# Online Forecasting and Anomaly Detection Based on the ARIMA Model
## 2 Materials and Methods
### Anomaly Detection Algorithms  
#### 2.4.1 Novel Anomaly Detection Algorithm Based on OGD Algorithm  
According to the definition in [20], the technical state is the state of the system at a certain point in time, which, under certain environmental conditions, is characterized by the values of the parameters established by the technical documentation for the system. In our case, this is \(X_{t}\). This state may implicitly include information about the presence of a defect or other anomaly in a system. Applying the ARIMA models to these parameters can make the presence of an anomaly in a technical system more apparent. Weight coefficientscan provide more transparent and precise information about changes in a system state than the parameters themselves. The Online Gradient Descent algorithm allows us to track weight coefficients in online mode. This makes it possible to use the base of the Online Gradient Descent algorithm not only for forecasting problems, but also for anomaly detection problems. For this, it is necessary to transform the OGD algorithm by essentially creating a novel algorithm based on it. Let us suppose that we have the entire history of the weight coefficients' changes in the form of vectors \(\gamma^{1}\ldots\gamma^{T-1}\). From Algorithm 1:  
\[\gamma^{t+1}\leftarrow\prod_{\mathcal{K}}\biggl{(}\gamma^{t}-\frac{1}{\eta} \
abla_{t}\biggr{)}\text{for each $t$ from $1$ to $T$} \tag{5}\]  
If the coefficient vector satisfies all the requirements, there is no need to project the vector of the weight coefficients. Then, this formula is converted into the following form:  
\[\gamma^{t+1}=\gamma^{t}-\frac{1}{\eta}\
abla_{t} \tag{6}\]  
However, tracking the values of the weight coefficients themselves is impractical for the following reasons:  
1. The optimal values of the weight coefficients are unknown initially. 2. The state of a considered system may gradually change over time. This will lead to a shift in the optimal values of the weight coefficients. This, in turn, can lead to a high false-positive rate in an anomaly detection algorithm. To avoid these shortcomings, we plot the discrete differences in the weight coefficients along a time axis. This solution allows us to analyze the state of the technical system more interpretably since, in a steady state, this value should tend toward 0 and, in the case of a change in an operating mode or anomaly mode, deviate from 0. Moreover, the value of the shift in each specific weight coefficient over the time interval is the sum of these weight coefficient values throughout the time interval. The vector of a discrete difference in a weight coefficient is:  
\[\
abla\gamma^{t}=\gamma^{t+1}-\gamma^{t}=-\frac{1}{\eta}\
abla_{t} \tag{7}\]  
Thus, a discrete difference vector must tend toward 0 when close to the optimum value. At the same time, a strong and sudden deviation from 0 may indicate the occurrence of an anomaly. In order to monitor these changes, a threshold can be introduced, which is a hyperparameter and requires separate tuning. Based on the above, an anomaly detection and forecasting algorithm was obtained (the pseudo-code is presented in Algorithm 4). As a rule, the state of a technical system is characterized by a large number of parameters that do not have the same scale and cannot be directly compared, which makes it difficult to describe the state of a technical system through the weights of the modernized ARIMA model. To solve this problem, the following normalization of the initial parameters was carried out:  
\[\tilde{X}_{i}=\frac{X_{i}-\mu}{\sigma} \tag{8}\]  
where \(\tilde{X}_{i}\) is a scaled time series, \(X_{i}\) is an initial time series, \(\mu\) is the expectation of \(X\), and \(\sigma\) is the standard deviation of \(X\).