# Anomaly Detection in High-Dimensional Time Series Data with Scaled Bregman Divergence
## 2 Materials and Methods
### Algorithm and Computational Complexity Analysis
#### 2.3.1 Anomaly Detection Algorithm
Our subsequent data analysis continues to reveal that when the dataset contains fewer anomalies, the \(L_{2}\) loss function outperforms the \(L_{1}\) loss. However, the performance gap between the two loss functions diminishes significantly when the data contain many anomalies. Furthermore, RuLSIF and PLsBD consistently outperform uLSIF, which is a state-of-the-art anomaly detection method, in both scenarios, highlighting their superior performance in anomaly detection tasks. \[\hat{\boldsymbol{\theta}}=(\widehat{\mathbf{H}}+\lambda\mathbf{I}_{n})^{-1} \widehat{\mathbf{h}}_{tr},\]2 Anomaly detection results in Dataset 2 using uLSIF, RuLSIF, and PLsBD methods with the \(L_{1}\) loss function, and the mixing parameter \(\alpha\) is set to be 0.01 for RuLSIF and PLsBD. The black bars indicate the frequencies that an observation is flagged as an anomaly in 100 runs. Red dashed vertical lines mark the true anomaly indices (40, 80). Our next step is to apply Algorithm 1 to analyze real-world low- and high-dimensional data, and to evaluate their performance in more complex, practical settings. ### Real-World Datasets

**Yahoo S5 A2 Benchmark Dataset. ** The Yahoo S5 benchmark dataset is widely used for evaluating anomaly detection methods, focusing on trend analysis and identifying deviations from normal patterns. It includes multiple one-dimensional time series datasets, and each dataset has three columns: timestamp (in Unix format), value (numerical measurements), and is.anomaly (binary label: 0 for normal, 1 for anomaly). In this experiment, we focus on the synthetic data 11 from the A2 Benchmark datasets, a subset of the Yahoo S5 benchmark. The values in synthetic data 11 exhibit a periodic cyclical trend with regular fluctuations. In our analysis, we use a subset of values from indices 450 to 550 as the training set, as it contains only normal data. The test set includes time points from indices 601 to 701, with anomalies occurring at indices 624-626 and 659-661. Given their close proximity, we treat indices 624-626 and 659-661 as two distinct anomaly intervals. The size of the sliding window is set to 3 and step size to 1, which are the same as the simulation data analysis, and all the experiments are repeated 50 times. Figure 6 illustrates the frequency of anomaly candidates and their mean divergence scores over 50 runs using uLSIF (a, d), RuLSIF (b, e), and PLsBD (c, f) measures with the \(L_{2}\) loss. Since the anomalies are grouped into two clusters (624-626 and 659-661), an anomaly is considered detected if any point within a cluster is identified. The results

\[\hat{\boldsymbol{\theta}}=(\widehat{\mathbf{H}}+\lambda\mathbf{I}_{n})^{-1} \widehat{\mathbf{h}}_{tr},\]3 Anomaly detection results in Dataset 2 using uLSIF, RuLSIF, and PLsBD methods with the \(L_{2}\) loss function, and the mixing parameter \(\alpha\) is set to be 0.01 for RuLSIF and PLsBD. The black bars indicate the frequencies that an observation is flagged as an anomaly in 100 runs. Red dashed vertical lines mark the true anomaly indices (40, 80). demonstrate that the PLsBD method, based on scaled Bregman divergence, outperforms other approaches, including uLSIF and RuLSIF, by accurately detecting all anomalies while minimizing false positives. In comparison, the traditional uLSIF method identifies false anomaly intervals, and RuLSIF produces flat mean divergence scores, which fail to reliably detect anomalies and result in numerous false positives. Therefore, our PLsBD method provides a more robust and reliable framework for anomaly detection, particularly in challenging scenarios. We increased \(\alpha\) from 0.1 to 0.5 and evaluated the performance of RuLSIF and PLsBD using both absolute and squared error loss functions. Figure 7 shows that with the \(L_{1}\) loss, both methods detected the two anomaly intervals, but RuLSIF introduced more false positives near the dataset's end, likely due to increased sensitivity to minor fluctuations.