57] & 58,317 & 73,729 & 55 & 10.5 \\ SMAP [57] & 135,183 & 427,617 & 25 & 12.8 \\ SMD [56] & 58,317 & 73,729 & 38 & 10.72 \\ PSM [58] & 132,481 & 87,841 & 25 & 27.8 \\ SWAN [59] & 60,000 & 60,000 & 38 & 32.6 \\ SWAT [60] & 99,000 & 89,984 & 26 & 12.2 \\ WADI [61] & 1,048,571 & 172,801 & 123 & 5.99 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Benchmark dataset information. Figure 3: Anomaly label adjustment strategy for time series data. MSL and SMAP: Both MSL (Mars Science Laboratory rover) and SMAP (Soil Moisture Active Passive satellite) are public datasets from [57] with 55 and 25 dimensions, respectively, which contain the telemetry anomaly data derived from the Incident Surprise Anomaly (ISA) reports of spacecraft monitoring systems. In these multivariate datasets, most features only have binary values. SMD: The Server Machine Dataset [56] was collected from a large Internet company with 38 dimensions (5 weeks of data total). We used 37 columns, eliminating 1 column without any value change. PSM: The Pooled Server Metrics [58] dataset was collected internally from multiple application server nodes at eBay, and the dataset has 26 dimensions. SWAN: SWAN is a multivariate time series dataset with 38 features, and it contains solar photospheric vector magnetograms in the Spaceweather HMI Active Region Patch (SHARP) series [59; 62]. SWaT: The Secure Water Treatment [60] is time series data from a modern industrial control system for security research and training that have 51 sensors under continuous operations. The data were collected over 11 days, and during the last 4 days, 36 attacks were launched with different intents and durations. After data cleaning, we used 41 columns, removing columns without value change and columns that have been recommended to be removed in [3]. WADI: The 14-day-long time series data from a water distribution system is presented in [61]. This testbed was used to analyze the security of water distribution networks and the effects of potential cyber and physical attacks. The dataset originally had 130 columns, but for our experiments, we reduced the dataset to 52 columns after eliminating highly correlated columns and columns without value changes. Each benchmark dataset was pre-split into training and test data, where the training data were assumed to only have normal samples while the test data contained a mix of normal and abnormal samples. In our experimental setup, 20% of the training data were set aside for validation and a window size of 100 was used for all datasets, as recommended in [9]. We used a bandpass filter cutoff frequency of 5-45 Hz (based on the Nyquist frequency). The model's hyperparameters were tuned using the validation data, which were also utilized to determine the anomaly detection threshold. This approach ensured that the model was optimized and calibrated before being evaluated on the test data. The experiments were performed on an 8-core M2 CPU, where the hyperparameter search for the number of layers (3, 5, 7), neurons (5, 10, 25, 50), activation functions (ReLU, Tanh, Linear), and others were kept in a similar range in the bottleneck network across the architectures (MLP, LSTM, and FNN) to ensure a fair comparison. We focused on matching the total number of trainable parameters so that each model had a similar capacity. We evaluate our proposed anomaly detection approach (FNN) on seven real-world datasets, comparing it with two other neural network types (MLP and LSTM) and assessing the performance under both bandpass (BP) and No-bandpass (No BP) filtering settings. Tables 2 and 3 show the F1 score and AUC score results for all methods over the seven datasets, respectively.