# Online Forecasting and Anomaly Detection Based on the ARIMA Model
## 2 Materials and Methods
### Anomaly Detection Algorithms
#### 2.4.2 One Point Prediction
To evaluate the anomaly detection algorithm in the entire set of \(D\) datasets, it is necessary to add them together:

\[S^{A}=\sum_{d\in D}S^{A}_{d} \tag{11}\]

The final score is:

\[S^{A}_{NAB}=100\cdot\frac{S^{A}-S^{A}_{\text{null}}}{S^{A}_{\text{perfect}}-S^{A }_{\text{null}}} \tag{12}\]

where \(S^{A}_{\text{perfect}}\) is a perfect score in which all anomalies are detected correctly and there are no false positives; \(S^{A}_{\text{null}}\) is a score in which no anomalies are detected. The better the final score, the better the anomaly detection algorithm. The best result is equal to 100. ### Python Library

One of the results of this work is the Anomaly Detection Library, named \"ARIMAFD\". The library is implemented in the Python3 programming language. It includes an algorithm based on the ARIMA model for both forecasting and anomaly detection problems and others algorithms, as described in this paper. The advantages of algorithms from this library include the fact that a training set is not necessary, as well as the ability to work in online mode (batch processing). The disadvantages include the laborious process necessary to obtain the stationarity of the time series and to use heuristics. The Anomaly Detection Library can be installed via the Python Package Index (PyPI) or via a link on GitHub [[https://github.com/waico/arimafd](https://github.com/waico/arimafd)]([https://github.com/waico/arimafd](https://github.com/waico/arimafd)) (accessed on 1 April 2021). For the purpose of unification, the commands and API design were developed in comparison with the scikit-learn library. An MIT License was used for the library. ## 3 Results

### Forecasting by Online Algorithms

We used one specific time series, received from the sensors of the turbogenerator in a single operational mode without transients, which produces a total of 25 thousand samples in about half a month. The choice to use only one time series was due to our desire to compare the forecast results for one physical quantity. The time series was separated in the training and testing sets, accordingly, as 5 and 20 thousand samples (5 thousand samples are enough for the first training period). At each point in the testing set, the results were evaluated. Table 2 presents the results for time series forecasting by various online algorithms, as presented in Section 2.2. The results in Table 2 are presented in more detail in Figure 2. Despite the fact that the MAPE curves of the non-refitted ARIMA, full refitting and window refitting algorithms are visually merged into one (their similar numerical values are shown in Table 2), this picture shows the general behavior of the algorithms' MAPE with an increase in the forecast horizon. We discuss the results more broadly in Section 4. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Algorithm**} & \multicolumn{4}{c}{**MAPE, \%**} & \multirow{2}{*}{**Training**} \\ \cline{2-2} \cline{4-6}  & **1 Point** & **30 Points** & **60 Points** & **180 Points** & **Time Ratio** \\ \hline Non-refitted ARIMA & 0.1642 & 0.3828 & 0.4713 & 0.7886 & 0.00 \\ Full refitting & 0.1644 & 0.3808 & 0.4698 & 0.7887 & 205.24 \\ Window refitting & 0.165 & 0.3823 & 0.4725 & 0.7914 & 16.04 \\ Online gradient descent & 0.1667 & 0.3895 & 0.4936 & 0.9036 & 1.00 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Mean absolute percentage error of algorithms and ratio of learning time between algorithms. Non-refitted Autoregressive Integrated Moving Average (ARIMA) is an algorithm with unchanged weight coefficients for the testing set after fitting on the training set. The training time ratio is the ratio of the mean time taken for one model retraining procedure in the research algorithm compared to the mean time taken for one model retraining procedure in the Gradient Descent algorithm (0.09 s per one retraining procedure by the Intel Core i9-9900K processor). ### Anomaly Detection

Using the Numenta Anomaly benchmark [9], the developed anomaly detection algorithm based on the ARIMA model was tested.